2026 Latest 100% Exam Passing Ratio – 350-701 Dumps PDF [Q269-Q293]

ExamBoosts May 16, 2026 350-701 > Cisco 0

Rate this post

2026 Latest 100% Exam Passing Ratio – 350-701 Dumps PDF

Pass Exam With Full Sureness – 350-701 Dumps with 727 Questions

NO.269 What is the function of the Context Directory Agent?

accepts user authentication requests on behalf of Web Security Appliance for user identification

relays user authentication requests from Web Security Appliance to Active Directory

maintains users’ group memberships

reads the Active Directory logs to map IP addresses to usernames

NO.270 A network engineer is trying to figure out whether FlexVPN or DMVPN would fit better in their environment.
They have a requirement for more stringent security multiple security associations for the connections, more efficient VPN establishment as well consuming less bandwidth. Which solution would be best for this and why?

DMVPN because it supports IKEv2 and FlexVPN does not

FlexVPN because it supports IKEv2 and DMVPN does not

FlexVPN because it uses multiple SAs and DMVPN does not

DMVPN because it uses multiple SAs and FlexVPN does not

FlexVPN supports IKEv2 -> Answer A is not correct.
DMVPN supports both IKEv1 & IKEv2 -> Answer B is not correct.
FlexVPN support multiple SAs -> Answer D is not correct.

NO.271 An administrator configures new authorization policies within Cisco ISE and has difficulty profiling the devices. Attributes for the new Cisco IP phones that are profiled based on the RADIUS authentication are seen however the attributes for CDP or DHCP are not. What should the administrator do to address this issue?

Configure the ip dhcp snooping trust command on the DHCP interfaces to get the information to Cisco ISE

Configure the authentication port-control auto feature within Cisco ISE to identify the devices that are trying to connect

Configure a service template within the switch to standardize the port configurations so that the correct information is sent to Cisco ISE

Configure the device sensor feature within the switch to send the appropriate protocol information

Device sensor is a feature of access devices. It allows to collect information about connected endpoints.
Mostly,
information collected by Device Sensor can come from the following protocols:
+ Cisco Discovery Protocol (CDP)
+ Link Layer Discovery Protocol (LLDP)
+ Dynamic Host Configuration Protocol (DHCP)
Reference: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200292- ConfigureDevice-Sensor-for-ISE-Profilin.html

NO.272 II
An engineer musi set up 200 new laptops on a network and wants to prevent the users from moving their laptops around to simplify administration Which switch port MAC address security setting must be used?

sticky

static

aging

maximum

NO.273 Drag and drop the capabilities of Cisco Firepower versus Cisco AMP from the left into the appropriate category on the right.

NO.274 What is a difference between GRE over IPsec and IPsec with crypto map?

Multicast traffic is supported by IPsec with crypto map.

GRE over IPsec supports non-IP protocols.

GRE provides its own encryption mechanism.

IPsec with crypto map oilers better scalability.

The difference between GRE over IPsec and IPsec with crypto map is that GRE (Generic Routing Encapsulation) over IPsec can encapsulate and transport non-IP protocols across an IP network, whereas IPsec with crypto map is typically used for IP traffic. GRE tunnels wrapped in IPsec provide a way to transport multicast traffic and other protocol types across an IPsec VPN, offering greater flexibility in the types of traffic that can be secured.

NO.275 Which Cisco Firewall solution requires zone definition?

CBAC

Cisco AMP

ZBFW

Cisco ASA

ZBFW stands for Zone-Based Firewall, which is a feature that allows unidirectional application of IOS firewall policies between groups of interfaces known as zones. Interfaces are assigned to zones, and firewall rules are applied to specific types of traffic moving in one direction between the zones. ZBFW enforces a secure inter-zone policy by default, meaning traffic cannot pass between security zones until an explicit policy allowing that traffic is defined. The zone itself is an abstraction of multiple interfaces with the same or similar security requirements that can be logically grouped together. ZBFW is CBAC’s replacement and offers intuitive policies for multiple-interface routers, increased granularity of firewall policy application, and a default deny-all policy that prohibits traffic between firewall security zones until an explicit policy is applied to allow desirable traffic. ZBFW is supported on IOS devices running 12.4(6)T or later, and ASR devices running 12.2(33) or later. References:
* Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0, Module 4: Securing the Cloud, Lesson 4.1: Introducing Cisco Cloud Services Router 1000V Series, Topic 4.1.2: Zone-Based Firewall
* Understand the Zone-Based Policy Firewall Design
* Managing Zone-based Firewall Rules
* Zone Based Firewall Overview
* CBAC vs. Zone-based firewall

NO.276 Refer to the exhibit.

An organization is using DHCP Snooping within their network. A user on VLAN 41 on a new switch is complaining that an IP address is not being obtained. Which command should be configured on the switch interface in order to provide the user with network connectivity?

ip dhcp snooping verify mac-address

ip dhcp snooping limit 41

ip dhcp snooping vlan 41

ip dhcp snooping trust

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html

NO.277 Refer to the exhibit.

An engineer must configure a Cisco switch to perform PPP authentication via a TACACS server located at IP address 10.1.1.10. Authentication must fall back to the local database using the username LocalUser and password C1Sc0451069341l if the TACACS server is unreachable.
Drag and drop the commands from the left onto the corresponding configuration steps on the right.

Explanation:

NO.278 A security engineer is tasked with configuring TACACS on a Cisco ASA firewall. The engineer must be able to access the firewall command line interface remotely. The authentication must fall back to the local user database of the Cisco ASA firewall. AAA server group named TACACS-GROUP is already configured with TACACS server IP address 192.168.10.10 and key C1sc0512222832!. Which configuration must be done next to meet the requirement?

aaa authentication ssh console LOCAL TACACS-GROUP

aaa authentication ssh console TACACS-GROUP LOCAL

aaa authentication serial console LOCAL TACACS-GROUP

aaa authentication http console TACACS-GROUP LOCAL

NO.279 Which command is used to log all events to a destination colector 209.165.201.107?

CiscoASA(config-pmap-c)#flow-export event-type flow-update destination 209.165.201.10

CiscoASA(config-cmap)# flow-export event-type all destination 209.165.201.

CiscoASA(config-pmap-c)#flow-export event-type all destination 209.165.201.10

CiscoASA(config-cmap)#flow-export event-type flow-update destination 209.165.201.10

NO.280 Which two application layer preprocessors are used by Firepower Next Generation Intrusion Prevention System? (Choose two.)

SIP

inline normalization

SSL

packet decoder

modbus

NO.281 What is the function of SDN southbound API protocols?

to enable the controller to make changes

to allow for the dynamic configuration of control plane applications

to enable the controller to use REST

to allow for the static configuration of control plane applications

Explanation

NO.282 An engineer must enable Outbreak Filters globally on an AsyncOS for Cisco Secure Email Gateway to protect the network from large-scale malware attacks. Drag and drop the steps from the left into the sequence on the right to complete the configuration.

NO.283 Refer to the exhibit.

An engineer configured wired 802.1x on the network and is unable to get a laptop to authenticate. Which port configuration is missing?

authentication open

dotlx reauthentication

cisp enable

dot1x pae authenticator

NO.284 How is Cisco Umbrella configured to log only security events?

per policy

in the Reporting settings

in the Security Settings section

per network in the Deployments section

The logging of your identities’ activities is set per-policy when you first create a policy. By default, logging is on and set to log all requests an identity makes to reach destinations. At any time after you create a policy, you can change what level of identity activity Umbrella logs.
From the Policy wizard, log settings are:
Log All Requests-For full logging, whether for content, security or otherwise Log Only Security Events-For security logging only, which gives your users more privacy-a good setting for people with the roaming client installed on personal devices Don’t Log Any Requests-Disables all logging. If you select this option, most reporting for identities with this policy will not be helpful as nothing is logged to report on.

NO.285 Drag and drop the Firepower Next Generation Intrusion Prevention System detectors from the left onto the correct definitions on the right.

NO.286 Which portion of the network do EPP solutions solely focus on and EDR solutions do not?

server farm

perimeter

core

East-West gateways

NO.287 Refer to the exhibit.

What does the API do when connected to a Cisco security appliance?

gather network telemetry information from AMP for endpoints

create an SNMP pull mechanism for managing AMP

get the process and PID information from the computers in the network

gather the network interface information about the computers AMP sees

NO.288 Refer to the exhibit.

Which command was used to generate this output and to show which ports are authenticating with dot1x or mab?

show authentication registrations

show authentication method

show dot1x all

show authentication sessions

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-xe-3se-3850-cr-book/sec-s1-xe-3se-
3850-cr-book_chapter_01.html#wp3404908137
Displaying the Summary of All Auth Manager Sessions on the Switch
Enter the following:
Switch# show authentication sessions
Interface MAC Address Method Domain Status Session ID
Gi1/48 0015.63b0.f676 dot1x DATA Authz Success 0A3462B1000000102983C05C Gi1/5 000f.23c4.a401 mab DATA Authz Success 0A3462B10000000D24F80B58 Gi1/5 0014.bf5d.d26d dot1x DATA Authz Success 0A3462B10000000E29811B94

NO.289 An engineer must configure Cisco AMP for Endpoints so that it contains a list of files that should not be executed by users. These files must not be quarantined. Which action meets this configuration requirement?

Identity the network IPs and place them in a blocked list.

Modify the advanced custom detection list to include these files.

Create an application control blocked applications list.

Add a list for simple custom detection.

create an application control blocked applications list. This option allows you to specify a list of files that you want to prevent from running on the endpoints that have the AMP connector installed. The files are identified by their SHA-256 hashes, and you can upload them individually or in a batch. The files are not quarantined, but they are blocked from execution and reported as events in the AMP console1. This option is different from the simple custom detection list, which is used to detect and quarantine specific files that are considered malicious2. The advanced custom detection list is also used to detect and quarantine files, but it allows you to specify more criteria such as file size, file name, and file path3. The IP block and allow lists are used to control the network traffic to and from the endpoints, not the file execution4. References: 1: Configure Application Control on the AMP for Endpoints Portal 2: Configure a Simple Custom Detection List on the AMP for Endpoints Portal 3: [Configure an Advanced Custom Detection List on the AMP for Endpoints Portal] 4: [Configure IP Block and Allow Lists on the AMP for Endpoints Portal]

NO.290 Drag and drop the capabilities from the left onto the correct technologies on the right.

NO.291 What is a difference between Cisco AMP for Endpoints and Cisco Umbrella?

Cisco AMP for Endpoints is a cloud-based service, and Cisco Umbrella is not.

Cisco AMP for Endpoints prevents connections to malicious destinations, and C malware.

Cisco AMP for Endpoints automatically researches indicators of compromise ..

Cisco AMP for Endpoints prevents, detects, and responds to attacks before and against Internet threats.

https://learn-umbrella.cisco.com/i/802005-umbrella-security-report/3?
https://www.cisco.com/site/us/en/products/security/endpoint-security/secure-endpoint/index.html#:~:text=Powerful%20EDR%20capabilities,from%20Kenna%20Security.
Cisco Advanced Malware Protection (AMP) for endpoints can be seen as a replacement for the traditional antivirus solution. It is a next generation, cloud delivered endpoint protection platform (EPP), and advanced endpoint detection and response (EDR). Providing Protection – Detection Response While Cisco Umbrella can enforce security at the DNS-, IP-, and HTTP/S-layer, this report does not require that blocking is enabled and only monitors your DNS activity. Any malicious domains requested and IPs resolved are indicators of compromise (IOC).
Any malicious domains requested and IPs resolved are indicators of compromise (IOC)

NO.292 Which security product enables administrators to deploy Kubernetes clusters in air-gapped sites without needing Internet access?

Cisco Content Platform

Cisco Container Controller

Cisco Container Platform

Cisco Cloud Platform

Cisco Container Platform (CCP) is a security product that enables administrators to deploy Kubernetes clusters in air-gapped sites without needing Internet access. CCP tenant images contain all the necessary binaries and don’t need internet access to function. CCP also supports offline installation and updates of the platform components. CCP is designed to simplify the deployment and management of containerized applications across hybrid cloud environments, while ensuring security and compliance. CCP integrates with Cisco security solutions such as Cisco Tetration and Cisco Stealthwatch Cloud to provide visibility and protection for Kubernetes clusters and workloads. CCP also leverages Cisco Intersight, a cloud-based management platform, to provide centralized monitoring and automation for CCP clusters. References:
* Cisco Container Platform
* 350-701 SCOR Cisco CCNP Security Updated Questions in April

NO.293 An engineer is implementing Cisco CES in an existing Microsoft Office 365 environment and must route inbound email to Cisco CE.. record must be modified to accomplish this task?

CNAME

SPF

DKIM

To route inbound email to Cisco Cloud Email Security (CES), the engineer must modify the MX record of the domain to point to the CES hostname or IP address. The MX record is a DNS record that specifies the mail server responsible for accepting email messages on behalf of a domain name. By changing the MX record, the engineer can direct all incoming email traffic to the CES gateway, where it can be filtered and scanned for threats before being delivered to the Microsoft Office 365 mailboxes. The other options are not relevant for this task. A CNAME record is a DNS record that maps an alias name to a canonical name. An SPF record is a DNS record that identifies the authorized senders of email for a domain. A DKIM record is a DNS record that contains a public key for verifying the digital signature of email messages sent from a domain. References := Some possible references for this question are:
* Configure Microsoft 365 with Secure Email
* Configure Microsoft 365 with Secure Email – More
* [Cisco Cloud Email Security – Configuration Guide]

Loading …