Hard — 350-701 Practice Quiz

Question 1

A company runs a FlexVPN hub-and-spoke topology built on IKEv2 and a dynamic VTI on the hub. Two branch spokes frequently exchange large volumes of VoIP and file-transfer traffic with each other, and network engineers notice all this traffic currently transits the hub, saturating the hub's WAN link and adding latency. Management wants the spokes to build direct tunnels dynamically without a full mesh of static tunnels. Which action should the engineer take to achieve this?

Accepted Answer

Enable NHRP shortcut switching and NHRP redirect so spokes can establish dynamic spoke-to-spoke tunnels

Answer

Configure static crypto maps between each pair of spokes to force direct encryption

Answer

Increase the hub's IKEv2 SA lifetime and enable dead peer detection on all tunnels

Answer

Replace the dynamic VTI with a static VTI on the hub and add per-spoke routing statements

Question 2

A security engineer deploys a Cisco FTD sensor inline between the distribution and access layers. An intrusion policy is applied with rules set to 'Generate Events'. After a demonstrated exploit, management demands that matching malicious traffic actually be dropped rather than just logged. The engineer verifies the rule state shows 'Drop and Generate Events'. However, testing shows the traffic is still passing while events are being generated. What is the MOST likely cause?

Accepted Answer

The FTD device or the intrusion policy is operating in a non-inline (detection-only) mode, so drop rules only generate events without dropping

Answer

The intrusion policy is being evaluated in the Security Intelligence phase, which cannot drop application-layer exploits

Answer

The access control policy default action is set to 'Trust', which bypasses all intrusion inspection

Answer

The rules must be set to 'Disabled' first and then re-enabled for the drop action to take effect

Question 3

A company hosts a web server in the DMZ zone (192.168.50.10) of a Cisco Secure Firewall Threat Defense (FTD) appliance. External users reach it via the public IP 203.0.113.10 using a static NAT rule. Internal users on the inside zone report that when they browse to the server's public FQDN (which resolves to 203.0.113.10), the connection fails, even though external access works fine. What must the administrator configure on the FTD to allow internal users to reach the DMZ server using its public IP?

Accepted Answer

A NAT hairpin (U-turn) configuration permitting traffic to enter and exit the same or interconnected interfaces, along with an access control rule allowing inside-to-DMZ traffic

Answer

A twice-NAT rule that translates the inside users' source addresses to the DMZ server's real IP address

Answer

A prefilter fastpath rule to bypass NAT processing for internal-to-DMZ flows

Answer

An identity NAT exemption rule disabling all address translation between the inside and DMZ zones

Question 4

A network engineer notices that a large, trusted database replication flow between two internal data centers is consuming significant Snort inspection resources on an FTD appliance, causing latency for other traffic. The flow is known-good and does not require deep inspection. Which FTD configuration allows this specific traffic to bypass Snort processing entirely while still being handled by the appliance?

Accepted Answer

Create a prefilter policy rule with the Fastpath action matching the flow's tunnel or source/destination criteria

Answer

Add the flow to a Security Intelligence allow list in the access control policy

Answer

Create an access control rule with the Trust action and enable file policy logging

Answer

Disable the intrusion policy globally on the access control policy default action

Question 5

A financial services company recently suffered an incident where an attacker obtained employee credentials via a phishing site and then used a real-time relay to intercept the one-time passcodes users typed in, successfully logging into the VPN. Leadership wants the security team to strengthen the MFA strategy so that a stolen password AND an intercepted code cannot be replayed by an attacker. Which MFA approach best meets this requirement?

Accepted Answer

Deploy FIDO2/WebAuthn hardware security keys that use origin-bound public-key cryptography for authentication

Answer

Switch users from SMS-based OTP to a TOTP authenticator app that generates 6-digit codes every 30 seconds

Answer

Enable Duo push notifications so users approve a login prompt on their registered mobile device

Answer

Require users to answer three knowledge-based security questions in addition to their password

Question 6

A network engineer is automating configuration changes on perimeter routers using NETCONF. The requirement is to push a multi-line configuration change, validate it before it takes effect, and be able to discard all pending changes if validation fails — without any partial configuration ever being applied to the running device. Which NETCONF capability and workflow satisfies this requirement?

Accepted Answer

Use the candidate datastore with , then issue followed by , and use if validation fails

Answer

Write changes directly to the running datastore using <edit-config> with the merge operation, relying on syntax checking to prevent errors

Answer

Use RESTCONF PATCH operations against the running datastore since HTTP status codes indicate success or failure atomically

Answer

Push each configuration line as a separate <edit-config> call to the startup datastore so changes persist across reloads

Question 7

A network engineer is configuring RESTCONF over HTTPS on a Cisco IOS-XE perimeter router to allow a Python automation script to push configuration changes. The script authenticates successfully and can perform GET operations, but every PUT and POST request returns an HTTP 405 Method Not Allowed error. The engineer confirms the user account has privilege level 15. What is the most likely cause?

Accepted Answer

The device has 'restconf' enabled but the target YANG data node is operational (read-only) rather than configuration data

Answer

The HTTPS server certificate has expired, blocking write operations only

Answer

The AAA method list is missing a command authorization statement for RESTCONF

Answer

The Accept header in the script requests XML while the device only supports JSON for writes