cert
cert-1
cert-2

Pass Cisco 350-701 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
350-701 Exam - Verified By Experts
350-701 Premium Bundle
$29.98

350-701 Premium Bundle

$79.99
$109.97
  • Premium File 789 Questions & Answers. Last update: Nov 02, 2026
  • Training Course 299 Video Lectures
  • Study Guide 701 Pages
 
$109.97
$79.99
accept 48 downloads in last 7 days
block-screenshots
Purchase Cisco 350-701 Exam Training Products Individually
Cisco 350-701 Premium File
Premium File 789 Q&A
$76.99$69.99
Cisco 350-701 Video Training Course
Training Course 299 Lectures
$21.99 $19.99
Cisco 350-701 PDF Study Guide
Study Guide 701 Pages
$21.99 $19.99
Cisco 350-701 Practice Test 93

Question 920

A distributed security team wants one cloud management view for supported FTD devices across several small branches. Which observed result BEST confirms that the security requirement is met?

  1. Compromising one application tier does not grant unrestricted lateral access to adjacent protected workloads.
  2. Approved branch traffic traverses the encrypted tunnel and response packets return through the selected protected path.
  3. Shared approved rules deploy consistently across devices and local exceptions remain tracked without uncontrolled divergence.
  4. Supported appliances receive tracked approved policies through the chosen management plane without granting excessive console privilege.

Explanation

Correct Answer

D:

Supported appliances receive tracked approved policies through the chosen management plane without granting excessive console privilege. This is an observable acceptance condition, rather than an assumption that enabling a feature alone proves security. Cloud-managed network policy still requires per-device compatibility, secure enrollment, change governance, and management connectivity. Situation: A distributed security team wants one cloud management view for supported FTD devices across several small branches.

Incorrect Answers

A:

Compromising one application tier does not grant unrestricted lateral access to adjacent protected workloads. This outcome tests North south versus east west segmentation and is not sufficient proof of the stated requirement. Here the relevant validation is: Supported appliances receive tracked approved policies through the chosen management plane without granting excessive console privilege. Situation: A distributed security team wants one cloud management view for supported FTD devices across several small branches.

B:

Approved branch traffic traverses the encrypted tunnel and response packets return through the selected protected path. This outcome tests FTD site-to-site VPN crypto policy and is not sufficient proof of the stated requirement. Here the relevant validation is: Supported appliances receive tracked approved policies through the chosen management plane without granting excessive console privilege. Situation: A distributed security team wants one cloud management view for supported FTD devices across several small branches.

C:

Shared approved rules deploy consistently across devices and local exceptions remain tracked without uncontrolled divergence. This outcome tests Centralized firewall manager versus local control and is not sufficient proof of the stated requirement. Here the relevant validation is: Supported appliances receive tracked approved policies through the chosen management plane without granting excessive console privilege. Situation: A distributed security team wants one cloud management view for supported FTD devices across several small branches.

Question 921

An analyst receives only critical events although a failed AAA attempt was logged at a lower severity. Which Cisco security control or operational response BEST addresses the stated need?

  1. Separate groups with VLAN boundaries and apply identity or context-based SGT policy where infrastructure supports scalable group enforcement.
  2. Limit administrative exposure, authenticate routing and management where supported, and protect control-plane resources against abuse.
  3. Forward security event logs over approved protected transport and synchronize clocks for reliable multi-device incident reconstruction.
  4. Correlate encrypted flow characteristics with endpoint, DNS, and identity context rather than assuming encrypted payloads are visible to ordinary sensors.

Explanation

Correct Answer

C:

Forward security event logs over approved protected transport and synchronize clocks for reliable multi-device incident reconstruction. This control addresses the failure mechanism and narrows the enforcement boundary. Central logging loses forensic value when clocks disagree or records are dropped; authenticated time and secure logging improve evidence quality. Confirm pre-change conditions using: Review syslog destinations, transport security, facility and severity filters, log loss, NTP synchronization, and collector permissions. Situation: An analyst receives only critical events although a failed AAA attempt was logged at a lower severity.

Incorrect Answers

A:

Separate groups with VLAN boundaries and apply identity or context-based SGT policy where infrastructure supports scalable group enforcement. This response applies to VLAN segmentation and SGT policy, not the controlling requirement in this case. VLANs group Layer 2 broadcast domains; SGT-based policies can follow endpoint identity across supported network paths independent of a particular subnet. For this scenario, the targeted action is: Forward security event logs over approved protected transport and synchronize clocks for reliable multi-device incident reconstruction. Situation: An analyst receives only critical events although a failed AAA attempt was logged at a lower severity.

B:

Limit administrative exposure, authenticate routing and management where supported, and protect control-plane resources against abuse. This response applies to Router control plane and management isolation, not the controlling requirement in this case. A network device has distinct control, data, and management planes; each requires separate scoped protection. For this scenario, the targeted action is: Forward security event logs over approved protected transport and synchronize clocks for reliable multi-device incident reconstruction. Situation: An analyst receives only critical events although a failed AAA attempt was logged at a lower severity.

D:

Correlate encrypted flow characteristics with endpoint, DNS, and identity context rather than assuming encrypted payloads are visible to ordinary sensors. This response applies to Encrypted network telemetry and correlated detection, not the controlling requirement in this case. Encrypted traffic analytics can leverage metadata and behavior; encryption reduces payload visibility and does not make a flow automatically benign. For this scenario, the targeted action is: Forward security event logs over approved protected transport and synchronize clocks for reliable multi-device incident reconstruction. Situation: An analyst receives only critical events although a failed AAA attempt was logged at a lower severity.

Question 922

A failed automation run repeats creation of a network object and inserts three redundant firewall rules. Before changing security policy, what evidence should the engineer examine FIRST?

  1. Inspect existing policy objects, API conflict or retry responses, object identifiers, approvals, and rollback artifacts.
  2. Inspect API documentation, token scope, request headers, JSON schema, response status, and transaction logs.
  3. Review API audit calls, token audience and lifetime, privilege scope, abnormal exports, and linked cloud-resource access.
  4. Inspect client connection logs, authentication flow, posture result, assigned routes, certificate policy, and headend access control.

Explanation

Correct Answer

A:

Inspect existing policy objects, API conflict or retry responses, object identifiers, approvals, and rollback artifacts. This checks the relevant condition before an engineer modifies production access or detection behavior. Blind retries of security policy POST requests can create duplicate or contradictory rules; idempotency and change tracking protect consistency. The controlled response would be: Implement safe automation with pre-change state capture, idempotent desired configuration, audit records, and validation after deployment. Situation: A failed automation run repeats creation of a network object and inserts three redundant firewall rules.

Incorrect Answers

B:

Inspect API documentation, token scope, request headers, JSON schema, response status, and transaction logs. This evidence addresses Authenticated security API requests; it would not establish the primary issue here. The diagnostic evidence needed for this scenario is: Inspect existing policy objects, API conflict or retry responses, object identifiers, approvals, and rollback artifacts. Situation: A failed automation run repeats creation of a network object and inserts three redundant firewall rules.

C:

Review API audit calls, token audience and lifetime, privilege scope, abnormal exports, and linked cloud-resource access. This evidence addresses Cloud API breach and lateral movement; it would not establish the primary issue here. The diagnostic evidence needed for this scenario is: Inspect existing policy objects, API conflict or retry responses, object identifiers, approvals, and rollback artifacts. Situation: A failed automation run repeats creation of a network object and inserts three redundant firewall rules.

D:

Inspect client connection logs, authentication flow, posture result, assigned routes, certificate policy, and headend access control. This evidence addresses Remote access VPN client controls; it would not establish the primary issue here. The diagnostic evidence needed for this scenario is: Inspect existing policy objects, API conflict or retry responses, object identifiers, approvals, and rollback artifacts. Situation: A failed automation run repeats creation of a network object and inserts three redundant firewall rules.

Question 923

Two office FTD peers establish an IKE session but an application subnet is absent from the protected traffic definition. Which observed result BEST confirms that the security requirement is met?

  1. Approved branch traffic traverses the encrypted tunnel and response packets return through the selected protected path.
  2. An authorized automation client commits only permitted device changes and unauthorized API operations fail without modifying running state.
  3. Tested exploit traffic is detected or blocked by the configured policy while legitimate services remain available.
  4. Compliant users receive intended protected routes and application access without exposing unrelated networks.

Explanation

Correct Answer

A:

Approved branch traffic traverses the encrypted tunnel and response packets return through the selected protected path. This is an observable acceptance condition, rather than an assumption that enabling a feature alone proves security. Successful VPN peer authentication does not prove application forwarding; selectors, route tables, NAT, and access policies also govern data traffic. Situation: Two office FTD peers establish an IKE session but an application subnet is absent from the protected traffic definition.

Incorrect Answers

B:

An authorized automation client commits only permitted device changes and unauthorized API operations fail without modifying running state. This outcome tests NETCONF RESTCONF and API management security and is not sufficient proof of the stated requirement. Here the relevant validation is: Approved branch traffic traverses the encrypted tunnel and response packets return through the selected protected path. Situation: Two office FTD peers establish an IKE session but an application subnet is absent from the protected traffic definition.

C:

Tested exploit traffic is detected or blocked by the configured policy while legitimate services remain available. This outcome tests FTD intrusion policy and malware detection and is not sufficient proof of the stated requirement. Here the relevant validation is: Approved branch traffic traverses the encrypted tunnel and response packets return through the selected protected path. Situation: Two office FTD peers establish an IKE session but an application subnet is absent from the protected traffic definition.

D:

Compliant users receive intended protected routes and application access without exposing unrelated networks. This outcome tests Cisco Secure Client remote VPN policy and is not sufficient proof of the stated requirement. Here the relevant validation is: Approved branch traffic traverses the encrypted tunnel and response packets return through the selected protected path. Situation: Two office FTD peers establish an IKE session but an application subnet is absent from the protected traffic definition.

Question 924

A SOC shares a six-month-old malware domain indicator that now resolves to a legitimate cloud service. Which observed result BEST confirms that the security requirement is met?

  1. Poisoned documents or swapped model dependencies fail integrity or access checks before affecting sensitive answers.
  2. Confirmed malicious indicators are shared and acted upon while expired or disputed indicators no longer cause unjustified blocking.
  3. One failed perimeter control does not provide unmonitored unrestricted access to sensitive workloads.
  4. Known malicious destinations are contained and exposed identities are investigated rather than relying only on awareness posters.

Explanation

Correct Answer

B:

Confirmed malicious indicators are shared and acted upon while expired or disputed indicators no longer cause unjustified blocking. This is an observable acceptance condition, rather than an assumption that enabling a feature alone proves security. Threat indicators are leads with changing confidence, not immutable proof that every matching host is compromised. Situation: A SOC shares a six-month-old malware domain indicator that now resolves to a legitimate cloud service.

Incorrect Answers

A:

Poisoned documents or swapped model dependencies fail integrity or access checks before affecting sensitive answers. This outcome tests Embedding and model supply chain risk and is not sufficient proof of the stated requirement. Here the relevant validation is: Confirmed malicious indicators are shared and acted upon while expired or disputed indicators no longer cause unjustified blocking. Situation: A SOC shares a six-month-old malware domain indicator that now resolves to a legitimate cloud service.

C:

One failed perimeter control does not provide unmonitored unrestricted access to sensitive workloads. This outcome tests Defense in depth and Cisco SAFE and is not sufficient proof of the stated requirement. Here the relevant validation is: Confirmed malicious indicators are shared and acted upon while expired or disputed indicators no longer cause unjustified blocking. Situation: A SOC shares a six-month-old malware domain indicator that now resolves to a legitimate cloud service.

D:

Known malicious destinations are contained and exposed identities are investigated rather than relying only on awareness posters. This outcome tests Phishing containment and domain verification and is not sufficient proof of the stated requirement. Here the relevant validation is: Confirmed malicious indicators are shared and acted upon while expired or disputed indicators no longer cause unjustified blocking. Situation: A SOC shares a six-month-old malware domain indicator that now resolves to a legitimate cloud service.

Question 925

An attacker changes a laptop MAC address to imitate a registered printer and attempts to reach finance servers. Which TWO complementary steps provide the most defensible remediation and its supporting assessment? Select TWO.

  1. Inspect security agent health, supported application versions, posture evidence, policy exceptions, and dynamic authorization.
  2. Authorized managed endpoints join the intended network while expired, revoked, or untrusted device credentials receive restricted treatment.
  3. Configure network access device 802.1X to use Cisco ISE RADIUS decisions and verify supplicant, authenticator, and server roles.
  4. Inspect known endpoint MAC registrations, profiling data, switch authentication order, RADIUS policy, and allowed destination flows.
  5. Use MAC Authentication Bypass only for supported non-802.1X devices with restricted roles and inventory-backed policy.

Explanation

Correct Answers

D:

Inspect known endpoint MAC registrations, profiling data, switch authentication order, RADIUS policy, and allowed destination flows. This checks the relevant condition before an engineer modifies production access or detection behavior. MAB relies on spoofable MAC identity and should be treated as lower-assurance admission, not an equivalent replacement for EAP-TLS. The controlled response would be: Use MAC Authentication Bypass only for supported non-802.1X devices with restricted roles and inventory-backed policy. This supplies the diagnostic evidence needed for the complementary action. Situation: An attacker changes a laptop MAC address to imitate a registered printer and attempts to reach finance servers.

E:

Use MAC Authentication Bypass only for supported non-802.1X devices with restricted roles and inventory-backed policy. This control addresses the failure mechanism and narrows the enforcement boundary. MAB relies on spoofable MAC identity and should be treated as lower-assurance admission, not an equivalent replacement for EAP-TLS. Confirm pre-change conditions using: Inspect known endpoint MAC registrations, profiling data, switch authentication order, RADIUS policy, and allowed destination flows. This is the implementation portion of the complementary pair. Situation: An attacker changes a laptop MAC address to imitate a registered printer and attempts to reach finance servers.

Incorrect Answers

A:

Inspect security agent health, supported application versions, posture evidence, policy exceptions, and dynamic authorization. This step could matter for Endpoint application compliance and risk-based access but is not part of the required complementary pair for this case. The paired steps are: Use MAC Authentication Bypass only for supported non-802.1X devices with restricted roles and inventory-backed policy. and Inspect known endpoint MAC registrations, profiling data, switch authentication order, RADIUS policy, and allowed destination flows. Situation: An attacker changes a laptop MAC address to imitate a registered printer and attempts to reach finance servers.

B:

Authorized managed endpoints join the intended network while expired, revoked, or untrusted device credentials receive restricted treatment. This step could matter for Certificate identity and noncompliant access segregation but is not part of the required complementary pair for this case. The paired steps are: Use MAC Authentication Bypass only for supported non-802.1X devices with restricted roles and inventory-backed policy. and Inspect known endpoint MAC registrations, profiling data, switch authentication order, RADIUS policy, and allowed destination flows. Situation: An attacker changes a laptop MAC address to imitate a registered printer and attempts to reach finance servers.

C:

Configure network access device 802.1X to use Cisco ISE RADIUS decisions and verify supplicant, authenticator, and server roles. This step could matter for 802.1X port-based access with Cisco ISE but is not part of the required complementary pair for this case. The paired steps are: Use MAC Authentication Bypass only for supported non-802.1X devices with restricted roles and inventory-backed policy. and Inspect known endpoint MAC registrations, profiling data, switch authentication order, RADIUS policy, and allowed destination flows. Situation: An attacker changes a laptop MAC address to imitate a registered printer and attempts to reach finance servers.

Question 926

An administrator issues CoA for an outdated duplicate session record and cannot observe the desired client change. Which Cisco security control or operational response BEST addresses the stated need?

  1. Trace failed Cisco ISE CoA requests through dynamic authorization configuration, source identity, shared secret, session selection, and device support.
  2. Correlate Cisco XDR observables, endpoint detections, email, and network events to establish incident scope and response before automating containment.
  3. Correlate unusual encrypted uploads and sanctioned cloud-service use with identity, DLP, destination, and endpoint telemetry.
  4. Use RADIUS Change of Authorization to trigger reauthentication or update access on an active network session when identity or posture changes.

Explanation

Correct Answer

A:

Trace failed Cisco ISE CoA requests through dynamic authorization configuration, source identity, shared secret, session selection, and device support. This control addresses the failure mechanism and narrows the enforcement boundary. A policy rule update does not retroactively rewrite an existing session without a supported reauthorization mechanism and a successful CoA exchange. Confirm pre-change conditions using: Inspect CoA NAK or timeout records, UDP transport, session identifiers, network device shared secret, and switch logs. Situation: An administrator issues CoA for an outdated duplicate session record and cannot observe the desired client change.

Incorrect Answers

B:

Correlate Cisco XDR observables, endpoint detections, email, and network events to establish incident scope and response before automating containment. This response applies to Cisco XDR cross-source incident correlation, not the controlling requirement in this case. XDR brings signals across integrated controls; cross-product visibility depends on healthy connectors and source coverage. For this scenario, the targeted action is: Trace failed Cisco ISE CoA requests through dynamic authorization configuration, source identity, shared secret, session selection, and device support. Situation: An administrator issues CoA for an outdated duplicate session record and cannot observe the desired client change.

C:

Correlate unusual encrypted uploads and sanctioned cloud-service use with identity, DLP, destination, and endpoint telemetry. This response applies to HTTPS and cloud-storage exfiltration containment, not the controlling requirement in this case. HTTPS encryption does not prove the destination or data transfer is authorized; flow, SaaS policy, and endpoint context can reveal risk without blindly decrypting all traffic. For this scenario, the targeted action is: Trace failed Cisco ISE CoA requests through dynamic authorization configuration, source identity, shared secret, session selection, and device support. Situation: An administrator issues CoA for an outdated duplicate session record and cannot observe the desired client change.

D:

Use RADIUS Change of Authorization to trigger reauthentication or update access on an active network session when identity or posture changes. This response applies to CoA session reauthorization by Cisco ISE, not the controlling requirement in this case. CoA allows an AAA policy server to request changes to an existing access session; it requires compatible network device settings and correct session matching. For this scenario, the targeted action is: Trace failed Cisco ISE CoA requests through dynamic authorization configuration, source identity, shared secret, session selection, and device support. Situation: An administrator issues CoA for an outdated duplicate session record and cannot observe the desired client change.

Question 927

An SSL remote access profile unexpectedly routes all personal browsing through an expensive corporate headend. Which TWO complementary steps provide the most defensible remediation and its supporting assessment? Select TWO.

  1. Intended application traffic matches a narrow allow rule and unauthorized flows are denied with traceable evidence.
  2. Configure Cisco Secure Client remote access to FTD with supported authentication, client profile, access restrictions, and split tunnel settings.
  3. Review fail-open or fail-closed expectations, high-availability topology, interface mode, IPS rule state, and packet counters.
  4. Configure FTD site-to-site VPN using compatible peer parameters, network selectors, identities, and routing/access rules, then verify both tunnel phases.
  5. Inspect group policy selection, identity provider/RADIUS logs, VPN address pool, route list, certificate profile, and access-control logs.

Explanation

Correct Answers

B:

Configure Cisco Secure Client remote access to FTD with supported authentication, client profile, access restrictions, and split tunnel settings. This control addresses the failure mechanism and narrows the enforcement boundary. Remote client tunnel success, user authentication, and authorized application reachability are distinct troubleshooting checkpoints. Confirm pre-change conditions using: Inspect group policy selection, identity provider/RADIUS logs, VPN address pool, route list, certificate profile, and access-control logs. This is the implementation portion of the complementary pair. Situation: An SSL remote access profile unexpectedly routes all personal browsing through an expensive corporate headend.

E:

Inspect group policy selection, identity provider/RADIUS logs, VPN address pool, route list, certificate profile, and access-control logs. This checks the relevant condition before an engineer modifies production access or detection behavior. Remote client tunnel success, user authentication, and authorized application reachability are distinct troubleshooting checkpoints. The controlled response would be: Configure Cisco Secure Client remote access to FTD with supported authentication, client profile, access restrictions, and split tunnel settings. This supplies the diagnostic evidence needed for the complementary action. Situation: An SSL remote access profile unexpectedly routes all personal browsing through an expensive corporate headend.

Incorrect Answers

A:

Intended application traffic matches a narrow allow rule and unauthorized flows are denied with traceable evidence. This step could matter for FTD access control rule ordering but is not part of the required complementary pair for this case. The paired steps are: Configure Cisco Secure Client remote access to FTD with supported authentication, client profile, access restrictions, and split tunnel settings. and Inspect group policy selection, identity provider/RADIUS logs, VPN address pool, route list, certificate profile, and access-control logs. Situation: An SSL remote access profile unexpectedly routes all personal browsing through an expensive corporate headend.

C:

Review fail-open or fail-closed expectations, high-availability topology, interface mode, IPS rule state, and packet counters. This step could matter for Inline IPS availability and bypass behavior but is not part of the required complementary pair for this case. The paired steps are: Configure Cisco Secure Client remote access to FTD with supported authentication, client profile, access restrictions, and split tunnel settings. and Inspect group policy selection, identity provider/RADIUS logs, VPN address pool, route list, certificate profile, and access-control logs. Situation: An SSL remote access profile unexpectedly routes all personal browsing through an expensive corporate headend.

D:

Configure FTD site-to-site VPN using compatible peer parameters, network selectors, identities, and routing/access rules, then verify both tunnel phases. This step could matter for FTD site-to-site VPN crypto policy but is not part of the required complementary pair for this case. The paired steps are: Configure Cisco Secure Client remote access to FTD with supported authentication, client profile, access restrictions, and split tunnel settings. and Inspect group policy selection, identity provider/RADIUS logs, VPN address pool, route list, certificate profile, and access-control logs. Situation: An SSL remote access profile unexpectedly routes all personal browsing through an expensive corporate headend.

Question 928

A privileged user provides a valid password but does not have the required second factor for an admin portal. Which observed result BEST confirms that the security requirement is met?

  1. An unknown IoT printer receives a restrictive authorization pending verification rather than unconditional internal access.
  2. A riskier session receives a stronger verification or denial decision without blocking routine authorized access unnecessarily.
  3. Users with acceptable identities and devices reach protected apps while stolen passwords or untrusted device states fail authorization.
  4. A controlled policy change reaches the correct active session and either reauthenticates or terminates it as intended.

Explanation

Correct Answer

C:

Users with acceptable identities and devices reach protected apps while stolen passwords or untrusted device states fail authorization. This is an observable acceptance condition, rather than an assumption that enabling a feature alone proves security. Multifactor authentication strengthens login assurance, while device trust and adaptive controls independently evaluate session risk. Situation: A privileged user provides a valid password but does not have the required second factor for an admin portal.

Incorrect Answers

A:

An unknown IoT printer receives a restrictive authorization pending verification rather than unconditional internal access. This outcome tests Cisco ISE profiling and endpoint identity certainty and is not sufficient proof of the stated requirement. Here the relevant validation is: Users with acceptable identities and devices reach protected apps while stolen passwords or untrusted device states fail authorization. Situation: A privileged user provides a valid password but does not have the required second factor for an admin portal.

B:

A riskier session receives a stronger verification or denial decision without blocking routine authorized access unnecessarily. This outcome tests Duo Adaptive Access and SSO context and is not sufficient proof of the stated requirement. Here the relevant validation is: Users with acceptable identities and devices reach protected apps while stolen passwords or untrusted device states fail authorization. Situation: A privileged user provides a valid password but does not have the required second factor for an admin portal.

D:

A controlled policy change reaches the correct active session and either reauthenticates or terminates it as intended. This outcome tests CoA failure and authorization policy debugging and is not sufficient proof of the stated requirement. Here the relevant validation is: Users with acceptable identities and devices reach protected apps while stolen passwords or untrusted device states fail authorization. Situation: A privileged user provides a valid password but does not have the required second factor for an admin portal.

Question 929

A static print server loses connectivity after ARP inspection is enabled without documenting its fixed address mapping. Which TWO complementary steps provide the most defensible remediation and its supporting assessment? Select TWO.

  1. Review syslog destinations, transport security, facility and severity filters, log loss, NTP synchronization, and collector permissions.
  2. Inspect DHCP snooping bindings or static ARP ACLs, trusted links, validation drops, and legitimate static IP exceptions.
  3. Enable DHCP snooping on the supported switch VLANs and trust only intended DHCP-server-facing interfaces.
  4. Intended application traffic matches a narrow allow rule and unauthorized flows are denied with traceable evidence.
  5. Use Dynamic ARP Inspection with reliable IP-to-MAC bindings to reject forged ARP claims on untrusted access interfaces.

Explanation

Correct Answers

B:

Inspect DHCP snooping bindings or static ARP ACLs, trusted links, validation drops, and legitimate static IP exceptions. This checks the relevant condition before an engineer modifies production access or detection behavior. DAI relies on trustworthy binding information; enabling inspection without handling static addressing can interrupt legitimate users. The controlled response would be: Use Dynamic ARP Inspection with reliable IP-to-MAC bindings to reject forged ARP claims on untrusted access interfaces. This supplies the diagnostic evidence needed for the complementary action. Situation: A static print server loses connectivity after ARP inspection is enabled without documenting its fixed address mapping.

E:

Use Dynamic ARP Inspection with reliable IP-to-MAC bindings to reject forged ARP claims on untrusted access interfaces. This control addresses the failure mechanism and narrows the enforcement boundary. DAI relies on trustworthy binding information; enabling inspection without handling static addressing can interrupt legitimate users. Confirm pre-change conditions using: Inspect DHCP snooping bindings or static ARP ACLs, trusted links, validation drops, and legitimate static IP exceptions. This is the implementation portion of the complementary pair. Situation: A static print server loses connectivity after ARP inspection is enabled without documenting its fixed address mapping.

Incorrect Answers

A:

Review syslog destinations, transport security, facility and severity filters, log loss, NTP synchronization, and collector permissions. This step could matter for Secure syslog and timestamp correlation but is not part of the required complementary pair for this case. The paired steps are: Use Dynamic ARP Inspection with reliable IP-to-MAC bindings to reject forged ARP claims on untrusted access interfaces. and Inspect DHCP snooping bindings or static ARP ACLs, trusted links, validation drops, and legitimate static IP exceptions. Situation: A static print server loses connectivity after ARP inspection is enabled without documenting its fixed address mapping.

C:

Enable DHCP snooping on the supported switch VLANs and trust only intended DHCP-server-facing interfaces. This step could matter for DHCP snooping trust and rogue server control but is not part of the required complementary pair for this case. The paired steps are: Use Dynamic ARP Inspection with reliable IP-to-MAC bindings to reject forged ARP claims on untrusted access interfaces. and Inspect DHCP snooping bindings or static ARP ACLs, trusted links, validation drops, and legitimate static IP exceptions. Situation: A static print server loses connectivity after ARP inspection is enabled without documenting its fixed address mapping.

D:

Intended application traffic matches a narrow allow rule and unauthorized flows are denied with traceable evidence. This step could matter for FTD access control rule ordering but is not part of the required complementary pair for this case. The paired steps are: Use Dynamic ARP Inspection with reliable IP-to-MAC bindings to reject forged ARP claims on untrusted access interfaces. and Inspect DHCP snooping bindings or static ARP ACLs, trusted links, validation drops, and legitimate static IP exceptions. Situation: A static print server loses connectivity after ARP inspection is enabled without documenting its fixed address mapping.

Question 930

An internal API returns a certificate for another hostname after a load-balancer migration. Which observed result BEST confirms that the security requirement is met?

  1. A client rejects a substituted or expired certificate rather than accepting encryption to the wrong endpoint.
  2. Protected traffic crosses the tunnel with authenticated peers and encrypted data even behind the intended NAT device.
  3. New approved networks traverse the intended secured virtual tunnel without proliferating inconsistent policy selectors.
  4. Poisoned documents or swapped model dependencies fail integrity or access checks before affecting sensitive answers.

Explanation

Correct Answer

A:

A client rejects a substituted or expired certificate rather than accepting encryption to the wrong endpoint. This is an observable acceptance condition, rather than an assumption that enabling a feature alone proves security. Encryption without authenticated identity does not rule out interception; certificates bind a public key to a verified name under a trust chain. Situation: An internal API returns a certificate for another hostname after a load-balancer migration.

Incorrect Answers

B:

Protected traffic crosses the tunnel with authenticated peers and encrypted data even behind the intended NAT device. This outcome tests IPsec IKE and NAT traversal and is not sufficient proof of the stated requirement. Here the relevant validation is: A client rejects a substituted or expired certificate rather than accepting encryption to the wrong endpoint. Situation: An internal API returns a certificate for another hostname after a load-balancer migration.

C:

New approved networks traverse the intended secured virtual tunnel without proliferating inconsistent policy selectors. This outcome tests Route-based versus policy-based VPN design and is not sufficient proof of the stated requirement. Here the relevant validation is: A client rejects a substituted or expired certificate rather than accepting encryption to the wrong endpoint. Situation: An internal API returns a certificate for another hostname after a load-balancer migration.

D:

Poisoned documents or swapped model dependencies fail integrity or access checks before affecting sensitive answers. This outcome tests Embedding and model supply chain risk and is not sufficient proof of the stated requirement. Here the relevant validation is: A client rejects a substituted or expired certificate rather than accepting encryption to the wrong endpoint. Situation: An internal API returns a certificate for another hostname after a load-balancer migration.

Implementing and Operating Cisco Security Core Technologies (350-701) Practice Tests