{"id":20928,"date":"2026-09-24T09:11:32","date_gmt":"2026-09-24T09:11:32","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=20928"},"modified":"2026-09-24T09:11:32","modified_gmt":"2026-09-24T09:11:32","slug":"cisco-ccie-security-350-701-practice-test-questions-and-exam-dumps-part18-q341-360","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/cisco-ccie-security-350-701-practice-test-questions-and-exam-dumps-part18-q341-360\/","title":{"rendered":"Cisco CCIE Security 350-701 Practice Test Questions and Exam Dumps Part18 Q341-360"},"content":{"rendered":"

View Full <\/b>Cisco 350-701 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 341<\/b><\/h3>\n

Which Cisco Secure Firewall capability can evaluate traffic before the main access control policy to identify connections that should be fast-tracked, blocked, or handled differently?<\/b><\/p>\n

    \n
  1. Prefilter policy<\/span><\/li>\n
  2. DNS caching<\/span><\/li>\n
  3. DHCP snooping<\/span><\/li>\n
  4. NTP authentication<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    A prefilter policy in Cisco Secure Firewall can process traffic before it reaches the main access control policy. It can be used to quickly handle specific traffic based on characteristics such as tunnel status, network attributes, or other defined conditions. This can improve policy organization and allow certain traffic to be handled efficiently before deeper inspection occurs. DNS caching stores query results, DHCP snooping protects DHCP operations, and NTP authentication protects time synchronization. Therefore, prefilter policy provides the described traffic-processing capability.<\/span><\/p>\n

    Question 342<\/b><\/h3>\n

    In Cisco Secure Firewall, which policy determines whether encrypted web traffic should be decrypted for security inspection?<\/b><\/p>\n

      \n
    1. Access control policy<\/span><\/li>\n
    2. Decryption policy<\/span><\/li>\n
    3. NAT policy<\/span><\/li>\n
    4. Routing policy<\/span><\/li>\n<\/ol>\n

      Correct Answer: 2<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      A decryption policy determines how encrypted traffic such as TLS sessions should be handled for inspection. Depending on policy requirements, selected traffic can be decrypted and inspected before being re-encrypted toward its destination. Rules can consider characteristics such as destination, source, category, or other traffic attributes. Access control policy controls traffic authorization, NAT policy handles address translation, and routing policy determines forwarding behavior. Therefore, the decryption policy provides the specific control for deciding how encrypted traffic is inspected.<\/span><\/p>\n

      Question 343<\/b><\/h3>\n

      Which Cisco Secure Firewall feature can use threat-intelligence information to block connections to destinations associated with known malicious activity?<\/b><\/p>\n

        \n
      1. Security Intelligence<\/span><\/li>\n
      2. DHCP Guard<\/span><\/li>\n
      3. Port security<\/span><\/li>\n
      4. IP Source Guard<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Cisco Secure Firewall Security Intelligence can use threat-intelligence information to identify and block connections involving known malicious IP addresses, domains, or other indicators. This allows security controls to stop certain threats before additional inspection is required. Threat intelligence can be updated as new malicious infrastructure is identified, improving protection against emerging threats. DHCP Guard protects DHCP-related activity, port security limits Layer 2 endpoint behavior, and IP Source Guard validates source addressing. Therefore, Security Intelligence provides the required reputation-based blocking capability.<\/span><\/p>\n

        Question 344<\/b><\/h3>\n

        Which Cisco Secure Firewall policy can inspect files transmitted through supported protocols and apply malware-related actions based on inspection results?<\/b><\/p>\n

          \n
        1. Access control rule<\/span><\/li>\n
        2. File and malware policy<\/span><\/li>\n
        3. Routing policy<\/span><\/li>\n
        4. Identity policy<\/span><\/li>\n<\/ol>\n

          Correct Answer: 2<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          A file and malware policy can inspect supported file transfers and apply security actions based on configured malware-detection policies. Depending on the deployment, files can be examined using local inspection and advanced malware-analysis capabilities. This allows organizations to identify suspicious or malicious content as it moves through monitored traffic. Access control rules primarily determine whether traffic is allowed or blocked, routing policies determine forwarding, and identity policies associate users with traffic. Therefore, a file and malware policy provides the described inspection capability.<\/span><\/p>\n

          Question 345<\/b><\/h3>\n

          Which Cisco Secure Firewall capability can identify the application generating network traffic even when multiple applications use the same destination port?<\/b><\/p>\n

            \n
          1. Application Visibility and Control<\/span><\/li>\n
          2. VLAN trunking<\/span><\/li>\n
          3. Static routing<\/span><\/li>\n
          4. NTP<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Application Visibility and Control, commonly associated with application identification, allows security devices to identify applications based on traffic characteristics rather than relying only on destination ports. This is important because modern applications frequently use common ports such as TCP 443, making port-based identification insufficient. Application-aware security policies can then allow, block, or inspect traffic based on the identified application. VLAN trunking transports multiple VLANs, static routing defines forwarding paths, and NTP synchronizes clocks. Therefore, AVC provides the required application-identification capability.<\/span><\/p>\n

            Question 346<\/b><\/h3>\n

            Which Cisco Secure Firewall feature allows administrators to create access-control rules using fully qualified domain names rather than relying exclusively on fixed IP addresses?<\/b><\/p>\n

              \n
            1. FQDN-based access control<\/span><\/li>\n
            2. MAC address learning<\/span><\/li>\n
            3. DHCP relay<\/span><\/li>\n
            4. BGP authentication<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              FQDN-based access control allows security policies to reference fully qualified domain names when controlling traffic. This can be useful for destinations whose IP addresses change over time, such as cloud-hosted services and distributed applications. The firewall resolves the configured domain information and uses the resulting addresses when enforcing the policy. MAC address learning supports Layer 2 forwarding, DHCP relay forwards DHCP requests, and BGP authentication protects routing sessions. Therefore, FQDN-based access control provides the domain-oriented policy capability described.<\/span><\/p>\n

              Question 347<\/b><\/h3>\n

              Which security mechanism can ensure that an IPsec receiver does not accept an old packet that an attacker captured and retransmitted later?<\/b><\/p>\n

                \n
              1. Anti-replay protection<\/span><\/li>\n
              2. DNSSEC<\/span><\/li>\n
              3. SPF<\/span><\/li>\n
              4. Port security<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                IPsec anti-replay protection uses sequence information to identify packets that have already been received or fall outside the acceptable sequence window. This prevents attackers from capturing legitimate encrypted packets and repeatedly transmitting them in an attempt to cause unintended actions. Anti-replay protection is particularly important for maintaining the integrity of protected communications over untrusted networks. DNSSEC protects DNS data, SPF validates email sending authorization, and port security controls switch-port behavior. Therefore, anti-replay protection addresses the described IPsec threat.<\/span><\/p>\n

                Question 348<\/b><\/h3>\n

                Which IPsec mechanism allows peers behind NAT devices to exchange protected traffic by encapsulating ESP within UDP?<\/b><\/p>\n

                  \n
                1. NAT Traversal<\/span><\/li>\n
                2. Perfect Forward Secrecy<\/span><\/li>\n
                3. Dead Peer Detection<\/span><\/li>\n
                4. IKE fragmentation<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  NAT Traversal, or NAT-T, allows IPsec traffic to pass through Network Address Translation devices by encapsulating ESP packets within UDP. This helps maintain VPN connectivity when one or both endpoints are behind NAT. NAT-T commonly uses UDP encapsulation so intermediate devices can properly process the traffic. Perfect Forward Secrecy provides additional key protection, Dead Peer Detection checks peer availability, and IKE fragmentation helps handle large IKE messages. Therefore, NAT Traversal provides the required NAT compatibility.<\/span><\/p>\n

                  Question 349<\/b><\/h3>\n

                  Which IKEv2 feature allows a VPN gateway to detect that a peer is no longer reachable and remove stale security associations?<\/b><\/p>\n

                    \n
                  1. DPD<\/span><\/li>\n
                  2. SGT<\/span><\/li>\n
                  3. RPKI<\/span><\/li>\n
                  4. SAML<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Dead Peer Detection, or DPD, allows an IKEv2 implementation to determine whether a VPN peer remains reachable. When a peer stops responding to appropriate liveness checks, the device can determine that the connection is no longer active and remove stale security associations according to its configuration. This helps prevent obsolete VPN state from remaining indefinitely. Security Group Tags classify traffic, RPKI validates route origins, and SAML is an identity federation framework. Therefore, DPD provides the required VPN peer-liveness function.<\/span><\/p>\n

                    Question 350<\/b><\/h3>\n

                    Which PKI component signs certificates and provides a trusted basis for validating identities in a certificate-based security environment?<\/b><\/p>\n

                      \n
                    1. Certificate Authority<\/span><\/li>\n
                    2. Certificate Revocation List<\/span><\/li>\n
                    3. OCSP responder<\/span><\/li>\n
                    4. Certificate Signing Request<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      A Certificate Authority, or CA, issues and digitally signs certificates for entities whose identities need to be established through PKI. Systems that trust the CA can validate certificates by checking the signature and certificate chain. A Certificate Revocation List contains certificates that have been revoked, while an OCSP responder provides current revocation-status information. A Certificate Signing Request is submitted when requesting a certificate and is not itself the issuing authority. Therefore, the CA provides the trusted certificate-issuance function.<\/span><\/p>\n

                      Question 351<\/b><\/h3>\n

                      Which PKI object is generated by a certificate requester and contains information such as the subject identity and public key that the CA uses when issuing a certificate?<\/b><\/p>\n

                        \n
                      1. CSR<\/span><\/li>\n
                      2. CRL<\/span><\/li>\n
                      3. OCSP response<\/span><\/li>\n
                      4. Root certificate<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        A Certificate Signing Request, or CSR, is generated by an entity requesting a digital certificate. It typically contains identifying information and the requester’s public key, along with a proof that the requester possesses the corresponding private key. The CSR is submitted to a Certificate Authority, which validates the request according to its policies before issuing a certificate. A CRL lists revoked certificates, an OCSP response reports certificate status, and a root certificate represents a trusted CA identity. Therefore, CSR is correct.<\/span><\/p>\n

                        Question 352<\/b><\/h3>\n

                        Which certificate extension identifies the DNS names or other identities for which a certificate is valid?<\/b><\/p>\n

                          \n
                        1. EKU<\/span><\/li>\n
                        2. SAN<\/span><\/li>\n
                        3. CRL<\/span><\/li>\n
                        4. Key Usage<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 2<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          The Subject Alternative Name, or SAN, extension identifies additional identities associated with a certificate. For TLS certificates, SAN entries commonly contain DNS names for which the certificate is valid. Modern certificate validation relies heavily on SAN values when determining whether the requested hostname matches the certificate. Extended Key Usage defines permitted certificate purposes, a CRL contains revoked certificates, and Key Usage specifies allowed cryptographic operations. Therefore, SAN provides the identity information required for hostname validation.<\/span><\/p>\n

                          Question 353<\/b><\/h3>\n

                          Which certificate mechanism allows a client to determine whether a certificate has been revoked without downloading the entire certificate revocation list?<\/b><\/p>\n

                            \n
                          1. OCSP<\/span><\/li>\n
                          2. SAN<\/span><\/li>\n
                          3. CSR<\/span><\/li>\n
                          4. EKU<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            Online Certificate Status Protocol, or OCSP, allows a client or security system to query an OCSP responder for the current revocation status of a certificate. This avoids requiring the client to download and process a potentially large Certificate Revocation List. The responder provides status information such as whether the certificate is good, revoked, or unknown. SAN identifies certificate subjects, CSR is used to request certificates, and EKU defines permitted uses. Therefore, OCSP provides the described certificate-status mechanism.<\/span><\/p>\n

                            Question 354<\/b><\/h3>\n

                            Which TLS feature allows a client to indicate the hostname it wants to connect to when multiple secure websites share the same IP address?<\/b><\/p>\n

                              \n
                            1. SNI<\/span><\/li>\n
                            2. DPD<\/span><\/li>\n
                            3. EAP<\/span><\/li>\n
                            4. PFS<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Server Name Indication, or SNI, allows a TLS client to include the intended hostname during the TLS handshake. This enables a server or intermediary to select the appropriate certificate and configuration when multiple secure websites share the same IP address. SNI is especially useful in environments hosting many virtual HTTPS services on common infrastructure. DPD is associated with VPN peer detection, EAP supports authentication methods, and PFS protects session-key independence. Therefore, SNI provides the required hostname indication.<\/span><\/p>\n

                              Question 355<\/b><\/h3>\n

                              Which TLS capability allows a client and server to negotiate the application protocol to use after establishing a secure TLS connection?<\/b><\/p>\n

                                \n
                              1. ALPN<\/span><\/li>\n
                              2. NAT-T<\/span><\/li>\n
                              3. OCSP<\/span><\/li>\n
                              4. DAI<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Application-Layer Protocol Negotiation, or ALPN, allows a TLS client and server to negotiate which application protocol will operate over the connection. This is important for protocols such as HTTP\/2, where the parties need to agree on the application protocol during connection establishment. ALPN is carried during the TLS negotiation rather than being an independent transport protocol. NAT-T supports IPsec through NAT, OCSP checks certificate status, and DAI protects against ARP spoofing. Therefore, ALPN provides the described protocol-negotiation capability.<\/span><\/p>\n

                                Question 356<\/b><\/h3>\n

                                Which access-control principle requires a user or process to receive only the permissions necessary to perform its assigned task?<\/b><\/p>\n

                                  \n
                                1. Separation of duties<\/span><\/li>\n
                                2. Least privilege<\/span><\/li>\n
                                3. Nonrepudiation<\/span><\/li>\n
                                4. Defense in depth<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 2<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  The principle of least privilege limits users, applications, and processes to the minimum permissions required for their legitimate activities. Reducing unnecessary privileges limits the potential impact of compromised accounts, malicious software, and accidental actions. Separation of duties divides sensitive responsibilities among different individuals or roles, nonrepudiation provides evidence linking actions to entities, and defense in depth uses multiple security layers. Therefore, least privilege directly describes the requirement to provide only necessary permissions.<\/span><\/p>\n

                                  Question 357<\/b><\/h3>\n

                                  Which administrative security model prevents one individual from controlling every stage of a sensitive transaction by dividing responsibilities among multiple people or roles?<\/b><\/p>\n

                                    \n
                                  1. Separation of duties<\/span><\/li>\n
                                  2. Least privilege<\/span><\/li>\n
                                  3. Asset classification<\/span><\/li>\n
                                  4. Network segmentation<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Separation of duties divides sensitive responsibilities among multiple individuals or roles so that one person cannot independently complete an entire high-risk process. This reduces opportunities for fraud, unauthorized changes, and abuse of administrative authority. For example, one administrator may request a privileged change while another approves it. Least privilege limits the permissions assigned to an individual, asset classification categorizes information, and network segmentation separates communication environments. Therefore, separation of duties provides the required organizational control.<\/span><\/p>\n

                                    Question 358<\/b><\/h3>\n

                                    Which security capability helps determine whether an employee’s current login behavior is significantly different from that employee’s historical access patterns?<\/b><\/p>\n

                                      \n
                                    1. UEBA<\/span><\/li>\n
                                    2. NAT<\/span><\/li>\n
                                    3. MACsec<\/span><\/li>\n
                                    4. DHCPv6 Guard<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      User and Entity Behavior Analytics can establish behavioral baselines and compare current activity against those patterns. A sudden change in login location, access time, resource usage, device characteristics, or other behavior can produce an alert for investigation. This is useful when an attacker has obtained valid credentials because the authentication itself may appear legitimate. NAT performs address translation, MACsec protects Ethernet traffic, and DHCPv6 Guard restricts unauthorized DHCPv6 server messages. Therefore, UEBA provides the required behavioral comparison capability.<\/span><\/p>\n

                                      Question 359<\/b><\/h3>\n

                                      Which security architecture separates applications into smaller trust zones so that compromise of one workload does not automatically provide unrestricted access to other workloads?<\/b><\/p>\n

                                        \n
                                      1. Microsegmentation<\/span><\/li>\n
                                      2. Route aggregation<\/span><\/li>\n
                                      3. DNS caching<\/span><\/li>\n
                                      4. Link aggregation<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Microsegmentation divides a network or workload environment into smaller security zones and applies policies between them. Policies can be based on application identity, workload attributes, user identity, or other contextual information. This reduces lateral movement opportunities because compromise of one workload does not automatically provide broad access to other systems. Route aggregation reduces routing-table entries, DNS caching stores name-resolution results, and link aggregation combines physical links. Therefore, microsegmentation provides the required fine-grained isolation.<\/span><\/p>\n

                                        Question 360<\/b><\/h3>\n

                                        Which security practice reduces the attack surface of a network device by disabling services and interfaces that are not required for normal operation?<\/b><\/p>\n

                                          \n
                                        1. Service minimization<\/span><\/li>\n
                                        2. Route redistribution<\/span><\/li>\n
                                        3. Traffic mirroring<\/span><\/li>\n
                                        4. DNS recursion<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Service minimization reduces the attack surface by disabling unnecessary services, protocols, interfaces, and features that are not required for normal operation. Every enabled service can introduce additional code, listening ports, configuration requirements, and potential vulnerabilities. Removing unnecessary functionality therefore reduces opportunities for attackers to interact with the device. Route redistribution exchanges routing information, traffic mirroring copies packets for analysis, and DNS recursion processes name-resolution requests. Therefore, service minimization provides the described attack-surface reduction.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.   Question 341 Which Cisco Secure Firewall capability can evaluate traffic before the main access control policy to identify connections that should be fast-tracked, blocked, or handled differently? Prefilter policy DNS caching DHCP snooping NTP authentication Correct Answer: 1 Explanation A prefilter policy in Cisco […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20928"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=20928"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20928\/revisions"}],"predecessor-version":[{"id":20929,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20928\/revisions\/20929"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=20928"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=20928"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=20928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}