Courseiva
mediumMultiple ChoiceObjective-mapped

350-701 Practice Question: An engineer is designing a cloud security…

An engineer is designing a cloud security solution using Cisco SD-WAN with cloud on-ramp. They want to ensure that traffic to a specific IaaS provider is inspected by the Cisco Umbrella SIG. Which configuration is necessary on the SD-WAN edge?

⚠ Common exam trap

Cisco often tests the distinction between DNS-layer security (Umbrella DNS) and full proxy-based SIG inspection; candidates mistakenly think DNS security alone provides the same traffic inspection as a service insertion policy.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Configure a service insertion policy for the cloud security provider

To direct specific traffic to Cisco Umbrella SIG for cloud security inspection, you must configure a service insertion policy on the SD-WAN edge. This policy intercepts traffic based on match criteria (e.g., destination IaaS provider IP/subnet) and forwards it to the cloud security service via a secure tunnel (e.g., IPsec or TLS). Without this policy, the SD-WAN edge will not redirect traffic to Umbrella for inspection.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Configure a service insertion policy for the cloud security provider

    Why this is correct

    Service insertion redirects traffic to the cloud security service for inspection.

  • Apply a DNS security policy

    Why it's wrong here

    DNS security only blocks malicious domains, not full traffic inspection.

  • Set up a site-to-site VPN to the IaaS

    Why it's wrong here

    VPN only provides encrypted connectivity, not security inspection.

  • Enable direct internet access for the branch

    Why it's wrong here

    Direct internet access would bypass the security inspection.

Visual reference

192.168.1.0 /24 256 addresses (254 usable) 192.168.1.0 /25 Subnet A 128 addr (126 usable) 192.168.1.128 /25 Subnet B 128 addr (126 usable) Borrowing 1 bit from host portion creates 2 subnets (/25)

Quick reference

VPN Protocol Comparison

ProtocolPortEncryptionAuthenticationUse Case
IKEv2 / IPsecUDP 500 / 4500AES-256Certificates / PSKSite-to-site & remote access
SSL / TLS VPNTCP 443TLS 1.3Certificates / MFAClientless remote access
L2TP / IPsecUDP 1701AES (IPsec)PSK / CertificatesLegacy remote access
WireGuardUDP 51820ChaCha20Public keysModern high-performance VPN
PPTPTCP 1723MPPE (weak)MS-CHAPv2Legacy — avoid in production

PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.

About these practice questions

This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.