View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 341

Which Cisco Secure Firewall capability can evaluate traffic before the main access control policy to identify connections that should be fast-tracked, blocked, or handled differently?

1. Prefilter policy
2. DNS caching
3. DHCP snooping
4. NTP authentication

Correct Answer: 1

Explanation

A prefilter policy in Cisco Secure Firewall can process traffic before it reaches the main access control policy. It can be used to quickly handle specific traffic based on characteristics such as tunnel status, network attributes, or other defined conditions. This can improve policy organization and allow certain traffic to be handled efficiently before deeper inspection occurs. DNS caching stores query results, DHCP snooping protects DHCP operations, and NTP authentication protects time synchronization. Therefore, prefilter policy provides the described traffic-processing capability.

Question 342

In Cisco Secure Firewall, which policy determines whether encrypted web traffic should be decrypted for security inspection?

1. Access control policy
2. Decryption policy
3. NAT policy
4. Routing policy

Correct Answer: 2

Explanation

A decryption policy determines how encrypted traffic such as TLS sessions should be handled for inspection. Depending on policy requirements, selected traffic can be decrypted and inspected before being re-encrypted toward its destination. Rules can consider characteristics such as destination, source, category, or other traffic attributes. Access control policy controls traffic authorization, NAT policy handles address translation, and routing policy determines forwarding behavior. Therefore, the decryption policy provides the specific control for deciding how encrypted traffic is inspected.

Question 343

Which Cisco Secure Firewall feature can use threat-intelligence information to block connections to destinations associated with known malicious activity?

1. Security Intelligence
2. DHCP Guard
3. Port security
4. IP Source Guard

Correct Answer: 1

Explanation

Cisco Secure Firewall Security Intelligence can use threat-intelligence information to identify and block connections involving known malicious IP addresses, domains, or other indicators. This allows security controls to stop certain threats before additional inspection is required. Threat intelligence can be updated as new malicious infrastructure is identified, improving protection against emerging threats. DHCP Guard protects DHCP-related activity, port security limits Layer 2 endpoint behavior, and IP Source Guard validates source addressing. Therefore, Security Intelligence provides the required reputation-based blocking capability.

Question 344

Which Cisco Secure Firewall policy can inspect files transmitted through supported protocols and apply malware-related actions based on inspection results?

1. Access control rule
2. File and malware policy
3. Routing policy
4. Identity policy

Correct Answer: 2

Explanation

A file and malware policy can inspect supported file transfers and apply security actions based on configured malware-detection policies. Depending on the deployment, files can be examined using local inspection and advanced malware-analysis capabilities. This allows organizations to identify suspicious or malicious content as it moves through monitored traffic. Access control rules primarily determine whether traffic is allowed or blocked, routing policies determine forwarding, and identity policies associate users with traffic. Therefore, a file and malware policy provides the described inspection capability.

Question 345

Which Cisco Secure Firewall capability can identify the application generating network traffic even when multiple applications use the same destination port?

1. Application Visibility and Control
2. VLAN trunking
3. Static routing
4. NTP

Correct Answer: 1

Explanation

Application Visibility and Control, commonly associated with application identification, allows security devices to identify applications based on traffic characteristics rather than relying only on destination ports. This is important because modern applications frequently use common ports such as TCP 443, making port-based identification insufficient. Application-aware security policies can then allow, block, or inspect traffic based on the identified application. VLAN trunking transports multiple VLANs, static routing defines forwarding paths, and NTP synchronizes clocks. Therefore, AVC provides the required application-identification capability.

Question 346

Which Cisco Secure Firewall feature allows administrators to create access-control rules using fully qualified domain names rather than relying exclusively on fixed IP addresses?

1. FQDN-based access control
2. MAC address learning
3. DHCP relay
4. BGP authentication

Correct Answer: 1

Explanation

FQDN-based access control allows security policies to reference fully qualified domain names when controlling traffic. This can be useful for destinations whose IP addresses change over time, such as cloud-hosted services and distributed applications. The firewall resolves the configured domain information and uses the resulting addresses when enforcing the policy. MAC address learning supports Layer 2 forwarding, DHCP relay forwards DHCP requests, and BGP authentication protects routing sessions. Therefore, FQDN-based access control provides the domain-oriented policy capability described.

Question 347

Which security mechanism can ensure that an IPsec receiver does not accept an old packet that an attacker captured and retransmitted later?

1. Anti-replay protection
2. DNSSEC
3. SPF
4. Port security

Correct Answer: 1

Explanation

IPsec anti-replay protection uses sequence information to identify packets that have already been received or fall outside the acceptable sequence window. This prevents attackers from capturing legitimate encrypted packets and repeatedly transmitting them in an attempt to cause unintended actions. Anti-replay protection is particularly important for maintaining the integrity of protected communications over untrusted networks. DNSSEC protects DNS data, SPF validates email sending authorization, and port security controls switch-port behavior. Therefore, anti-replay protection addresses the described IPsec threat.

Question 348

Which IPsec mechanism allows peers behind NAT devices to exchange protected traffic by encapsulating ESP within UDP?

1. NAT Traversal
2. Perfect Forward Secrecy
3. Dead Peer Detection
4. IKE fragmentation

Correct Answer: 1

Explanation

NAT Traversal, or NAT-T, allows IPsec traffic to pass through Network Address Translation devices by encapsulating ESP packets within UDP. This helps maintain VPN connectivity when one or both endpoints are behind NAT. NAT-T commonly uses UDP encapsulation so intermediate devices can properly process the traffic. Perfect Forward Secrecy provides additional key protection, Dead Peer Detection checks peer availability, and IKE fragmentation helps handle large IKE messages. Therefore, NAT Traversal provides the required NAT compatibility.

Question 349

Which IKEv2 feature allows a VPN gateway to detect that a peer is no longer reachable and remove stale security associations?

1. DPD
2. SGT
3. RPKI
4. SAML

Correct Answer: 1

Explanation

Dead Peer Detection, or DPD, allows an IKEv2 implementation to determine whether a VPN peer remains reachable. When a peer stops responding to appropriate liveness checks, the device can determine that the connection is no longer active and remove stale security associations according to its configuration. This helps prevent obsolete VPN state from remaining indefinitely. Security Group Tags classify traffic, RPKI validates route origins, and SAML is an identity federation framework. Therefore, DPD provides the required VPN peer-liveness function.

Question 350

Which PKI component signs certificates and provides a trusted basis for validating identities in a certificate-based security environment?

1. Certificate Authority
2. Certificate Revocation List
3. OCSP responder
4. Certificate Signing Request

Correct Answer: 1

Explanation

A Certificate Authority, or CA, issues and digitally signs certificates for entities whose identities need to be established through PKI. Systems that trust the CA can validate certificates by checking the signature and certificate chain. A Certificate Revocation List contains certificates that have been revoked, while an OCSP responder provides current revocation-status information. A Certificate Signing Request is submitted when requesting a certificate and is not itself the issuing authority. Therefore, the CA provides the trusted certificate-issuance function.

Question 351

Which PKI object is generated by a certificate requester and contains information such as the subject identity and public key that the CA uses when issuing a certificate?

1. CSR
2. CRL
3. OCSP response
4. Root certificate

Correct Answer: 1

Explanation

A Certificate Signing Request, or CSR, is generated by an entity requesting a digital certificate. It typically contains identifying information and the requester’s public key, along with a proof that the requester possesses the corresponding private key. The CSR is submitted to a Certificate Authority, which validates the request according to its policies before issuing a certificate. A CRL lists revoked certificates, an OCSP response reports certificate status, and a root certificate represents a trusted CA identity. Therefore, CSR is correct.

Question 352

Which certificate extension identifies the DNS names or other identities for which a certificate is valid?

1. EKU
2. SAN
3. CRL
4. Key Usage

Correct Answer: 2

Explanation

The Subject Alternative Name, or SAN, extension identifies additional identities associated with a certificate. For TLS certificates, SAN entries commonly contain DNS names for which the certificate is valid. Modern certificate validation relies heavily on SAN values when determining whether the requested hostname matches the certificate. Extended Key Usage defines permitted certificate purposes, a CRL contains revoked certificates, and Key Usage specifies allowed cryptographic operations. Therefore, SAN provides the identity information required for hostname validation.

Question 353

Which certificate mechanism allows a client to determine whether a certificate has been revoked without downloading the entire certificate revocation list?

1. OCSP
2. SAN
3. CSR
4. EKU

Correct Answer: 1

Explanation

Online Certificate Status Protocol, or OCSP, allows a client or security system to query an OCSP responder for the current revocation status of a certificate. This avoids requiring the client to download and process a potentially large Certificate Revocation List. The responder provides status information such as whether the certificate is good, revoked, or unknown. SAN identifies certificate subjects, CSR is used to request certificates, and EKU defines permitted uses. Therefore, OCSP provides the described certificate-status mechanism.

Question 354

Which TLS feature allows a client to indicate the hostname it wants to connect to when multiple secure websites share the same IP address?

1. SNI
2. DPD
3. EAP
4. PFS

Correct Answer: 1

Explanation

Server Name Indication, or SNI, allows a TLS client to include the intended hostname during the TLS handshake. This enables a server or intermediary to select the appropriate certificate and configuration when multiple secure websites share the same IP address. SNI is especially useful in environments hosting many virtual HTTPS services on common infrastructure. DPD is associated with VPN peer detection, EAP supports authentication methods, and PFS protects session-key independence. Therefore, SNI provides the required hostname indication.

Question 355

Which TLS capability allows a client and server to negotiate the application protocol to use after establishing a secure TLS connection?

1. ALPN
2. NAT-T
3. OCSP
4. DAI

Correct Answer: 1

Explanation

Application-Layer Protocol Negotiation, or ALPN, allows a TLS client and server to negotiate which application protocol will operate over the connection. This is important for protocols such as HTTP/2, where the parties need to agree on the application protocol during connection establishment. ALPN is carried during the TLS negotiation rather than being an independent transport protocol. NAT-T supports IPsec through NAT, OCSP checks certificate status, and DAI protects against ARP spoofing. Therefore, ALPN provides the described protocol-negotiation capability.

Question 356

Which access-control principle requires a user or process to receive only the permissions necessary to perform its assigned task?

1. Separation of duties
2. Least privilege
3. Nonrepudiation
4. Defense in depth

Correct Answer: 2

Explanation

The principle of least privilege limits users, applications, and processes to the minimum permissions required for their legitimate activities. Reducing unnecessary privileges limits the potential impact of compromised accounts, malicious software, and accidental actions. Separation of duties divides sensitive responsibilities among different individuals or roles, nonrepudiation provides evidence linking actions to entities, and defense in depth uses multiple security layers. Therefore, least privilege directly describes the requirement to provide only necessary permissions.

Question 357

Which administrative security model prevents one individual from controlling every stage of a sensitive transaction by dividing responsibilities among multiple people or roles?

1. Separation of duties
2. Least privilege
3. Asset classification
4. Network segmentation

Correct Answer: 1

Explanation

Separation of duties divides sensitive responsibilities among multiple individuals or roles so that one person cannot independently complete an entire high-risk process. This reduces opportunities for fraud, unauthorized changes, and abuse of administrative authority. For example, one administrator may request a privileged change while another approves it. Least privilege limits the permissions assigned to an individual, asset classification categorizes information, and network segmentation separates communication environments. Therefore, separation of duties provides the required organizational control.

Question 358

Which security capability helps determine whether an employee’s current login behavior is significantly different from that employee’s historical access patterns?

1. UEBA
2. NAT
3. MACsec
4. DHCPv6 Guard

Correct Answer: 1

Explanation

User and Entity Behavior Analytics can establish behavioral baselines and compare current activity against those patterns. A sudden change in login location, access time, resource usage, device characteristics, or other behavior can produce an alert for investigation. This is useful when an attacker has obtained valid credentials because the authentication itself may appear legitimate. NAT performs address translation, MACsec protects Ethernet traffic, and DHCPv6 Guard restricts unauthorized DHCPv6 server messages. Therefore, UEBA provides the required behavioral comparison capability.

Question 359

Which security architecture separates applications into smaller trust zones so that compromise of one workload does not automatically provide unrestricted access to other workloads?

1. Microsegmentation
2. Route aggregation
3. DNS caching
4. Link aggregation

Correct Answer: 1

Explanation

Microsegmentation divides a network or workload environment into smaller security zones and applies policies between them. Policies can be based on application identity, workload attributes, user identity, or other contextual information. This reduces lateral movement opportunities because compromise of one workload does not automatically provide broad access to other systems. Route aggregation reduces routing-table entries, DNS caching stores name-resolution results, and link aggregation combines physical links. Therefore, microsegmentation provides the required fine-grained isolation.

Question 360

Which security practice reduces the attack surface of a network device by disabling services and interfaces that are not required for normal operation?

1. Service minimization
2. Route redistribution
3. Traffic mirroring
4. DNS recursion

Correct Answer: 1

Explanation

Service minimization reduces the attack surface by disabling unnecessary services, protocols, interfaces, and features that are not required for normal operation. Every enabled service can introduce additional code, listening ports, configuration requirements, and potential vulnerabilities. Removing unnecessary functionality therefore reduces opportunities for attackers to interact with the device. Route redistribution exchanges routing information, traffic mirroring copies packets for analysis, and DNS recursion processes name-resolution requests. Therefore, service minimization provides the described attack-surface reduction.