mediumMultiple SelectObjective-mapped
350-701 Practice Question: Which TWO actions are recommended best practices…
Which TWO actions are recommended best practices for securing web traffic using Cisco Umbrella?
⚠ Common exam trap
A common trap is to assume that DNS-layer blocking alone is sufficient for web security, but Cisco Umbrella requires IP-layer enforcement to catch traffic that bypasses DNS (e.g., direct IP connections). Additionally, candidates may overlook the importance of Selective Proxy with PAC files for granular traffic routing, focusing instead on simpler configurations like IP-layer enforcement only. The correct answers combine both DNS and IP-layer protections with selective proxying.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable IP-layer enforcement for all destinations.
Enabling IP-layer enforcement in Cisco Umbrella ensures that all traffic to destinations that match a blocked category is dropped at the IP layer, even if DNS-based blocking is bypassed (e.g., via direct IP connections). This provides a second layer of protection by inspecting and blocking traffic based on the destination IP address, preventing users from circumventing DNS filtering by using IP addresses directly. Option E is also correct because using Selective Proxy with PAC files allows granular control over web traffic routing based on destination category, enabling organizations to apply different security policies (e.g., proxy inspection for high-risk categories) while allowing direct access to trusted categories. This combination of IP-layer enforcement and selective proxying provides comprehensive web security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure SSL decryption to always bypass traffic to trusted domains.
Why it's wrong here
SSL decryption should inspect encrypted traffic; bypassing trusted domains may allow threats.
- ✗
Configure the network to use the root DNS forwarder for all DNS queries.
Why it's wrong here
Root DNS forwarders do not provide security filtering; Umbrella DNS resolvers are recommended.
- ✓
Enable IP-layer enforcement for all destinations.
Why this is correct
IP-layer enforcement blocks malicious IPs at the network layer, providing comprehensive protection.
- ✗
Configure local security stack bypass for all internal IP ranges.
Why it's wrong here
Local security stack bypass is not a standard practice and may reduce protection.
- ✓
Use Selective Proxy with PAC files to route traffic based on destination category.
Why this is correct
Selective Proxy allows inspection of risky categories while bypassing trusted traffic, balancing security and performance.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.