350-701 Practice Question: Secure Network Access, Visibility and Enforcement
During a security incident, an investigator wants to identify all endpoints that communicated with a known malicious IP address within the last 24 hours. Which Cisco tool is best suited for this forensic analysis?
⚠ Common exam trap
Cisco often tests the distinction between real-time blocking tools (NGFW, Umbrella) and historical forensic analysis tools (Stealthwatch), leading candidates to choose a tool that prevents threats rather than one that retroactively identifies all affected hosts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco Secure Network Analytics (Stealthwatch)
Cisco Secure Network Analytics (Stealthwatch) is the correct tool because it provides network-wide visibility and flow-based analytics using NetFlow/IPFIX data. It can retroactively query all historical flow records to identify every endpoint that communicated with a known malicious IP address within a specified time window, making it ideal for forensic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cisco Firepower NGFW
Why it's wrong here
Next-gen firewall, not designed for historical forensics.
- ✓
Cisco Secure Network Analytics (Stealthwatch)
Why this is correct
Provides network visibility and historical flow analysis.
- ✗
Cisco Umbrella
Why it's wrong here
Cloud-based DNS security, not historical flow analysis.
- ✗
Cisco ISE
Why it's wrong here
Access control system, not traffic forensics.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.