350-701 Dumps 2026 - New Cisco 350-701 Exam Questions
Free 350-701 Braindumps Download Updated on Jun 26, 2026 with 727 Questions
Cisco 350-701 (Implementing and Operating Cisco Security Core Technologies) Exam is designed for network security professionals who are responsible for implementing and operating core security technologies for their organization. 350-701 exam focuses on the latest security technologies and solutions that are necessary to implement a comprehensive security strategy. 350-701 exam validates the knowledge and skills of the candidates in areas such as network security, cloud security, content security, endpoint protection and detection, secure network access, visibility, and enforcement.
Understanding functional and technical aspects of Implementing and Operating Cisco Security Core Technologies (SCOR 350-701) Security Concepts
The following will be discussed in CISCO 350-701 exam dumps:
- Explain DNAC APIs for network provisioning, optimization, monitoring, and troubleshooting
- Compare common security vulnerabilities such as software bugs, weak and/or hardcoded passwords, SQL injection, missing encryption, buffer overflow, path traversal, cross-site scripting/forgery
- Describe security intelligence authoring, sharing, and consumption
- Describe functions of the cryptography components such as hashing, encryption, PKI, SSL, IPsec, NAT-T IPv4 for IPsec, pre-shared key and certificate based authorization
- Compare site-to-site VPN and remote access VPN deployment types such as sVTI, IPsec, Cryptomap, DMVPN, FLEXVPN including high availability considerations, and AnyConnect
- Interpret basic Python scripts used to call Cisco Security appliances APIs
- On-premises: viruses, trojans, DoS/DDoS attacks, phishing, rootkits, man-in-themiddle attacks, SQL injection, cross-site scripting, malware
NEW QUESTION # 317
Refer to the exhibit.
What is a result of the configuration?
- A. Traffic from the inside and DMZ networks is redirected
- B. Traffic from the inside network is redirected
- C. Traffic from the DMZ network is redirected
- D. All TCP traffic is redirected
Answer: A
Explanation:
The purpose of above commands is to redirect traffic that matches the ACL "redirect-acl" to the Cisco FirePOWER (SFR) module in the inline (normal) mode. In this mode, after the undesired traffic is dropped and any other actions that are applied by policy are performed, the traffic is returned to the ASA for further processing and ultimate transmission. The command "service-policy global_policy global" applies the policy to all of the interfaces. Reference: https://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configurefirepower-00.html FirePOWER (SFR) module in the inline (normal) mode. In this mode, after the undesired traffic is dropped and any other actions that are applied by policy are performed, the traffic is returned to the ASA for further processing and ultimate transmission.
The command "service-policy global_policy global" applies the policy to all of the interfaces.
The purpose of above commands is to redirect traffic that matches the ACL "redirect-acl" to the Cisco FirePOWER (SFR) module in the inline (normal) mode. In this mode, after the undesired traffic is dropped and any other actions that are applied by policy are performed, the traffic is returned to the ASA for further processing and ultimate transmission. The command "service-policy global_policy global" applies the policy to all of the interfaces. Reference: https://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configurefirepower-00.html
NEW QUESTION # 318
An engineer wants to generate NetFlow records on traffic traversing the Cisco ASA. Which Cisco ASA command must be used?
- A. ip flow monitor input
- B. ip flow-export destination 1.1.1.1 2055
- C. flow-export destination inside 1.1.1.1 2055
- D. flow exporter
Answer: C
Explanation:
The syntax of this command is: flow-export destination interface-name ipv4-address | hostname udp-port This command is used on Cisco ASA to configure Network Secure Event Logging (NSEL) collector to which NetFlow packets are sent. The destination keyword indicates that a NSEL collector is being configured. + The interface-name argument is the name of the ASA and ASA Services Module interface through which the collector is reached. + The ipv4-address argument is the IP address of the machine running the collector application. + The hostname argument is the destination IP address or name of the collector. + The udp-port argument is the UDP port number to which NetFlow packets are sent. You can configure a maximum of five collectors. After a collector is configured, template records are automatically sent to all configured NSEL collectors. Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/ monitor_nsel.html This command is used on Cisco ASA to configure Network Secure Event Logging (NSEL) collector to which NetFlow packets are sent. The destination keyword indicates that a NSEL collector is being configured.
+ The interface-name argument is the name of the ASA and ASA Services Module interface through which the collector is reached.
+ The ipv4-address argument is the IP address of the machine running the collector application.
+ The hostname argument is the destination IP address or name of the collector.
+ The udp-port argument is the UDP port number to which NetFlow packets are sent.
You can configure a maximum of five collectors. After a collector is configured, template records are automatically sent to all configured NSEL collectors.
Reference:
The syntax of this command is: flow-export destination interface-name ipv4-address | hostname udp-port This command is used on Cisco ASA to configure Network Secure Event Logging (NSEL) collector to which NetFlow packets are sent. The destination keyword indicates that a NSEL collector is being configured. + The interface-name argument is the name of the ASA and ASA Services Module interface through which the collector is reached. + The ipv4-address argument is the IP address of the machine running the collector application. + The hostname argument is the destination IP address or name of the collector. + The udp-port argument is the UDP port number to which NetFlow packets are sent. You can configure a maximum of five collectors. After a collector is configured, template records are automatically sent to all configured NSEL collectors. Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/ monitor_nsel.html
NEW QUESTION # 319
Drag and drop the cryptographic algorithms for IPsec from the left onto the cryptographic processes on the right.
Answer:
Explanation:
NEW QUESTION # 320
When choosing an algorithm to us what should be considered about Diffie Hellman and RSA for key establishment?
- A. DH is on asymmetric key establishment algorithm intended to output symmetric keys.
- B. RSA is an asymmetric key establishment algorithm Intended to output symmetric keys.
- C. RSA is a symmetric key establishment algorithm intended to output asymmetric keys.
- D. DH is a symmetric key establishment algorithm Intended to output asymmetric keys
Answer: A
NEW QUESTION # 321
Which two features of Cisco DNA Center are used in a Software Defined Network solution? (Choose two.)
- A. authentication
- B. encryption
- C. assurance
- D. automation
- E. accounting
Answer: C,D
NEW QUESTION # 322
Which two request of REST API are valid on the Cisco ASA Platform? (Choose two)
- A. get
- B. options
- C. push
- D. put
- E. connect
Answer: A,D
Explanation:
ExplanationThe ASA REST API gives you programmatic access to managing individual ASAs through a Representational State Transfer (REST) API. The API allows external clients to perform CRUD (Create, Read, Update, Delete) operations on ASA resources; it is based on the HTTPS protocol and REST methodology.All API requests are sent over HTTPS to the ASA, and a response is returned.Request StructureAvailable request methods are:GET - Retrieves data from the specified object.PUT - Adds the supplied information to the specified object; returns a 404 Resource Not Found error if the object does not exist.POST - Creates the object with the supplied information.DELETE - Deletes the specified object Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/api/qsg-asa-api.html
NEW QUESTION # 323
An administrator has been tasked with configuring the Cisco Secure Email Gateway to ensure there are no viruses before quarantined emails are delivered. In addition, delivery of mail from known bad mail servers must be prevented. Which two actions must be taken in order to meet these requirements? (Choose two.)
- A. Scan quarantined emails using AntiVirus signatures.
- B. Deploy the Secure Email Gateway in the DMZ.
- C. Configure a recipient access table.
- D. Enable a message tracking service.
- E. Use outbreak filters from Cisco Talos.
Answer: A,E
NEW QUESTION # 324
Using Cisco Firepower's Security Intelligence policies, upon which two criteria is Firepower block based? (Choose two.)
- A. MAC addresses
- B. IP addresses
- C. URLs
- D. port numbers
- E. protocol IDs
Answer: B,C
Explanation:
NEW QUESTION # 325
Drag and drop the suspicious patterns for the Cisco Tetration platform from the left onto the correct definitions on the right.
Answer:
Explanation:
NEW QUESTION # 326
Refer to the exhibit.
What does the number 15 represent in this configuration?
- A. number of possible failed attempts until the SNMPv3 user is locked out
- B. interval in seconds between SNMPv3 authentication attempts
- C. privilege level for an authorized user to this router
- D. access list that identifies the SNMP devices that can access the router
Answer: D
Explanation:
The syntax of this command is shown below:
snmp-server group [group-name {v1 | v2c | v3 [auth | noauth | priv]}] [read read-view] [write write-view]
[notify notify-view] [access access-list]
The command above restricts which IP source addresses are allowed to access SNMP functions on the router.
You could restrict SNMP access by simply applying an interface ACL to block incoming SNMP packets that don't come from trusted servers. However, this would not be as effective as using the global SNMP commands shown in this recipe. Because you can apply this method once for the whole router, it is much simpler than applying ACLs to block SNMP on all interfaces separately. Also, using interface ACLs would block not only SNMP packets intended for this router, but also may stop SNMP packets that just happened to be passing through on their way to some other destination device.
Topic 4.1.2: Cisco Firepower NGIPS Device Management 2: What is Perfect Forward Secrecy? | Baeldung on Computer Science4 3: Perfect Forward Secrecy - an overview | ScienceDirect Topics5
NEW QUESTION # 327
Which statement about IOS zone-based firewalls is true?
- A. An interface can be assigned to multiple zones.
- B. An unassigned interface can communicate with assigned interfaces
- C. Only one interface can be assigned to a zone.
- D. An interface can be assigned only to one zone.
Answer: D
Explanation:
Explanation/Reference: https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/98628-zone-design-guide.html
NEW QUESTION # 328
Which two cryptographic algorithms are used with IPsec? {Choose two.)
- A. AES-ABC
- B. AES-CBC
- C. HMAC-SHA1/SHA2
- D. Triple AMC-CBC
- E. AES-BAC
Answer: B,C
Explanation:
Explanation
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/15-mt/sec-sec-for-vpns-w-ips
NEW QUESTION # 329
An organization has a Cisco ESA set up with policies and would like to customize the action assigned for violations. The organization wants a copy of the message to be delivered with a message added to flag it as a DLP violation. Which actions must be performed in order to provide this capability?
- A. deliver and send copies to other recipients
- B. quarantine and send a DLP violation notification
- C. deliver and add disclaimer text
- D. quarantine and alter the subject header with a DLP violation
Answer: C
Explanation:
You specify primary and secondary actions that the appliance will take when it detects a possible DLP violation in an outgoing message. Different actions can be assigned for different violation types and severities.
Primary actions include:
- Deliver
- Drop
- Quarantine
Secondary actions include:
- Sending a copy to a policy quarantine if you choose to deliver the message. The copy is a perfect clone of the original, including the Message ID. Quarantining a copy allows you to test the DLP system before deployment in addition to providing another way to monitor DLP violations. When you release the copy from the quarantine, the appliance delivers the copy to the recipient, who will have already received the original message.
- Encrypting messages. The appliance only encrypts the message body. It does not encrypt the message headers.
- Altering the subject header of messages containing a DLP violation.
- Adding disclaimer text to messages.
- Sending messages to an alternate destination mailhost.
- Sending copies (bcc) of messages to other recipients. (For example, you could copy messages with critical DLP violations to a compliance officer's mailbox for examination.)
- Sending a DLP violation notification message to the sender or other contacts, such as a manager or DLP compliance officer.
You specify primary and secondary actions that the appliance will take when it detects a possible DLP violation in an outgoing message. Different actions can be assigned for different violation types and severities.
Primary actions include:
- Deliver
- Drop
- Quarantine
Secondary actions include:
- Sending a copy to a policy quarantine if you choose to deliver the message. The copy is a perfect clone of the original, including the Message ID. Quarantining a copy allows you to test the DLP system before deployment in addition to providing another way to monitor DLP violations. When you release the copy from the quarantine, the appliance delivers the copy to the recipient, who will have already received the original message.
- Encrypting messages. The appliance only encrypts the message body. It does not encrypt the message headers.
- Altering the subject header of messages containing a DLP violation.
- Adding disclaimer text to messages.
- Sending messages to an alternate destination mailhost.
- Sending copies (bcc) of messages to other recipients. (For example, you could copy messages with critical DLP violations to a compliance officer's mailbox for examination.)
- Sending a DLP violation notification message to the sender or other contacts, such as a manager or DLP compliance officer.
You specify primary and secondary actions that the appliance will take when it detects a possible DLP violation in an outgoing message. Different actions can be assigned for different violation types and severities.
Primary actions include:
- Deliver
- Drop
- Quarantine
Secondary actions include:
- Sending a copy to a policy quarantine if you choose to deliver the message. The copy is a perfect clone of the original, including the Message ID. Quarantining a copy allows you to test the DLP system before deployment in addition to providing another way to monitor DLP violations. When you release the copy from the quarantine, the appliance delivers the copy to the recipient, who will have already received the original message.
- Encrypting messages. The appliance only encrypts the message body. It does not encrypt the message headers.
- Altering the subject header of messages containing a DLP violation.
- Adding disclaimer text to messages.
- Sending messages to an alternate destination mailhost.
- Sending copies (bcc) of messages to other recipients. (For example, you could copy messages with critical DLP violations to a compliance officer's mailbox for examination.)
- Sending a DLP violation notification message to the sender or other contacts, such as a manager or DLP compliance officer.
Reference:
b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_010001.html
b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_010001.html
NEW QUESTION # 330
Drag and drop the NetFlow export formats from the left onto the descriptions on the right.
Answer:
Explanation:
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/cfgnflow-data-ex
NEW QUESTION # 331
Which two application layer preprocessors are used by Firepower Next Generation Intrusion Prevention System? (Choose two.)
- A. modbus
- B. inline normalization
- C. packet decoder
- D. SIP
- E. SSL
Answer: D,E
NEW QUESTION # 332
Refer to the exhibit.
How does Cisco Umbrella manage traffic that is directed toward risky domains?
- A. Traffic is allowed but logged.
- B. Traffic is managed by the security settings and blocked.
- C. Traffic is proximed through the intelligent proxy.
- D. Traffic is managed by the application settings, unhandled and allowed.
Answer: C
Explanation:
Cisco Umbrella is a cloud-delivered and SaaS-based solution that provides DNS-layer security and web filtering for internet traffic. It blocks requests to malicious domains or IPs before a connection is even established, and logs and inspects all web traffic for greater transparency, control, and protection1.
However, not all domains or IPs are clearly malicious or benign. Some of them may be risky, meaning that they host both legitimate and malicious content, or that they have a low reputation score based on various factors. For these domains or IPs, Cisco Umbrella offers the option to proxy the traffic through the intelligent proxy, which is a selective web proxy that performs deeper inspection and analysis of the web content2.
The intelligent proxy can apply URL filtering, file inspection, and file type control to the proxied traffic, and block or allow it based on the policy settings. The intelligent proxy can also leverage Cisco Advanced Malware Protection (AMP) and antivirus engines to scan files for malware and threats3.
Therefore, by using the intelligent proxy, Cisco Umbrella can manage traffic that is directed toward risky domains more effectively, and provide an additional layer of security and visibility for the organization.
References :=
* Manage the Intelligent Proxy
* Manage File Inspection
* Cisco Umbrella At a Glance
NEW QUESTION # 333
Which solution is more secure than the traditional use of a username and password and encompasses at least two of the methods of authentication?
- A. RADIUS/LDAP authentication
- B. single-sign on
- C. multifactor authentication
- D. Kerberos security solution
Answer: C
Explanation:
Multifactor authentication (MFA) is a solution that requires the user to provide two or more verification factors to gain access to a resource, such as an application, online account, or a VPN. MFA is more secure than the traditional use of a username and password because it reduces the risk of identity theft, phishing, and credential compromise. MFA can use different types of factors, such as something the user knows (e.g., password, PIN), something the user has (e.g., smartphone, token, smart card), or something the user is (e.g., fingerprint, facial recognition). MFA can be implemented using various methods, such as security defaults, Conditional Access policies, or third-party solutions123. References:
https://support.microsoft.com/en-us/topic/what-is-multifactor-authentication-e5e39437-121c-be60-d123-eda06bd
https://www.onelogin.com/learn/what-is-mfa
NEW QUESTION # 334
Drag and drop the threats from the left onto examples of that threat on the right
Answer:
Explanation:
NEW QUESTION # 335
Which type of protection encrypts RSA keys when they are exported and imported?
- A. passphrase
- B. NGE
- C. file
- D. nonexportable
Answer: A
Explanation:
A passphrase is a type of protection that encrypts RSA keys when they are exported and imported. A passphrase is a sequence of characters that the user enters to decrypt the key. The passphrase acts as a symmetric key that is used to encrypt and decrypt the RSA key with a symmetric algorithm, such as AES. This way, the RSA key is protected from unauthorized access or tampering when it is transferred or stored. A passphrase can also provide additional security by adding entropy to the RSA key generation process. A file, NGE, and nonexportable are not types of protection that encrypt RSA keys when they are exported and imported. A file is a container that stores the RSA key, but does not encrypt it. NGE stands for Next Generation Encryption, which is a set of cryptographic standards and algorithms that Cisco recommends, but it is not a specific type of protection. Nonexportable is a property that prevents the RSA key from being exported at all, but it does not encrypt it. References: RSA/Schannel Key BLOBs, Common Encryption Types, Protocols and Algorithms Explained, Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0 (Module 5: Implementing Secure Communications with VPNs, Lesson 5.1: Implementing Site-to-Site VPNs, Topic 5.1.2: Implementing Site-to-Site VPNs with Pre-Shared Keys)
NEW QUESTION # 336
Which deployment model is the most secure when considering risks to cloud adoption?
- A. Private Cloud
- B. Community Cloud
- C. Hybrid Cloud
- D. Public Cloud
Answer: A
Explanation:
A private cloud is a cloud deployment model that is dedicated to a single organization and provides exclusive access to its resources and services. A private cloud can be hosted on-premises or off-premises by a third-party provider, but in either case, the organization has full control and visibility over the security, privacy, and compliance of its data and applications. A private cloud can also leverage the security features and best practices of the public cloud service provider, if applicable, while maintaining a higher degree of isolation and customization. A private cloud is the most secure deployment model when considering risks to cloud adoption, as it minimizes the exposure of sensitive data to external threats, reduces the dependency on the security posture of the cloud service provider, and enables the organization to meet its specific security and regulatory requirements123. References: 1: Best Practices to Manage Risks in the Cloud - ISACA 2: Security in the Microsoft Cloud Adoption Framework for Azure 3: Five challenges to cloud adoption and how to overcome them - PwC Middle East
NEW QUESTION # 337
Which component of Cisco umbrella architecture increases reliability of the service?
- A. AMP Threat grid
- B. Anycast IP
- C. Cisco Talos
- D. BGP route reflector
Answer: C
NEW QUESTION # 338
Which two aspects of the cloud PaaS model are managed by the customer but not the provider? (Choose two)
- A. applications
- B. middleware
- C. operating systems
- D. data
- E. virtualization
Answer: A,D
Explanation:
Explanation
Explanation
Customers must manage applications and data in PaaS.
NEW QUESTION # 339
......
Cisco 350-701 Exam Practice Test Questions: https://www.passsureexam.com/350-701-pass4sure-exam-dumps.html
Updated Certification Exam 350-701 Dumps - Practice Test Questions: https://drive.google.com/open?id=1t4Mxn3zntXY5815HcXi1_O5GQ9eXiPfl