Get all the Information About Cisco 350-701 Exam 2025 Practice Test Questions
Check Real Cisco 350-701 Exam Question for Free (2025)
Cisco 350-701 exam is a comprehensive test that evaluates the knowledge and skills of candidates in implementing and operating Cisco Security Core Technologies. Passing 350-701 exam is a prerequisite for obtaining the CCNP Security certification, which is highly valued in the industry. Candidates who want to take 350-701 exam must have a deep understanding of security concepts and best practices, as well as a solid understanding of Cisco technologies.
NEW QUESTION # 384
Which type of API is being used when a security application notifies a controller within a software-defined network architecture about a specific security threat? (Choose Two)
- A. eastbound API
- B. northbound API
- C. southbound API
- D. westbound AP
Answer: B,C
NEW QUESTION # 385
Refer to the exhibit. What is the function of the Python script code snippet for the Cisco ASA REST API?
- A. changes the hostname of the Cisco ASA
- B. obtains the saved configuration of the Cisco ASA firewall
- C. adds a global rule into policies
- D. deletes a global rule from policies
Answer: C
NEW QUESTION # 386
A security engineer must add destinations into a destination list in Cisco Umbrella. What describes the application of these changes?
- A. The destination list must be removed from the policy before changes are made to It.
- B. The user role of Block Page Bypass or higher is needed to perform these changes.
- C. The changes are applied only after the configuration is saved in Cisco Umbrella.
- D. The changes are applied immediately it the destination list is part or a policy.
Answer: D
Explanation:
A destination list is a list of internet destinations: domains, URLs, and CIDRs. To control identity access to specific destinations, you can add destination lists to Umbrella and then select them when configuring your Web and DNS policies12. When you add or edit a destination list, the changes are applied immediately if the destination list is part of a policy3. This means that any identities that are associated with the policy will be affected by the changes in the destination list. You do not need to save the configuration or remove the destination list from the policy to apply the changes. However, you do need to have the appropriate user role to manage destination lists. The user role of Block Page Bypass or higher is needed to perform these changes4. References :=
* Manage Destination Lists - Umbrella User Guide
* Manage Destination Lists - Umbrella SIG User Guide
* Add a Destination List - Umbrella User Guide
* Add a DNS Destination List - Umbrella SIG User Guide
NEW QUESTION # 387
An organization is implementing URL blocking using Cisco Umbrella. The users are able to go to some sites but other sites are not accessible due to an error. Why is the error occurring?
- A. Client computers do not have the Cisco Umbrella Root CA certificate installed.
- B. IP-Layer Enforcement is not configured.
- C. Intelligent proxy and SSL decryption is disabled in the policy.
- D. Client computers do not have an SSL certificate deployed from an internal CA server.
Answer: C
Explanation:
Explanation
https://support.umbrella.com/hc/en-us/articles/115004564126-SSL-Decryption-in-the-Intelligent-Proxy
NEW QUESTION # 388
What are two functionalities of SDN Northbound APIs? (Choose two.)
- A. Northbound APIs form the interface between the SDN controller and the network switches or routers.
- B. Northbound APIs provide a programmable interface for applications to dynamically configure the network.
- C. Northbound APIs form the interface between the SDN controller and business applications.
- D. OpenFlow is a standardized northbound API protocol.
- E. Northbound APIs use the NETCONF protocol to communicate with applications.
Answer: B,C
Explanation:
Northbound APIs are the link between the applications and the SDN controller. The applications can tell the network what they need (data, storage, bandwidth, and so on) and the network can deliver those resources, or communicate what it has. These APIs support a wide variety of applications, such as load balancers, firewalls, orchestration platforms, and automation stacks. Northbound APIs also enable the applications to use the controller's capabilities to program flows into the network devices using the southbound interface. Northbound APIs are usually RESTful APIs that use HTTP methods to exchange data in JSON or XML formats12.
OpenFlow is not a northbound API protocol, but a southbound API protocol that defines the communication between the SDN controller and the network switches or routers. OpenFlow allows the controller to manipulate the forwarding behavior of the switches or routers by sending commands and receiving events3 .
NETCONF is not a northbound API protocol, but a network management protocol that can be used as a southbound API protocol to configure and monitor network devices. NETCONF uses XML to encode data and remote procedure calls (RPCs) to exchange messages between the controller and the network devices
. References := 1: What are SDN Northbound APIs (and SDN Rest APIs)? - SDxCentral 2: SDN North-bound and South-bound APIs and Interfaces 3: OpenFlow - Wikipedia : OpenFlow - SDxCentral : NETCONF - Wikipedia : NETCONF Protocol - Cisco
1sdxcentral.com2computernetworkingnotes.com3examguides.com
NEW QUESTION # 389
An engineer configured a new network identity in Cisco Umbrella but must verify that traffic is being routed through the Cisco Umbrella network. Which action tests the routing?
- A. Add the public IP address that the client computers are behind to a Core Identity.
- B. Enable the Intelligent Proxy to validate that traffic is being routed correctly.
- C. Ensure that the client computers are pointing to the on-premises DNS servers.
- D. Browse to http://welcome.umbrella.com/ to validate that the new identity is working.
Answer: D
Explanation:
the
routing of traffic through the Cisco Umbrella network is to browse to http://welcome.umbrella.com/. This URL will display a message that confirms whether the new network identity is working or not. If the message says "You're protected by Cisco Umbrella", then the traffic is being routed correctly. If the message says
"You're not using Cisco Umbrella", then the traffic is not being routed correctly and the configuration needs to be checked. The other options are not valid actions to test the routing. Option A is incorrect because the client computers should point to the Cisco Umbrella DNS servers, not the on-premises DNS servers. Option B is incorrect because the Intelligent Proxy is a feature that selectively intercepts and proxies web requests for deeper inspection, not a tool to test the routing. Option C is incorrect because adding the public IP address to a Core Identity is a way to identify the network, not a way to test the routing. References:
* How To: Successfully test to ensure you're running Umbrella correctly
* Add a Network Identity
NEW QUESTION # 390
An organization recently installed a Cisco Secure Web Appliance and would like to take advantage of the AVC engine to allow the organization to create a policy to control application-specific activity. After enabling the AVC engine, what must be done to implement this?
- A. Use web security reporting to validate engine functionality.
- B. Use URL categorization to prevent the application traffic.
- C. Use security services to configure the traffic monitor.
- D. Use an access policy group to configure application control settings.
Answer: D
NEW QUESTION # 391
Which two protocols must be configured to authenticate end users to the Cisco WSA? (Choose two.)
- A. Kerberos
- B. TACACS+
- C. NTLMSSP
- D. RADIUS
- E. CHAP
Answer: A,C
Explanation:
The Cisco WSA supports mainly two authentication protocols: LDAP and NTLM. LDAP is a standard protocol for accessing directory services, such as Active Directory or OpenLDAP. NTLM is a proprietary protocol for authenticating Windows clients to Windows servers. NTLM has two versions: NTLMv1 and NTLMv2. NTLMSSP (NT LAN Manager Security Support Provider) is a variant of NTLMv2 that provides additional security features, such as message integrity and confidentiality. The Cisco WSA supports both LDAP and NTLMSSP using basic authentication, which requires the user to enter a username and password.
The Cisco WSA also supports Kerberos, which is a network authentication protocol that uses tickets to authenticate users and services. Kerberos is based on symmetric-key cryptography and requires a trusted third party, called the Key Distribution Center (KDC), to issue and validate tickets. Kerberos is more secure and efficient than NTLM, as it does not require the user to enter credentials repeatedly and does not send passwords over the network. The Cisco WSA supports Kerberos only in standard mode, not in cloud connector mode. The Cisco WSA does not support TACACS+ or CHAP as authentication protocols.
TACACS+ is a Cisco proprietary protocol for authenticating network devices and users to a central server.
CHAP is a challenge-response protocol for authenticating PPP connections. These protocols are not designed for web security appliances and are not compatible with the Cisco WSA. References:
* User Guide for AsyncOS 11.0 for Cisco Web Security Appliances (Section: Acquire End-User Credentials)
* Cisco WSA Authentication
* WSA Authentication
NEW QUESTION # 392
Using Cisco Firepower's Security Intelligence policies, upon which two criteria is Firepower block based?
(Choose two)
- A. URLs
- B. port numbers
- C. IP addresses
- D. MAC addresses
- E. protocol IDs
Answer: A,C
Explanation:
Explanation Explanation Security Intelligence Sources ... Custom Block lists or feeds (or objects or groups) Block specific IP addresses, URLs, or domain names using a manually-created list or feed (for IP addresses, you can also use network objects or groups.) For example, if you become aware of malicious sites or addresses that are not yet blocked by a feed, add these sites to a custom Security Intelligence list and add this custom list to the Block list in the Security Intelligence tab of your access control policy. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-configguide-v623/security_intelligence_blacklisting.html Explanation Security Intelligence Sources
...
Custom Block lists or feeds (or objects or groups)
Block specific IP addresses, URLs, or domain names using a manually-created list or feed (for IP addresses, you can also use network objects or groups.) For example, if you become aware of malicious sites or addresses that are not yet blocked by a feed, add these sites to a custom Security Intelligence list and add this custom list to the Block list in the Security Intelligence tab of your access control policy.
Explanation Explanation Security Intelligence Sources ... Custom Block lists or feeds (or objects or groups) Block specific IP addresses, URLs, or domain names using a manually-created list or feed (for IP addresses, you can also use network objects or groups.) For example, if you become aware of malicious sites or addresses that are not yet blocked by a feed, add these sites to a custom Security Intelligence list and add this custom list to the Block list in the Security Intelligence tab of your access control policy. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-configguide-v623/security_intelligence_blacklisting.html
NEW QUESTION # 393
Which Dos attack uses fragmented packets to crash a target machine?
- A. MITM
- B. smurf
- C. teardrop
- D. LAND
Answer: C
Explanation:
Explanation:
A teardrop attack is a denial-of-service (DoS) attack that involves sending fragmented packets to a target machine. Since the machine receiving such packets cannot reassemble them due to a bug in TCP/IP fragmentation reassembly, the packets overlap one another, crashing the target network device. This generally happens on older operating systems such as Windows 3.1x, Windows 95, Windows NT and versions of the Linux kernel prior to 2.1.63.
NEW QUESTION # 394
An organization is trying to implement micro-segmentation on the network and wants to be able to gain visibility on the applications within the network. The solution must be able to maintain and force compliance. Which product should be used to meet these requirements?
- A. Cisco AMP
- B. Cisco Stealthwatch
- C. Cisco Tetration
- D. Cisco Umbrella
Answer: C
Explanation:
Micro-segmentation secures applications by expressly allowing particular application traffic and, by default, denying all other traffic. Micro-segmentation is the foundation for implementing a zero-trust security model for application workloads in the data center and cloud.
Cisco Tetration is an application workload security platform designed to secure your compute instances across any infrastructure and any cloud. To achieve this, it uses behavior and attribute-driven microsegmentation policy generation and enforcement. It enables trusted access through automated, exhaustive context from various systems to automatically adapt security policies.
To generate accurate microsegmentation policy, Cisco Tetration performs application dependency mapping to discover the relationships between different application tiers and infrastructure services. In addition, the platform supports "what-if" policy analysis using real-time data or historical data to assist in the validation and risk assessment of policy application pre-enforcement to ensure ongoing application availability. The normalized microsegmentation policy can be enforced through the application workload itself for a consistent approach to workload microsegmentation across any environment, including virtualized, bare-metal, and container workloads running in any public cloud or any data center. Once the microsegmentation policy is enforced, Cisco Tetration continues to monitor for compliance deviations, ensuring the segmentation policy is up to date as the application behavior change.
Micro-segmentation secures applications by expressly allowing particular application traffic and, by default, denying all other traffic. Micro-segmentation is the foundation for implementing a zero-trust security model for application workloads in the data center and cloud.
Cisco Tetration is an application workload security platform designed to secure your compute instances across any infrastructure and any cloud. To achieve this, it uses behavior and attribute-driven microsegmentation policy generation and enforcement. It enables trusted access through automated, exhaustive context from various systems to automatically adapt security policies.
To generate accurate microsegmentation policy, Cisco Tetration performs application dependency mapping to discover the relationships between different application tiers and infrastructure services. In addition, the platform supports "what-if" policy analysis using real-time data or historical data to assist in the validation and risk assessment of policy application pre-enforcement to ensure ongoing application availability. The normalized microsegmentation policy can be enforced through the application workload itself for a consistent approach to workload microsegmentation across any environment, including virtualized, bare-metal, and container workloads running in any public cloud or any data center. Once the microsegmentation policy is enforced, Cisco Tetration continues to monitor for compliance deviations, ensuring the segmentation policy is up to date as the application behavior change.
Reference:
Micro-segmentation secures applications by expressly allowing particular application traffic and, by default, denying all other traffic. Micro-segmentation is the foundation for implementing a zero-trust security model for application workloads in the data center and cloud.
Cisco Tetration is an application workload security platform designed to secure your compute instances across any infrastructure and any cloud. To achieve this, it uses behavior and attribute-driven microsegmentation policy generation and enforcement. It enables trusted access through automated, exhaustive context from various systems to automatically adapt security policies.
To generate accurate microsegmentation policy, Cisco Tetration performs application dependency mapping to discover the relationships between different application tiers and infrastructure services. In addition, the platform supports "what-if" policy analysis using real-time data or historical data to assist in the validation and risk assessment of policy application pre-enforcement to ensure ongoing application availability. The normalized microsegmentation policy can be enforced through the application workload itself for a consistent approach to workload microsegmentation across any environment, including virtualized, bare-metal, and container workloads running in any public cloud or any data center. Once the microsegmentation policy is enforced, Cisco Tetration continues to monitor for compliance deviations, ensuring the segmentation policy is up to date as the application behavior change.
NEW QUESTION # 395
Drag and drop the concepts from the left onto the correct descriptions on the right
Answer:
Explanation:
NEW QUESTION # 396
A network engineer must configure a Cisco ESA to prompt users to enter two forms of information before gaining access The Cisco ESA must also join a cluster machine using preshared keys What must be configured to meet these requirements?
- A. Enable two-factor authentication through a TACACS+ server and then join the cluster by using the Cisco ESA GUI.
- B. Enable two-factor authentication through a TACACS+ server and then join the cluster by using the Cisco ESA CLI
- C. Enable two-factor authentication through a RADIUS server and then join the cluster by using the Cisco ESA GUI
- D. Enable two-factor authentication through a RADIUS server and then join the cluster by using the Cisco ESA CLI.
Answer: D
NEW QUESTION # 397
Drag and drop the concepts from the left onto the correct descriptions on the right
Answer:
Explanation:
Explanation:
NEW QUESTION # 398
Refer to the exhibit.
What does the number 15 represent in this configuration?
- A. privilege level for an authorized user to this router
- B. number of possible failed attempts until the SNMPv3 user is locked out
- C. access list that identifies the SNMP devices that can access the router
- D. interval in seconds between SNMPv3 authentication attempts
Answer: C
NEW QUESTION # 399
Which policy represents a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in a deployment?
- A. Access Control Policy
- B. Device Management Policy
- C. Platform Service Policy
- D. Group Policy
Answer: C
Explanation:
Cisco Firepower deployments can take advantage of platform settings policies. A platform settings policy is a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in your deployment, such as time settings and external authentication. Examples of these platform settings policies are time and date settings, external authentication, and other common administrative features. A shared policy makes it possible to configure multiple managed devices at once, which provides consistency in your deployment and streamlines your management efforts. Any changes to a platform settings policy affects all the managed devices where you applied the policy. Even if you want different settings per device, you must create a shared policy and apply it to the desired device. For example, your organization's security policies may require that your appliances have a "No Unauthorized Use" message when a user logs in. With platform settings, you can set the login banner once in a platform settings policy. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-configguide-v62/platform_settings_policies_for_managed_devices.html Therefore the answer should be "Platform Settings Policy", not "Platform Service Policy" but it is the best answer here so we have to choose it.
administrative features.
A shared policy makes it possible to configure multiple managed devices at once, which provides consistency in your deployment and streamlines your management efforts. Any changes to a platform settings policy affects all the managed devices where you applied the policy. Even if you want different settings per device, you must create a shared policy and apply it to the desired device.
For example, your organization's security policies may require that your appliances have a "No Unauthorized Use" message when a user logs in. With platform settings, you can set the login banner once in a platform settings policy.
Reference:
Therefore the answer should be "Platform Settings Policy", not "Platform Service Policy" but it is the best Cisco Firepower deployments can take advantage of platform settings policies. A platform settings policy is a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in your deployment, such as time settings and external authentication. Examples of these platform settings policies are time and date settings, external authentication, and other common administrative features. A shared policy makes it possible to configure multiple managed devices at once, which provides consistency in your deployment and streamlines your management efforts. Any changes to a platform settings policy affects all the managed devices where you applied the policy. Even if you want different settings per device, you must create a shared policy and apply it to the desired device. For example, your organization's security policies may require that your appliances have a "No Unauthorized Use" message when a user logs in. With platform settings, you can set the login banner once in a platform settings policy. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-configguide-v62/platform_settings_policies_for_managed_devices.html Therefore the answer should be "Platform Settings Policy", not "Platform Service Policy" but it is the best answer here so we have to choose it.
NEW QUESTION # 400
A Cisco FTD engineer is creating a new IKEv2 policy called s2s00123456789 for their organization to allow for additional protocols to terminate network devices with They currently only have one policy established and need the new policy to be a backup in case some devices cannot support the stronger algorithms listed in the primary policy What should be done in order to support this?
- A. Make the priority for the new policy 5 and the primary policy 1.
- B. Change the encryption to AES* to support all AES algorithms in the primary policy
- C. Make the priority for the primary policy 10 and the new policy 1
- D. Change the integrity algorithms to SHA* to support all SHA algorithms in the primary policy
Answer: C
NEW QUESTION # 401
Which posture assessment requirement provides options to the client for remediation and requires the remediation within a certain timeframe?
- A. Optional
- B. Visibility
- C. Mandatory
- D. Audit
Answer: C
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_client_posture_policies.html#:~:text=Policy%20Requirement%20Types-,Mandatory%20Requirements,the%20requirements%20within%20the%20time%20specified%20in%20the%20remediation%20timer%20settings.,-For%20example%2C%20you Mandatory Requirements During policy evaluation, the agent provides remediation options to clients who fail to meet the mandatory requirements defined in the posture policy. End users must remediate to meet the requirements within the time specified in the remediation timer settings
NEW QUESTION # 402
In which two ways does Easy Connect help control network access when used with Cisco TrustSec? (Choose two)
- A. It integrates with third-party products to provide better visibility throughout the network.
- B. It creates a dashboard in Cisco ISE that provides full visibility of all connected endpoints.
- C. It allows multiple security products to share information and work together to enhance security posture in the network.
- D. It allows for the assignment of Security Group Tags and does not require 802.1x to be configured on the switch or the endpoint.
- E. It allows for managed endpoints that authenticate to AD to be mapped to Security Groups (PassiveID).
Answer: D,E
Explanation:
Easy Connect simplifies network access control and segmentation by allowing the assignment of Security Group Tags to endpoints without requiring 802.1X on those endpoints, whether using wired or wireless connectivity.
Easy Connect simplifies network access control and segmentation by allowing the assignment of Security Group Tags to endpoints without requiring 802.1X on those endpoints, whether using wired or wireless connectivity.
Reference:
Easy Connect simplifies network access control and segmentation by allowing the assignment of Security Group Tags to endpoints without requiring 802.1X on those endpoints, whether using wired or wireless connectivity.
NEW QUESTION # 403
An organization has a requirement to collect full metadata information about the traffic going through their AWS cloud services They want to use this information for behavior analytics and statistics Which two actions must be taken to implement this requirement? (Choose two.)
- A. Send VPC Flow Logs to Cisco Stealthwatch Cloud.
- B. Configure Cisco Thousand Eyes to ingest AWS information.
- C. Configure Cisco Stealthwatch Cloud to ingest AWS information
- D. Configure Cisco ACI to ingest AWS information.
- E. Send syslog from AWS to Cisco Stealthwatch Cloud.
Answer: A,C
Explanation:
To collect full metadata information about the traffic going through their AWS cloud services, the organization needs to send VPC Flow Logs to Cisco Stealthwatch Cloud and configure Cisco Stealthwatch Cloud to ingest AWS information. VPC Flow Logs is a feature that enables the organization to capture information about the IP traffic going to and from network interfaces in their VPC. Flow log data can be published to Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose1. Cisco Stealthwatch Cloud is a SaaS-based network and cloud security solution that provides behavioral analytics across the network to help the organization improve threat detection and achieve a stronger security posture2. By sending VPC Flow Logs to Cisco Stealthwatch Cloud, the organization can leverage the rich network flow metadata to perform various types of flow analysis, such as troubleshooting connectivity issues, monitoring the traffic patterns, detecting anomalous or malicious activity, and verifying compliance3. To send VPC Flow Logs to Cisco Stealthwatch Cloud, the organization needs to create a flow log for their VPC, subnet, or network interface, and specify Cisco Stealthwatch Cloud as the destination4. To configure Cisco Stealthwatch Cloud to ingest AWS information, the organization needs to add their AWS account as a data source in the Cisco Stealthwatch Cloud portal, and grant the necessary permissions for Cisco Stealthwatch Cloud to access their VPC Flow Logs5. By doing so, the organization can view and analyze the flow log data in the Cisco Stealthwatch Cloud dashboard, and receive valuable security alerts and insights based on the network behavior6.
References := 1: Logging IP traffic using VPC Flow Logs - Amazon Virtual Private Cloud 2: Cisco Secure Cloud Analytics (Stealthwatch Cloud) - Cisco 3: Cisco Secure Cloud Analytics - AWS VPC Flow Logs: A New Tool for Your ... 4: Publish flow logs to Cisco Stealthwatch Cloud - Amazon Virtual Private Cloud 5:
AWS Data Source Setup - Cisco Stealthwatch Cloud 6: AWS Workload Protection - Cisco Stealthwatch Cloud
NEW QUESTION # 404
What is a feature of an endpoint detection and response solution?
- A. Preventing attacks by identifying harmful events with machine learning and conduct-based defense
- B. Rapidly and consistently observing and examining data to mitigate threats
- C. Capturing and clarifying data on email, endpoints, and servers to mitigate threats
- D. Ensuring the security of network devices by choosing which devices are allowed to reach the network
Answer: B
NEW QUESTION # 405
In which two ways does a system administrator send web traffic transparently to the Web Security Appliance?
(Choose two)
- A. configure the proxy IP address in the web-browser settings
- B. use Web Cache Communication Protocol
- C. configure policy-based routing on the network infrastructure
- D. reference a Proxy Auto Config file
- E. configure Active Directory Group Policies to push proxy settings
Answer: B,C
NEW QUESTION # 406
Which deployment model is the most secure when considering risks to cloud adoption?
- A. public cloud
- B. hybrid cloud
- C. private cloud
- D. community cloud
Answer: C
NEW QUESTION # 407
......
Cisco 350-701 (Implementing and Operating Cisco Security Core Technologies) Certification Exam is a globally recognized certification that validates an individual's knowledge and skills in implementing and operating Cisco Security Core Technologies. Implementing and Operating Cisco Security Core Technologies certification exam is designed for security professionals who want to advance their career in the field of network security.
Use Free 350-701 Exam Questions that Stimulates Actual EXAM : https://www.dumpexams.com/350-701-real-answers.html
Get Ready to Boost your Prepare for your 350-701 Exam with 727 Questions: https://drive.google.com/open?id=17k5jmFGoqbC2kZmusbNf3mlb2L9X1jXS