mediumMultiple ChoiceObjective-mapped
350-701 Practice Question: Is configuring Cisco Umbrella to block malicious…
A security engineer is configuring Cisco Umbrella to block malicious domains. They need to ensure that internal DNS queries from remote users using Cisco AnyConnect are protected. Which deployment method should they use?
⚠ Common exam trap
Cisco often tests the misconception that VPN-based protection (like AnyConnect) inherently secures DNS traffic, but the trap here is that without a local agent like the Umbrella Roaming Client, DNS queries from remote users may bypass the corporate DNS policy and use the local ISP's DNS resolver.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the Umbrella Roaming Client on all endpoints
The Umbrella Roaming Client (now part of Cisco Secure Client) is the correct deployment method because it provides DNS-layer security directly on endpoints, including remote users connecting via AnyConnect. It intercepts DNS queries on the local machine and forwards them to Umbrella's cloud-based DNS resolvers, ensuring protection even when the user is off-network or behind a VPN. This is the only option that covers remote users without relying on network-level appliances or firewalls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure DNS Layer Security in the office firewall
Why it's wrong here
Office firewall does not protect remote users.
- ✗
Enable Cisco Cloudlock integration
Why it's wrong here
Cloudlock is a CASB, not for DNS security on endpoints.
- ✓
Install the Umbrella Roaming Client on all endpoints
Why this is correct
The Roaming Client secures DNS queries regardless of user location.
- ✗
Deploy the Umbrella virtual appliance at headquarters
Why it's wrong here
The virtual appliance protects on-premises traffic, not remote users.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.