Medium 350-701 practice questions

A penetration tester submits an oversized input string to a legacy C-based network daemon running on a company server. The application crashes, and the tester is subsequently able to execute arbitrary code by overwriting the return address on the stack with a pointer to injected shellcode. Which vulnerability class does this describe?

A company wants employees to be able to register and configure their personally owned devices for secure 802.1X access to the corporate WLAN without help-desk involvement. Requirements: each device must automatically receive the correct supplicant configuration and be issued a unique X.509 certificate for EAP-TLS authentication. Which Cisco ISE capability satisfies these BYOD requirements?

A security team notices employees are uploading corporate files to numerous unsanctioned SaaS applications discovered from firewall and proxy logs. Leadership wants a solution that can automatically discover all cloud apps in use, assess their risk, enforce granular data-sharing policies within sanctioned apps like Office 365, and detect anomalous user behavior indicating account compromise. Which cloud security solution best meets all of these requirements?

A security engineer is deploying a remote access VPN and wants to eliminate the risk of shared or reused credentials. The organization already operates an internal PKI. The engineer configures the VPN gateway to require that each connecting client present an X.509 digital certificate issued by the corporate CA, and the gateway validates the certificate chain and checks revocation before granting access. Which cryptography function is being used to authenticate the user in this design?

A DevSecOps team stores database passwords, API keys, and TLS private keys directly as plaintext variables inside their Jenkins pipeline configuration files, which are committed to a shared Git repository. A security review flags this practice. Which approach best remediates the risk while supporting the CI/CD pipeline's need to authenticate to downstream services at build time?

A data center team wants to enforce east-west traffic controls between servers regardless of their IP subnet or VLAN, so that policy remains consistent even when workloads move or are re-addressed. They already run Cisco ISE and TrustSec-capable switches. Which approach best meets this requirement?

A financial services company migrated its file-sharing workloads to a sanctioned SaaS platform. Compliance requires that employees be prevented from uploading documents containing customer social security numbers or credit card data to any cloud storage location. Security wants a solution that inspects content in real time and blocks the transfer based on the sensitive data patterns detected, regardless of the file name. Which capability should be implemented?

A company is deploying a three-tier application (web, app, database) in a public cloud IaaS environment. Security requires that the database tier only accept inbound traffic from the app tier, and the app tier only from the web tier, regardless of IP address changes as instances autoscale. The team wants a policy model that references logical workload groupings rather than static IPs. Which approach best meets these requirements?

A financial services company is migrating a sensitive customer database to an IaaS provider's managed storage service. Regulatory requirements state that the organization must retain full control over the encryption keys used to protect the data at rest, including the ability to revoke access and rotate keys independently of the cloud provider. Which approach best satisfies this data security requirement?

A security engineer at a company using a public cloud IaaS provider must investigate who deleted a virtual machine and from which source IP the API call originated. The team already collects VPC/network flow logs but cannot determine the identity or management action responsible for the deletion. Which cloud logging capability should the engineer enable to capture this information?

A security engineer at a retail company must continuously detect when engineers modify AWS security group rules or S3 bucket ACLs away from the approved baseline, and automatically flag those changes as non-compliant. The team already collects VPC flow logs and API activity separately. Which native cloud capability should the engineer implement to satisfy this specific requirement?

A security team has migrated a multi-tier application into a hybrid environment consisting of on-premises bare-metal servers and public cloud instances. They need a solution that provides deep visibility into east-west process-level and network flow behavior across every workload, automatically generates whitelist microsegmentation policies based on observed application dependencies, and enforces those policies consistently regardless of where the workload runs. Which Cisco solution best meets these requirements?

A security architect must protect a sanctioned Microsoft 365 tenant. The requirement is to scan data already stored in SharePoint Online and OneDrive for sensitive files and malware, apply remediation to historical content, and do so without redirecting user traffic through a proxy or requiring endpoint agents. Which cloud security deployment approach meets these requirements?

A company migrates several application servers to an IaaS cloud provider. During a security review, the team debates which risks are now the cloud provider's responsibility versus their own. In this IaaS deployment model, which threat remains primarily the customer's responsibility to mitigate?

A retail company hosts its customer-facing web application on public-cloud virtual machines. Security wants to inspect inbound HTTP/HTTPS traffic for SQL injection and cross-site scripting, apply OWASP Top 10 rule sets, and enable virtual patching without redesigning the application or forcing all traffic through the on-premises data center. Which cloud security capability and deployment approach best meets these requirements?

A security team is deploying workload protection across a fleet of production virtual machines in a public cloud IaaS environment. Many of these VMs are ephemeral and are frequently terminated and recreated by an autoscaling group. The team needs continuous vulnerability and configuration visibility but cannot tolerate performance overhead on the running instances or a lengthy onboarding process for each new VM. Which workload security approach best fits these constraints?

A security engineer is hardening a fleet of production Linux VMs running a well-defined set of applications in a public cloud IaaS environment. The workloads are static — the same processes run continuously and no new software is expected to be installed at runtime. The team wants to prevent any unauthorized or unknown executable, script, or process from launching on these workloads, even if an attacker gains a foothold. Which workload security control best meets this requirement?

An enterprise uses Cisco ISE for 802.1X on wired switches. When an endpoint's profile changes and it must move to a different dynamic VLAN, the administrator notices that some thin clients do not request a new DHCP address after ISE pushes the policy change, leaving them stranded on the old subnet. Which Change of Authorization (CoA) type should ISE issue to force these endpoints onto the new VLAN while triggering a fresh DHCP request without requiring a full re-authentication handshake?

An enterprise runs Cisco ISE with profiling enabled. A workstation initially connects and is placed in a limited VLAN because ISE has only collected partial DHCP and RADIUS attributes. Moments later, ISE receives additional CDP and DHCP data that reclassifies the device into a trusted 'Corporate-Workstation' profile with a more permissive authorization profile. Which mechanism allows ISE to enforce the new authorization result on the switch port WITHOUT requiring the endpoint to physically disconnect and reconnect?

A DevSecOps team builds Docker images that are pushed to a private registry before deployment into a Kubernetes cluster. Recently, a production workload was found running an image containing a critical CVE in a bundled OS library. The security architect wants to prevent vulnerable images from ever reaching the cluster while keeping the CI/CD pipeline automated. Which control best addresses this requirement?

A DevSecOps team runs a microservices application on a Kubernetes cluster. By default, all pods can communicate freely with each other across namespaces. Security wants to enforce that only the frontend pods may initiate connections to the payment-service pods, while blocking all other lateral pod-to-pod traffic to that service. Which Kubernetes-native mechanism should the team implement to achieve this least-privilege pod communication?

A DevSecOps team runs a microservices application on a Kubernetes cluster. Security wants to detect and block anomalous runtime behavior inside running containers—such as a process spawning an unexpected shell or making unauthorized outbound connections—without modifying application code. Which capability best meets this requirement?

A security analyst reviews authentication logs for a company's public-facing web portal and notices thousands of failed login attempts across many different user accounts, each account tried only a handful of times before the attacker moves to the next. The source IPs rotate frequently, and a small percentage of logins eventually succeed using valid username/password pairs that were never reset after a breach at an unrelated third-party site. Which type of attack best describes this activity?

A security team is responsible for a rapidly growing multi-cloud deployment spanning AWS and Azure. Developers frequently spin up new storage buckets, databases, and virtual machines using infrastructure-as-code templates. The team keeps discovering publicly exposed storage buckets and security groups that allow 0.0.0.0/0 inbound access only after an incident occurs. They need a solution that continuously assesses their cloud resource configurations against compliance benchmarks and best-practice policies, and alerts on drift across both providers. Which cloud security capability best meets this requirement?

A security architect wants to ensure that only corporate laptops that meet defined security requirements (disk encryption enabled, endpoint protection running, and OS patched) can access sensitive internal applications. Endpoints that fall out of compliance should automatically be blocked from those applications until they are remediated, without an administrator manually reviewing each device. Which benefit of device compliance enforcement best describes what the architect is trying to achieve?