hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A security team is troubleshooting an incident…
A security team is troubleshooting an incident where a compromised application running in a Kubernetes cluster on AWS EKS is being used to exfiltrate data to an external IP. They have deployed Cisco Secure Workload. How would the agent on the container report the exfiltration attempt?
⚠ Common exam trap
Cisco often tests the distinction between reporting mechanisms (violation events) and data-plane telemetry (NetFlow, syslog), expecting candidates to know that Secure Workload's primary incident reporting is through policy violation events, not traditional logging or flow exports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
By creating a violation for a policy that denies egress to unknown IPs
Cisco Secure Workload uses a policy-based enforcement model where agents enforce micro-segmentation rules. When a container attempts egress to an external IP not permitted by an explicit allow policy, the agent creates a violation event for the deny rule that blocks unknown destinations. This violation is the primary reporting mechanism for policy violations, including exfiltration attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
By creating a violation for a policy that denies egress to unknown IPs
Why this is correct
Policy violation is the standard reporting mechanism.
- ✗
By generating a syslog alert for outbound traffic
Why it's wrong here
Agents do not generate syslog alerts directly.
- ✗
By sending a NetFlow export to the controller
Why it's wrong here
NetFlow is not used in Cisco Secure Workload.
- ✗
By blocking the traffic automatically and terminating the pod
Why it's wrong here
Automatic termination is not default behavior.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.