Secure Service Edge

350-701 · 30 questions

• An organization wants a cloud-delivered secure web gateway, CASB, zero trust network access and firewall as a service for its users, but it has just renewed its WAN contracts and will not change its branch networking. Which architecture term best describes what it is adopting?
• A retailer wants to converge its branch SD-WAN and its cloud-delivered security services (secure web gateway, CASB, ZTNA and firewall as a service) into one architecture with consistent policy for both branches and remote users. Which term describes this target?
• Remote and branch users' internet traffic is backhauled over VPN and MPLS to headquarters for inspection, which adds latency to every SaaS session and congests the data center's internet link. Which property of SSE addresses this problem?
• A security architect compares zero trust network access with the company's full-tunnel remote access VPN for reaching private applications. What is the key access-model difference between them?
• Branch offices send traffic to the cloud security service over IPsec tunnels. Web traffic is inspected, but a custom inventory application uses a non-HTTP protocol on uncommon TCP and UDP ports, and that traffic must also be controlled by port, protocol and application. Which SSE capability covers it?
• After the company adopts SSE for user access to the internet, SaaS and private applications, an executive asks whether the data center firewall that protects public-facing servers from inbound internet traffic can now be removed. What is the correct answer?
• A branch office has many devices, including printers and IoT sensors, on which no endpoint client can be installed, yet all of the site's internet traffic must be inspected by Cisco Secure Access. What is the appropriate way to connect the site?
• Laptops that are protected while on the corporate network lose DNS and web protection when employees work from hotels and home networks. The company wants Secure Access policy to follow these managed laptops wherever they connect. What should it deploy?
• The internet access policy must block destinations associated with malware, phishing and command-and-control while permitting business-category sites, and it must keep working as new malicious domains appear every day. How should the rules be built?
• After the team enables HTTPS decryption in Secure Access to gain full URL and file inspection, users on managed laptops suddenly see browser certificate warnings on every HTTPS site. What step was missed?
• Company privacy policy forbids inspecting the content of employees' sessions to banking and healthcare websites, but all other HTTPS traffic must remain decrypted for malware and DLP inspection. What is the appropriate configuration?
• An internet access rule that allows a partner's file-sharing site never matches. Logs show the partner traffic is blocked by a broader rule above it that blocks the entire file-sharing category. The allow rule's identities and destinations are correct. What is the fix?
• An external contractor on a personal, unmanaged laptop needs access to one internal web application for a month. No software may be installed on the laptop, and the contractor must not receive network-level access. Which Secure Private Access method fits?
• Managed employee laptops need access to private applications, including several non-web TCP applications, and access must be granted only when the device passes posture checks such as disk encryption and firewall status. Which access method fits best?
• Private applications in the data center must be reachable through Cisco Secure Access, but the security team will not open any inbound ports on the data center firewall for this purpose. What should be deployed?
• A legacy thick-client application negotiates many dynamic ports and uses server-initiated connections, and it fails over per-application ZTNA. Remote users still need it, and the company wants to deliver this through Secure Access rather than its own VPN headend. Which option fits?
• An administrator wants to let the finance group reach a new internal web application through Secure Private Access, but cannot select the application as a destination when writing the private access rule. What was skipped?
• Users authenticate to Secure Access successfully and the activity log shows their private access rule matched with an allow action, but the private web application still times out. Other users reach different apps through the same connector group. Where should troubleshooting focus first?
• Users must be stopped from uploading documents that contain payment card numbers to personal cloud storage sites at the moment of upload, while uploads without such data continue normally. Which Secure Access configuration achieves this?
• Employees paste source code and customer records into public generative AI chat tools. The company wants to keep allowing these tools but detect and block prompts that carry sensitive data, and also guard against prompt injection content in what users send. Which Secure Access capability fits?
• A compliance team plans a real-time DLP rule in Cisco Secure Access to stop credit card numbers from leaving through web uploads. Before enforcing anything, it wants to measure how often the rule would fire and how many matches are false positives, without interrupting users. How should the rule be deployed initially?
• An audit reveals that files containing customer account numbers were uploaded months ago to the organization's sanctioned cloud storage tenant. Security must find those files that are already stored there, not only future uploads. Which Cisco Secure Access DLP capability addresses this?
• Internal project codenames follow a fixed pattern of two capital letters, a hyphen and four digits, and no built-in data identifier in Cisco Secure Access matches them. The team wants DLP rules to detect these codenames in web uploads. What should be configured?
• A real-time DLP rule in Cisco Secure Access is set to block uploads of documents containing health record numbers to a file-sharing site. Test uploads over HTTPS succeed and no DLP event is logged, even though the identity and destination match the rule. What is the most likely cause?
• In Cisco Secure Access Investigate, an analyst reviews a domain contacted by one workstation. The domain was registered three days ago and carries a high risk score, but it has no security category assigned yet. What is the most appropriate interpretation?
• During an investigation, an analyst notices that a little-known domain is queried by the same clients within moments of queries to domains already confirmed as part of a phishing campaign. Which Investigate indicator captures this relationship?
• Investigate shows that a domain resolved to dozens of different IP addresses across many unrelated autonomous systems and countries during the last week, with short TTLs and records changing constantly. What does this DNS and IP history most strongly suggest?
• Three domains used in a recent malware campaign all list the same registrant email address in their registration data. The analyst wants to find other domains the attacker may have prepared but not used yet. Which Investigate pivot is most useful?
• Investigate shows a domain with extremely low popularity that almost no other networks query, yet DNS logs show one internal host resolving it every 60 seconds around the clock, including when no user is logged in. What does this pattern most likely indicate?
• A domain carries a benign business-related content category in Investigate, but it has a high risk score, appeared recently and co-occurs with known malware domains. A manager argues that the business category means it is safe. How should the analyst respond?