Free Practice Questions for Cisco 350-701 Exam

Cisco Secure Email Threat Defense uses Secondary Gateway mode when inbound mail first reaches an additional gateway and then passes to Secure Email Threat Defense before final delivery. In this scenario, the existing Cisco Secure Email Gateways are the Internet-facing termination point, and Secure Email Threat Defense is downstream of them but upstream of the cloud mail platform. That sequence exactly matches Secondary Gateway mode. Primary Gateway mode would place Secure Email Threat Defense first and require inbound mail to reach it directly. Primary with Additional Gateway would also place Secure Email Threat Defense before another gateway, reversing the stated design. “Secondary with Additional Gateway” is not the documented flow required for the described single upstream gateway layer. Therefore, the correct incoming-traffic domain setting is Secondary Gateway. Cisco Secure Email Threat Defense mail-flow modes

Cisco Stealthwatch Cloud is a network detection and response (NDR) solution that leverages pre-existing infrastructure to offer enterprise-wide, contextual visibility of network traffic from the private network to the public cloud1. It uses advanced analytics and machine learning to detect threats and anomalies across on-premises and cloud environments, and provides actionable alerts and recommendations to remediate them2. Cisco Stealthwatch Cloud is part of Cisco’s XDR strategy, which converges its deep expertise and visibility across the network and endpoints into one turnkey, risk-based solution3. References: 3: Cisco Unveils New Solution to Rapidly Detect Advanced Cyber Threats and Automate Response 2: Cisco Secure Network Analytics - Cisco 1: Cisco Stealthwatch and Cisco Tetration Workload Security

Quarantine Failed reports the result of a specific quarantine attempt; it does not establish the file’s current presence or execution state. A quarantine can fail because the file was renamed, moved, deleted, locked, or otherwise unavailable when the connector attempted remediation. The artifact might therefore still exist, or it might already have been removed through another mechanism. The log shown does not provide enough trajectory or error-detail evidence to decide between those possibilities. Option B overstates the observation as failure of an entire configured remediation policy. Options C and D make even stronger unsupported claims that the file remained accessible or continued running. The analyst should review event details, device/file trajectory, the connector logs, and the endpoint itself before declaring containment or compromise. Therefore, A is the only defensible conclusion from the displayed data. Cisco Secure Endpoint quarantine-failure discussion

Explanation

The appliance will try once to upload the file; if upload is not successful, for example because of

connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.

to configure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as isolated port and GigabitEthernet0/3 and GrgabitEthernet0/4 as community ports. This way, the default gateway can communicate with all servers, the isolated port can only communicate with the promiscuous port, and the community ports can communicate with each other and the promiscuous port. This prevents the file server from communicating with the DNS servers, as required by the question.

To understand the concept of private VLANs and port types, you can refer to the following sections of the source book:

Section 1.1.2: Describe the concepts of network security

Section 1.1.2.1: Describe the concepts of private VLANs

Section 1.1.2.2: Describe the concepts of port types

Section 1.1.2.3: Describe the concepts of PVLAN edge

Section 1.1.2.4: Describe the concepts of protected ports

Section 1.1.2.5: Describe the concepts of PVLAN configuration

Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets on untrusted interfaces by comparing the MAC address to IP address bindings in the DHCP snooping database or an ARP access-list. If the ARP packet contains invalid or spoofed information, it is dropped and logged. DAI also inspects ARP packets on trusted interfaces, but it does not drop them if they are invalid. Instead, it forwards them to the destination without validation. This allows the switch to support devices that use static IP addresses or have legitimate reasons to send ARP packets with different MAC address to IP address bindings. However, this also means that if a spoofed ARP packet is received on a trusted interface, it will bypass the DAI validation and be forwarded to the destination. This could allow an attacker to poison the ARP cache of other devices and perform a man-in-the-middle attack. Therefore, the correct answer is option B. The switch drops the packet after validation by using the IP & MAC Binding Table. References:

Understanding and Configuring Dynamic ARP Inspection

DAI (Dynamic ARP Inspection)

Dynamic ARP Inspection (DAI) Explanation & Configuration

Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0

 The Decrypt for Application Detection feature within the WSA Decryption options enhances the ability of AsyncOS to detect HTTPS applications. The HTTPS Proxy can decrypt HTTPS connections to web applications. This allows the Application Visibility and Control (AVC) engine to more accurately detect and block web applications that use HTTPS. This feature can help improve the security and performance of the network by identifying and controlling the usage of web applications that may consume bandwidth, pose security risks, or violate compliance policies.

The weak element is MD5, an obsolete hash with practical collision weaknesses, so it should be replaced with a modern integrity algorithm. SHA-512 is a SHA-2 family hash and provides strong integrity validation; therefore, option C is correct. AES-256 remains a strong confidentiality algorithm, and TLS 1.3 with properly validated signed certificates provides current transport security and authentication. Replacing AES with 3DES would reduce security and introduce a legacy cipher. Replacing TLS 1.3 with DES is technically mismatched because TLS is a protocol while DES is an obsolete cipher. SSLv3 is deprecated and would also weaken the design. Cisco’s Next Generation Cryptography recommendations classify MD5 for integrity as “Avoid” and SHA-256, SHA-384, and SHA-512 as next-generation choices. Cisco’s cryptographic recommendations directly support replacing MD5 with SHA-512.

Explanation

Two-factor authentication adds a second layer of security to your online accounts. Verifying your identity using a

second factor (like your phone or other mobile device) prevents anyone but you from logging in, even if they

know your password.

Note: Single sign-on (SSO) is a property of identity and access management that enables users to securely

authenticate with multiple applications and websites by logging in only once with just one set of credentials

(username and password). With SSO, the application or website that the user is trying to access relies on a

trusted third party to verify that users are who they say they are.

Network telemetry is a technology that allows network devices to push data to a collector in real time, rather than waiting for the collector to pull data from them. This improves the efficiency and accuracy of data collection, and enables the monitoring of a large number of network devices. SNMP, on the other hand, is a protocol that uses a pull model, where the collector requests data from the devices periodically. This can cause delays, gaps, and overhead in data collection, and limit the scalability of network monitoring. Therefore, network telemetry has an advantage over SNMP pulls in terms of scalability. References:

What Is Telemetry? Telemetry vs. SNMP - Huawei

Streaming telemetry challenges SNMP in large, complex networks

Network streaming telemetry: Monitoring in “real-time” - Paessler

An Overview of Network Telemetry - Geek Speak - Resources - THWACK

Cisco FTDv is a virtual appliance that combines the features of Cisco ASA and Cisco Firepower NGIPS. It provides stateful firewall, IPS, URL filtering, malware protection, and other advanced security functions. Cisco ASAv is a virtual appliance that only provides stateful firewall and VPN features. It does not support URL filtering or other Firepower functions. Therefore, Cisco FTDv provides more features than ASAv, especially for next-generation firewall capabilities. References :=

Cisco Firewall in AWS - Should i use ASAv or FTDv/FMCv?

Difference between Cisco ASAv, NGIPSv and FTDv…?

Are there any differences in features between Cisco ASA hardware …