Implementing and Operating Cisco Security Core Technologies (350-701) practice questions

Domain coverage 6 domains

• Security Concepts (20%)
• Network Security (25%)
• Cloud Security (15%)
• Secure Service Edge (10%)
• Endpoint Protection and Detection (15%)
• Network Access, Visibility, and Enforcement (15%)

Sample questions 30 of 300 shown

1. Q1

   An engineer must force an endpoint to re-authenticate an already authenticated session without disrupting the endpoint to apply a new or updated policy from ISE. Which CoA type achieves this goal?

   1. Port Bounce
   2. CoA Terminate
   3. CoA Reauth
   4. CoA Session Query

   CoA Reauth instructs the network device to re-run authentication on the already established session; the session and the port stay up, so the endpoint is not disrupted while ISE applies the new or updated policy. CoA Terminate actually terminates the session, which briefly cuts off network access until the endpoint re-authenticates. Port Bounce performs a shutdown/no-shutdown of the switch port, which is disruptive (it drops link, PoE devices reset, and any other devices behind the port are affected). CoA Session Query merely asks for session state and changes nothing.
2. Q2

   Which policy represents a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in a deployment?

   1. group policy
   2. access control policy
   3. device management policy
   4. platform service policy

   On FMC, a Platform Service Policy bundles device-wide settings such as NTP, DNS, DHCP server, syslog and SNMP that are common across many managed devices, so it can be shared and applied to multiple sensors at once. A group policy is an ASA remote-access concept, an access control policy governs traffic inspection decisions, and a device management policy is not an FMC policy type.
3. Q3

   An engineer is configuring a Cisco ESA and wants to control whether to accept or reject email messages to a recipient address. Which list contains the allowed recipient addresses?

   1. SAT
   2. BAT
   3. HAT
   4. RAT

   The Recipient Access Table (RAT) defines which recipient domains/addresses the ESA will accept; recipients not in the RAT are rejected at the listener level. HAT (Host Access Table) controls which sending hosts are accepted or blocked, BAT (Blocked Sender List) is part of IronPort anti-spam sender filtering, and SAT is not an ESA list type.
4. Q4

   Which policy is used to capture host information on the Cisco Firepower Next Generation Intrusion Prevention System?

   1. correlation
   2. intrusion
   3. access control
   4. network discovery

   The network discovery policy passively profiles hosts on the network, collecting OS, client, application, protocol and topology data. Correlation policies react to events with responses, intrusion policies inspect packets for threats, and access control policies decide whether traffic is trusted, blocked or further inspected — none of them perform host discovery.
5. Q5

   Which feature within Cisco Umbrella allows for the ability to inspect secure HTTP traffic?

   1. File Analysis
   2. SafeSearch
   3. SSL Decryption
   4. Destination Lists

   Umbrella's SSL Decryption feature enables the intelligent proxy to decrypt HTTPS sessions so the traffic can be inspected before being re-encrypted and forwarded. File Analysis runs sandboxing on files, SafeSearch enforces safe web/image search results, and Destination Lists simply allow or block domains without any decryption capability.
6. Q6

   Which two preventive measures are used to control cross-site scripting? (Choose two.)

   1. Enable client-side scripts on a per-domain basis
   2. Incorporate contextual output encoding/escaping
   3. Disable cookie inspection in the HTML inspection engine
   4. Run untrusted HTML input through an HTML sanitization engine
   5. SameSite cookie attribute should not be used

   The Cisco security curriculum lists enabling client-side scripts on a per-domain basis (so scripts only run on trusted domains) and incorporating contextual output encoding/escaping (so user data is never interpreted as code) as the two XSS prevention measures. Option C weakens protection rather than adding it, option E is backwards — the SameSite attribute should be used to mitigate cookie theft, and option D (sanitization) is a valid defense in general practice but is not part of the two Cisco-listed measures in this item.
7. Q7

   Which proxy mode must be used on Cisco WSA to redirect TCP traffic with WCCP?

   1. transparent
   2. redirection
   3. forward
   4. proxy gateway

   WCCP on the router performs transparent redirection — clients are unaware of the proxy and send traffic to normal destinations, which the router then diverts to the WSA. The WSA must therefore run in transparent proxy mode to accept traffic that was not addressed to it. Explicit/forward proxy requires browser or PAC configuration on clients, "redirection" is not a WSA proxy mode, and proxy gateway mode is a bridging deployment rather than the mode paired with WCCP redirection (some dump keys incorrectly list "proxy gateway").
8. Q8

   Which ID store requires that a shadow user be created on Cisco ISE for the admin login to work?

   1. RSA SecureID
   2. Internal Database
   3. Active Directory
   4. LDAP

   RSA SecurID is a token-based external identity store that has no user attribute schema for administrator roles, so a local "shadow" admin user with the same name must be created in the ISE internal database to assign the admin role and permit GUI login. Internal Database, Active Directory and LDAP natively carry the user objects that ISE maps to administrator roles without shadow users.
9. Q9

   What is a difference between weak passwords and missing encryption?

   1. Weak passwords allow programs to be renamed, and missing encryption hides .exe extensions.
   2. Weak passwords consume bandwidth, and missing encryption allows user information to be hijacked.
   3. Weak passwords are guessed easily, and missing encryption allows information to be decrypted.
   4. Weak passwords cause programs to crash, and missing encryption sends data to a memory location.

   Weak passwords are short, simple or default credentials that can be guessed or brute-forced, giving attackers direct access. Missing or absent encryption means data travels or is stored in plaintext, so anything captured "in the clear" is immediately readable — effectively no decryption barrier at all. The other options describe unrelated or nonsensical behaviors (renaming programs, bandwidth consumption, memory writes).
10. Q10

    What is Cisco Talos Intelligence?

    1. security threat intelligence application
    2. security threat intelligence organization
    3. part of the Cisco Smart Business Architecture
    4. part of Security Information and Event Management

    Talos is Cisco's dedicated threat intelligence organization (a research group, not a product) that analyzes threats worldwide and feeds reputation data (IP/domain/file) into Cisco security products such as Firepower, ESA/WSA and Umbrella. It is not an application, an architecture component, or part of a SIEM.
11. Q11

    What is a difference between SQL injection and buffer overflow attacks?

    1. SQL injection reads data from memory, and buffer overflow inserts data into memory.
    2. SQL injection targets websites, and buffer overflow targets software.
    3. SQL injection requires only remote access, and buffer overflow needs local access.
    4. SQL injection targets databases, and buffer overflow targets applications.

    SQL injection abuses insufficient input validation in a web application to manipulate queries against a backend database. Buffer overflow targets the application process itself by sending more data to a memory buffer than it can hold, overwriting adjacent memory to crash the program or execute code. The other options reverse or misstate where the attack data is inserted and what is targeted.
12. Q12

    What is an attribute of Structured Threat Information eXpression?

    1. excludes traffic without inspection
    2. describes cyber threat information
    3. proactively identifies threats
    4. shows the trajectory of a malicious file

    STIX is a standardized, machine-readable language for describing cyber threat information — indicators of compromise, threat actors, attack patterns, campaigns and vulnerabilities — so it can be exchanged between systems (typically over TAXII). It does not inspect traffic, actively identify threats, or track file trajectories itself.
13. Q13

    How is an amplification DDoS attack performed?

    1. turning small DNS queries into DNS responses that are much larger in packet size to flood the target device
    2. sending instructions to a collection of compromised devices to launch a large-scale network attack
    3. generating and sending the packets directly to the target device from the source of the attack to overwhelm the device
    4. triggering a memory buffer overflow that causes a device to consume all the available resources

    In an amplification attack, the attacker sends small requests (for example, open DNS resolvers with ANY queries or NTP monlist) to third-party servers with a spoofed source address; the servers generate responses many times larger than the request, all directed at the victim, multiplying the attack traffic. Option B describes a botnet-based DDoS, option C is a direct (non-amplified) flood, and option D is a resource-exhaustion exploit, not traffic amplification.
14. Q14

    What is a capability of a Cisco Next-Generation Firewall?

    1. endpoint isolation
    2. deep file analysis
    3. IOC scanning
    4. intrusion prevention

    NGFW platforms such as ASA with FirePOWER services and FTD integrate intrusion prevention, application awareness, URL filtering and advanced malware protection in one device. Endpoint isolation is an AMP for Endpoints response action, and deep file analysis/IOC scanning are performed by dedicated sandboxing (Threat Grid) and endpoint products, not by the firewall itself.
15. Q15

    An engineer is configuring a site-to-site IPsec VPN between two routers. Which step must be the last in the configuration?

    1. Configure the routers to exclude traffic from NAT.
    2. Ping one of the routers to verify network connectivity.
    3. Establish the IPsec VPN tunnel.
    4. Create an extended access control list on one of the routers to allow inbound traffic.

    NAT exemption (deny interesting traffic in the NAT ACL) must be configured last because the VPN encryption must occur before NAT translation; if NAT rewrites the source addresses, the encrypted packets fail the proxy identity check and the tunnel drops or traffic is sent unencrypted. Connectivity testing and tunnel establishment are verification steps, and inbound ACLs are handled by the crypto map/interesting-traffic definition.
16. Q16

    What is a difference between a zone-based firewall and a Cisco Adaptive Security Appliance firewall?

    1. Cisco Adaptive Security Appliance firewalls support application monitoring, and zone-based firewalls support packet inspection.
    2. Cisco Adaptive Security Appliance firewalls support high-performance networks, and zone-based firewalls are suited for low traffic levels.
    3. Cisco Adaptive Security Appliance firewalls use policy-based routing, and zone-based firewalls use stateless access control lists.
    4. Cisco Adaptive Security Appliance firewalls use quality of service, and zone-based firewalls use throttling.

    The ASA is a dedicated, purpose-built firewall appliance with high throughput, while a zone-based firewall is a software feature running on an IOS router and is limited by the router's CPU/memory, making it appropriate for smaller, lower-traffic deployments. Both support application inspection, ZBF does not rely on stateless ACLs, and the QoS/routing statements in the other options are incorrect.
17. Q17

    Which interface mode must be configured on the Cisco Secure IPS to block suspicious traffic?

    1. active
    2. inline
    3. promiscuous
    4. passive

    Only in inline mode does the IPS sit directly in the traffic path, where it can drop packets, reset connections and actively block malicious traffic in real time. Promiscuous/passive modes receive a copy of traffic (for example via SPAN) and can only raise alerts, not block, and "active" is not an interface mode on Firepower.
18. Q18

    An engineer has configured the identity certificate on the ASA and enabled Cisco Secure Client for remote access VPN. What is the next step in the configuration?

    1. Configure a DHCP pool by using group policy.
    2. Configure NAT exemption for remote clients.
    3. Create the connection profile and tunnel group.
    4. Configure access list bypass for SSL/IPsec clients.

    After the identity certificate is installed and AnyConnect (Secure Client) is enabled, the next step is to create the connection profile (tunnel group), which defines the VPN attributes: authentication method, address assignment, group policy linkage and the client address pool. DHCP pools, NAT exemption and ACL bypass come later or are handled within the tunnel group/group policy configuration.
19. Q19

    Which command on the Cisco ASA enables SSH authentication against a TACACS+ server group, falling back to the local database if the server is unreachable?

    1. aaa authentication ssh console TACACS-GROUP LOCAL
    2. aaa authentication http console TACACS-GROUP LOCAL
    3. aaa authentication serial console LOCAL TACACS-GROUP
    4. aaa authentication ssh console LOCAL TACACS-GROUP

    The syntax is aaa authentication ssh console <server-group> <fallback>, so aaa authentication ssh console TACACS-GROUP LOCAL first queries the TACACS-GROUP server group and falls back to the LOCAL database only if the group cannot be reached. Option B targets HTTP (ASDM) management, option C targets the serial console, and option D reverses the order so the local database would always be tried first.
20. Q20

    Which firewall mode on the Cisco ASA allows the firewall to inspect Layer 2 traffic?

    1. inline
    2. passive
    3. routed
    4. transparent

    In transparent mode the ASA operates as a Layer 2 bridge (a "bump in the wire"), forwarding and inspecting frames between interfaces in the same subnet without routing them, so it can be inserted into an existing network without readdressing. Routed mode operates at Layer 3, and inline/passive are Firepower sensor interface modes, not ASA firewall modes.
21. Q21

    Which interface mode on the Cisco Secure IPS receives network traffic without modifying the traffic flow?

    1. port pair
    2. bridge mode
    3. transparent mode
    4. SPAN port

    A SPAN port receives a mirrored copy of traffic from a switch, so the IPS monitors the traffic passively without being in the forwarding path and without altering the original flow. Port pair and bridge (inline) modes place the sensor in the traffic path, where it can modify or drop packets.
22. Q22

    Which feature provides an encrypted, routed site-to-site VPN suitable for connecting a router to a cloud environment?

    1. IKE Profile Based Selection
    2. Tunnel Mode Auto Selection
    3. Virtual Tunnel Interface
    4. FlexVPN Mixed Mode

    A Virtual Tunnel Interface (VTI) is a routed, IPsec-protected interface: traffic is selected for encryption by routing it into the tunnel interface instead of by an ACL-based crypto map, which makes it ideal for scalable cloud connectivity. The other options are not mechanisms that create a routed encrypted VPN.
23. Q23

    What is a capability of a CASB?

    1. It secures proxy connections to a cloud-based application.
    2. It issues oAuth tokens for user-level access to cloud-based applications.
    3. It encrypts data between a cloud provider and a cloud consumer.
    4. It controls access to and usage of a cloud-based application.

    A Cloud Access Security Broker sits between cloud consumers and providers to enforce policy: it controls access to cloud applications, monitors usage, applies data security rules and ensures compliance (functions Cloudlock provides via API and proxy modes). It does not terminate or secure proxy connections, issue OAuth tokens, or itself provide the transport encryption between provider and consumer.
24. Q24

    When is the Umbrella Dynamic IP Updater required to be downloaded and installed?

    1. dynamic IPv6
    2. static IPv4
    3. static IPv6
    4. dynamic IPv4

    Umbrella policies are tied to registered network identities (typically the public IPv4 address). When the upstream provider assigns a dynamic IPv4 address, the Dynamic IP Updater agent authenticates to Umbrella and updates the address whenever it changes so the correct policy keeps applying. Static IPv4/IPv6 networks do not change, and the updater is an IPv4 mechanism.
25. Q25

    An organization migrated its web server to a PaaS environment and must still protect the application from attacks. Which security measure must the organization configure?

    1. Perform IPS scanning.
    2. Implement a proxy server.
    3. Perform operating system patching.
    4. Add physical security control.

    In PaaS the provider is responsible for the physical plant, hypervisor and operating system patching, while the customer is responsible for the application. Deploying application-level protections such as IPS/web application scanning is therefore the customer's job. OS patching (C) and physical security (D) are provider responsibilities, and a generic proxy server does not protect against application-layer attacks.
26. Q26

    In a hybrid hub-and-spoke topology that combines on-premises and cloud environments, which protocol protects data in transit between the environments?

    1. AES-256
    2. TLS-1.3
    3. SHA-512
    4. MD5

    TLS 1.3 is the current transport-layer protocol providing end-to-end encryption and integrity for data moving between on-premises systems and cloud services. AES-256 and SHA-512 are cryptographic primitives used inside protocols, not transport protocols themselves, and MD5 is a broken hash unsuitable for data-in-transit protection.
27. Q27

    Which proxy method is used on Cisco Secure Web Appliance when the proxy IP address and port are configured explicitly in the client so that traffic is sent directly to the appliance?

    1. anonymity
    2. reverse
    3. explicit
    4. transparent

    In explicit mode the client is configured (manually, via Group Policy or via PAC file) with the proxy's IP address and port, and sends every request directly to the appliance regardless of whether the user is inside or outside the corporate network. Transparent mode relies on redirection (WCCP/PBR) without client configuration, reverse proxy fronts published servers, and "anonymity" is not a WSA mode.
28. Q28

    Which solution must be used to protect a SaaS-hosted company website against DoS, DDoS, XSS and SQL injection attacks?

    1. Cisco IDS Host Sensor on the SaaS platform
    2. Secure Web Application Firewall on the SaaS platform
    3. Cisco Intrusion Prevention System at the company site
    4. Cisco Secure Firewall at the company site

    Application-layer attacks (DoS/DDoS against the web tier, XSS, SQL injection) are best mitigated by a Web Application Firewall deployed where the application runs — the SaaS platform. An on-premises IPS or firewall inspects traffic behind the perimeter and cannot effectively filter attacks aimed at a public SaaS application, and an IDS host sensor provides detection rather than prevention at the application layer.
29. Q29

    Which CLI command is used to configure Outbreak Filters on a Cisco Secure Email Gateway, including logging of URL Category, Reputation score and Outbreak Filter rewrites?

    1. outbreakfilters
    2. outbreakconfig
    3. dlpconfig
    4. quarantineconfig

    The outbreakconfig command configures Outbreak Filters behavior and its logging, including URL category and reputation data and the URL rewriting applied to suspicious messages. dlpconfig configures Data Loss Prevention policies and quarantineconfig configures quarantine settings, while "outbreakfilters" is not an AsyncOS CLI command.
30. Q30

    Which capability of Cisco Secure Endpoint (AMP for Endpoints) for Email Security defends against advanced phishing attacks?

    1. continuous file analysis
    2. email domain blocking
    3. automated training
    4. vulnerability analysis

    Continuous file analysis keeps analyzing attachments and URLs after the message has been delivered; if an attachment later turns out to be malicious, remediation is applied retroactively — a key defense against advanced phishing payloads. Domain blocking is a gateway function, automated training is an awareness feature rather than detection, and vulnerability analysis targets software flaws rather than phishing.

Answer all 300 questions with instant feedback →

Reader reviews 33 ratings

• The 350-701 explanations are detailed and educational. I learned more from reviewing wrong answers than from any book.

  ★★★★★★ Rachel S.

• I studied for 350-701 with this bank and passed comfortably. The questions are well-organized and the UI is clean.

  ★★★★★★ Lauren C.

• Got the 350-701 certification after three weeks of self-study with this question bank. Very happy with the purchase.

  ★★★★★★ Victoria K.

• The review mode for 350-701 is awesome. Being able to see all questions and explanations at once really helps with last-minute cramming.

  ★★★★★★ Ezra J.

• After failing 350-701 twice, these practice questions helped me finally pass. The detailed answer explanations are gold.

  ★★★★★★ Michael T.

• Bought lifetime access for the 350-701 bank and it’s been great. Still use it to brush up even after passing the cert.

  ★★★★★★ Sophie L.

Frequently asked questions

Free study resources

Community-verified analysis of 100 questions from real test-taker discussions — 12 deep analyses and 0 FAQs.

More Microsoft exams