hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A security engineer for a multinational…
You are a security engineer for a multinational corporation with 5,000 employees. The company uses Cisco Umbrella for DNS-layer security, Cisco Web Security Appliance (WSA) for proxy services in the data center, and Cisco Email Security Appliance (ESA) for email security. Recently, the security team has received multiple reports of users receiving phishing emails that bypass the ESA. The emails contain links to malicious websites that are also not blocked by Umbrella or WSA. Upon investigation, you find that the phishing emails use newly registered domains (less than 24 hours old) and the malicious websites are hosted on cloud infrastructure with frequently changing IP addresses. The company's current security policies rely on signature-based detection and static blocklists. Which action should you take to most effectively mitigate these threats?
⚠ Common exam trap
Cisco often tests the misconception that increasing signature update frequency or using broad domain-blocking rules can effectively stop zero-day or rapidly changing threats, when in fact integrated threat intelligence and automated response (like CTR) are required to address dynamic attacks that bypass signature-based and static defenses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Cisco Threat Response to enable automated threat hunting and blocking across all security products.
Cisco Threat Response (CTR) provides integrated threat hunting and automated blocking across Cisco security products, including Umbrella, WSA, and ESA. This enables the security team to correlate indicators of compromise (IoCs) from phishing emails and newly registered domains, then automatically block them across all layers, addressing the dynamic nature of the threat (fast-flux hosting and newly registered domains) that signature-based and static blocklists cannot handle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy Cisco Threat Response to enable automated threat hunting and blocking across all security products.
Why this is correct
Cisco Threat Response uses real-time intelligence to block emerging threats across the entire security stack.
- ✗
Configure the WSA to block all domains registered within the last 30 days.
Why it's wrong here
Blocking all new domains would block many legitimate websites and cause business disruption.
- ✗
Enable Data Loss Prevention (DLP) on the ESA to scan email content for sensitive data.
Why it's wrong here
DLP does not detect malicious URLs or unknown domains.
- ✗
Increase the frequency of signature updates on the ESA and WSA to every hour.
Why it's wrong here
Signatures are ineffective against newly registered domains that have not been analyzed yet.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.