Network Security

350-701 · 75 questions

• An engineer must deploy intrusion prevention so that malicious packets are dropped before they reach a server farm. The current sensor receives a copy of traffic from a switch SPAN session. What change achieves the requirement?
• A Cisco Secure Firewall (FTD) must be inserted between a server subnet and its default gateway router. The servers' IP addresses, subnet and default gateway cannot change. Which firewall mode meets the requirement?
• A data center wants one physical Cisco Secure Firewall chassis to serve three business units. Each unit needs its own independently managed FTD policy and dedicated hardware resources, so that rebooting or upgrading one unit's firewall does not affect the others. Which capability fits?
• An organization's current firewall permits outbound TCP 443 for everyone. It cannot tell a sanctioned SaaS application from a file-sharing site that uses the same port, or which employee generated the traffic. What should replace it?
• Cisco Secure Firewall interfaces are already cabled inline for an intrusion prevention pilot. Management wants intrusion events generated from real traffic, no packets dropped during the pilot, and the option to switch to blocking later without recabling. Which interface mode fits?
• Two Cisco Secure Firewall devices protect a data-center edge. The requirement is that established connections continue if the active device fails. A single device has enough throughput for the load. Which deployment meets the requirement?
• A branch router's stateless inbound ACL on its internet link drops the replies to users' outbound HTTPS sessions. The engineer replaces it with a stateful firewall whose only rule permits outbound HTTPS from inside users. Why do the replies now reach the users?
• A data center's only Cisco Secure Firewall sits at the internet edge. Web, application and database servers in separate VLANs route to each other on the core switch, and a compromised web server connected straight to the database. Which design change addresses this?
• The SOC wants to know which internal hosts talked to which destinations, for how long and with how many bytes, across the whole campus, retained for 90 days. Storage for full packet capture is not available. Which telemetry source fits?
• Flow records show a workstation sent 4 GB to an unknown external host over unencrypted FTP overnight. Legal asks for evidence of exactly which files and content left the network. Which data source can provide that?
• Firewalls send syslog across a WAN to a central collector over UDP. Auditors note that messages can be lost without any indication and can be read or altered in transit. Which change addresses both concerns?
• Two finance workstations that have never communicated before suddenly exchange SMB traffic at 3 a.m. No intrusion signature matched the traffic. Which detection approach is designed to flag this activity?
• A sensor must receive every frame on a busy 10-Gbps uplink, including frames with errors, with no risk of copies being dropped when the switch is under heavy load. Which method should feed the sensor?
• Most outbound traffic is TLS 1.3, and company policy forbids decrypting it. The SOC still wants to detect malware command-and-control sessions on the network. What can detection rely on?
• Operations wants interface counters and state changes from IOS XE switches pushed to a collector every few seconds, instead of a management server polling each device on a timer. Which technology fits?
• Each access port must accept only the first device MAC address it learns, and the port must be disabled for investigation if a different MAC address appears. Which port security configuration meets this requirement?
• A rogue DHCP server connected to an access port is handing clients a wrong default gateway. The legitimate DHCP server is reached through the access switch's uplink to the distribution layer. Which configuration stops the rogue server?
• A host on a user VLAN sends gratuitous ARP replies that claim the default gateway's IP address with the host's own MAC address. DHCP snooping is already enabled on that VLAN. Which feature stops this attack, and how?
• An attacker on an access port in VLAN 1 sends frames carrying two 802.1Q tags, the outer tag matching the trunk's native VLAN 1 and the inner tag VLAN 20, to reach a server in VLAN 20. Which mitigation directly defeats this technique?
• A user plugs a consumer switch into a PortFast access port, and it starts sending superior BPDUs in an attempt to become the spanning-tree root. Policy says any edge port that receives a BPDU must be disabled. Which feature enforces that policy?
• A faulty device floods broadcast frames into an access VLAN, saturating links and switch CPUs. The team wants each access port to limit broadcast traffic to a set share of bandwidth and take an action when the threshold is exceeded. Which feature fits?
• Users' access rights must follow their role, such as contractor or finance, wherever they connect on campus, without redesigning VLANs or maintaining IP-based ACLs for every subnet. Which segmentation approach fits?
• A switch suddenly floods unicast frames out of every port in a VLAN after one access port sends thousands of frames with random source MAC addresses. Which attack is this, and which control mitigates it?
• A small site has one Cisco Secure Firewall (FTD) and no central management appliance or cloud management subscription. The administrator wants to configure it through a web interface running on the device itself. Which manager fits?
• An enterprise runs 60 Cisco Secure Firewall (FTD) devices at its sites. Today each one is configured individually, policies have drifted apart, and analysts must log in to each device to review events. Which management approach addresses this?
• A company wants to manage its Cisco Secure Firewall devices from a SaaS portal, with no on-premises management appliance to install, patch or back up. Which option meets that requirement?
• During a routing outage on the production network, administrators lost access to every firewall and switch they needed to fix it, because management traffic shares the data interfaces. Which design keeps management reachable when the data network is down?
• Auditors require firewall and switch management sessions to be isolated from user traffic, and the team proposes a dedicated out-of-band management network. Which statement describes the main benefit and the main cost of this design?
• A defense contractor's management network has no internet access by policy, and all firewall configuration and event data must stay on site. The team must centrally manage 25 Cisco Secure Firewall (FTD) devices. Which management option fits?
• A team wants to define firewall objects and access rules in a version-controlled repository and have a CI pipeline push them automatically to 50 Cisco Secure Firewall (FTD) devices that share a central manager. Where should the pipeline make its API calls?
• An auditor asks how the network team proves its IOS XE routers and switches are hardened consistently against an industry-recognized standard rather than individual engineers' preferences. What should the team use?
• A hardening review of branch routers finds the HTTP server, Telnet and several unused services enabled. The team is applying benchmark-style guidance to the routers. What is the recommended action for these findings?
• A team reading a CIS benchmark asks how Level 1 and Level 2 profile recommendations differ. Which description is correct?
• A team is applying benchmark-style hardening to the management plane of its Cisco Secure Firewall (FTD) devices. Which set of settings falls within that scope?
• An organization passed a CIS benchmark audit last year, but emergency changes have since introduced configuration drift. Leadership wants benchmark compliance verified continuously rather than once a year. Which approach fits?
• A CIS benchmark item recommends disabling a protocol that a legacy monitoring system still requires on several switches. The system cannot be replaced this year. What is the appropriate way to handle this item?
• A hardening review of IOS XE devices finds that SSH version 1 is still accepted and weak algorithms are enabled for management sessions. Which change aligns with benchmark guidance?
• After a policy change on Cisco ISE, network administrators still log in to switches over TACACS+ successfully, but every configuration command they enter is rejected with an authorization failure. What should the engineer check first?
• A company needs centralized administrator logins to routers and switches, with authorization and accounting for each individual command an administrator enters, and the entire packet body encrypted. Which protocol fits?
• An engineer is configuring access switches and Cisco ISE to authenticate employee laptops with 802.1X before granting them network access. Which AAA protocol carries the EAP exchange between the switch and ISE?
• A newly installed access switch is configured to send 802.1X requests to Cisco ISE. Ping from the switch to ISE succeeds, but endpoints time out and the RADIUS server never answers the switch, not even with an Access-Reject. What is the most likely cause?
• An IOS XE router uses 'aaa authentication login default group tacacs+' for administrator logins. During a WAN outage both TACACS+ servers become unreachable and nobody can log in to fix the router. Which change prevents this lockout without weakening normal TACACS+ use?
• Network administrators log in to IOS XE switches through Cisco ISE using TACACS+. Authentication succeeds and the ISE shell profile returns privilege level 15, yet every administrator lands at the user EXEC prompt. Which missing configuration on the switches explains this?
• Switches in a branch authenticate 802.1X users against Cisco ISE in the data center, and a new firewall was just placed between the two. Authentication and accounting both stopped working. Which firewall rule restores the standard RADIUS exchange?
• Users fail 802.1X on a wired port. The Cisco ISE live log shows the user's credentials were verified successfully against Active Directory, then the request was rejected because no authorization rule matched the user's group membership and the default rule denied access. What should the engineer do?
• A security policy requires that SNMP polling of perimeter devices authenticate each message and encrypt its payload, and that SNMPv2c community strings be retired. Which configuration meets the requirement?
• During an incident review, log timestamps from routers, switches and firewalls disagree by several minutes, and the team suspects a rogue time source could shift clocks to hide activity. What should be configured so devices accept time only from approved servers?
• An automation team must push configuration to IOS XE devices using YANG models. They want a protocol that runs over SSH, exchanges XML-encoded RPCs, and supports candidate datastores and network-wide transactions. Which protocol fits?
• Firewall syslog messages contain usernames and internal addresses, and they cross an untrusted transit network to reach a SIEM. Currently they are sent in clear text over UDP 514. Which change protects these messages in transit?
• An audit finds that administrators still manage switches with Telnet and the HTTP web interface, exposing credentials on the network. Which change remediates the finding?
• Only hosts in the 10.10.50.0/24 administrator subnet should be able to open SSH sessions to an IOS XE router, but today any internal host can reach the login prompt. Which configuration enforces this?
• A script uses the Cisco Secure Firewall Management Center REST API only to read device health and export inventory. Today it authenticates with the shared admin account. Which change best applies least privilege to this automation?
• On a Cisco Secure Firewall (FTD), a social-media application must be blocked for all users except members of the Marketing AD group. Identity sources are already mapping users to IP addresses. How should the access control rules be built?
• An FTD access control policy has rule 3 allowing any internal network to any destination over HTTPS, and rule 9 blocking HTTPS from the Guest network to a known malicious subnet. Guests still reach that subnet. What is the fix?
• A company wants its Cisco Secure Firewall (FTD) to block gambling websites and any site with a poor reputation, without maintaining lists of individual domains. Which access control configuration fits?
• Traffic from partner networks to a public web server must be permitted on Cisco Secure Firewall (FTD), but the security team still wants the sessions inspected for exploit attempts. Which rule configuration achieves this?
• Users download files over HTTP through a Cisco Secure Firewall (FTD), and the security team wants known malicious files stopped in transit using cloud disposition lookups. How is this configured?
• Nightly backups between two data center subnets saturate inspection resources on a Cisco Secure Firewall (FTD), even though the backup flow is fully trusted and must still be logged as allowed. Which approach reduces inspection load for this flow?
• On a Cisco Secure Firewall (FTD), URL rules must block one specific path on an otherwise allowed HTTPS site, but connection events show only the server name, never the full URL path. What is required to enforce the rule?
• A user reports a blocked connection through a Cisco Secure Firewall (FTD), but no connection event exists for it. The engineer suspects a block rule but must prove which rule handled the session. What should be done first?
• A branch Cisco Secure Firewall (FTD) and an HQ FTD, both managed by the same management center, need a site-to-site IPsec tunnel between 10.20.0.0/16 and 10.1.0.0/16. Which set of elements defines this VPN topology?
• Remote employees must connect with Cisco Secure Client to a Cisco Secure Firewall (FTD) and send all traffic through the tunnel. Which set of components does the remote access VPN policy need?
• Remote users on Cisco Secure Client should send only traffic destined for corporate networks 10.0.0.0/8 and 172.16.0.0/12 through the FTD tunnel, while internet traffic goes directly out their local connection. Where is this configured?
• Remote access VPN users on Cisco Secure Firewall (FTD) must authenticate with their Active Directory password and approve a Duo push before the tunnel is established. Which configuration achieves this?
• Remote access VPN clients connect to a Cisco Secure Firewall (FTD) and inside servers see the traffic, but replies never reach the clients. A packet trace shows the servers' replies to the VPN pool being translated to the outside interface address. What is the fix?
• Employees without Cisco Secure Client installed must be able to browse to the Cisco Secure Firewall (FTD) remote access VPN address, log in, and receive the client automatically on their first connection. What must the administrator provide?
• A newly acquired company uses 192.168.10.0/24 internally, which is also used at headquarters. A site-to-site VPN between the two Cisco Secure Firewall (FTD) devices must let hosts at each site reach the other. Which design makes this possible?
• A new site-to-site tunnel between two Cisco Secure Firewall (FTD) devices never completes IKEv2 Phase 1. The logs show each peer rejecting the other's IKESAINIT proposal because no acceptable proposal was found. What is the most likely cause?
• Between two Cisco Secure Firewall (FTD) peers, the IKEv2 security association is established and authenticated, but no IPsec (child) security association ever forms. Which cause best fits this symptom?
• A site-to-site tunnel on a Cisco Secure Firewall (FTD) shows IKE and IPsec SAs up, yet remote hosts cannot reach local servers. A packet trace of traffic arriving from the tunnel shows it dropped by the access control policy default action. What should be changed?
• A site-to-site tunnel between HQ and branch Cisco Secure Firewall (FTD) devices comes up whenever HQ hosts send traffic first. When only branch hosts start traffic, the IKE SA forms but the IPsec SA is refused. What most likely explains this?
• Site-to-site VPNs on a Cisco Secure Firewall (FTD) work normally, but remote access users report that Cisco Secure Client accepts the server certificate, shows the login prompt, and then returns login failed. Where should troubleshooting focus first?
• A branch Cisco Secure Firewall (FTD) sits behind an ISP router performing NAT. The tunnel to HQ starts IKEv2 successfully, then fails once the peers detect NAT. The ISP filter permits only UDP 500 between the peers. Which change resolves this?
• On a Cisco Secure Firewall (FTD), 'show crypto ipsec sa' for a site-to-site tunnel shows the encaps counter increasing steadily while the decaps counter stays at zero. Users at both sites report no connectivity. What does this indicate?
• A certificate-authenticated site-to-site tunnel between two Cisco Secure Firewall (FTD) devices stopped establishing right after the remote peer's identity certificate was reissued by a newly deployed enterprise CA. Nothing else changed. What should be done on the local FTD?