2026 Actual Cisco 350-701 Dumps, Updated Exam Questions for Guaranteed Pass

350-701 free sample questions and answers

Cisco 350-701 practice quiz with correct answers for search indexing.

1. Question 1

   [Endpoint Protection and Detection]

   An engineer must deploy a Cisco Secure Web Appliance. Antimalware scanning must use the Outbreak Heuristics antimalware category on files identified as malware before performing any other processes. What must be configured on the Secure Web Appliance to meet the requirements?

   ASophos scanning engine
   

   BWebroot scanning engine
   

   CMcAfee scanning engine
   

   DAdaptive Scanning
   

   Correct answer: D

   On Cisco Secure Web Appliance, to ensure Outbreak Heuristics runs first:

   • Outbreak Heuristics Antimalware Category:
     • Specialized detection for brand-new, zero-day malware exploits
     • Uses behavioral and heuristic analysis rather than signatures
     • Most resource-intensive scanning method
   • Configuration Requirement: Set Outbreak Heuristics as the highest-priority antimalware engine in the scanning order.
   • How to Configure:
     • Navigate to Antimalware scanning policies
     • Arrange scanning order/priority
     • Place Outbreak Heuristics before other engines (like signature-based scanning)
     • Enable the category and commit changes
   • Why This Order?
     • Outbreak Heuristics detects sophisticated threats other engines miss
     • By running first, it catches zero-days before standard signatures are available
     • Prevents missed detections from faster but less sensitive engines
     • Trade-off: higher latency but superior malware detection

2. Question 2

   [Endpoint Protection and Detection]

   Which Cisco platform onboards the endpoint and can issue a CA signed certificate while also automatically configuring endpoint network settings to use the signed endpoint certificate, allowing the endpoint to gain network access?

   ACisco ISE
   

   BCisco NAC
   

   CCisco TACACS+
   

   DCisco WSA
   

   Correct answer: A

   Cisco ISE is a platform that can onboard the endpoint and can issue a CA signed certificate while also automatically configuring endpoint network settings to use the signed endpoint certificate, allowing the endpoint to gain network access. Cisco ISE has an internal CA service that can validate and sign certificate requests from endpoints, generate and store keys and certificates, and provide an OCSP responder to check the validity of certificates. Cisco ISE also supports Enrollment over Secure Transport (EST), which is a protocol that allows endpoints to securely enroll with a CA and obtain certificates. Cisco ISE can use EST to provision certificates to endpoints and configure their network settings to use EAP-TLS authentication. Cisco ISE can also use BYOD workflows to onboard endpoints and issue certificates to them.Reference:

   Understand ISE Internal Certificate Authority Services

   Endpoint On-boarding using Internal ISE CA

   Cisco ISE BYOD Prescriptive Deployment Guide

   
   

3. Question 3

   [Endpoint Protection and Detection]

   A network administrator is configuring a switch to use Cisco ISE for 802.1X. An endpoint is failing

   authentication and is unable to access the network. Where should the administrator begin troubleshooting to verify the authentication details?

   AAdaptive Network Control Policy List
   

   BContext Visibility
   

   CAccounting Reports
   

   DRADIUS Live Logs
   

   Correct answer: D

   How To Troubleshoot ISE Failed Authentications & Authorizations

   Check the ISE Live Logs

   Login to the primary ISE Policy Administration Node (PAN).

   Go to Operations > RADIUS > Live Logs

   (Optional) If the event is not present in the RADIUS Live Logs, go to Operations > Reports > Reports >

   Endpoints and Users > RADIUS Authentications

   Check for Any Failed Authentication Attempts in the Log

   

   
   

4. Question 4

   [Network Security]

   What is a difference between GRE over IPsec and IPsec with crypto map?

   AMulticast traffic is supported by IPsec with crypto map.
   

   BGRE over IPsec supports non-IP protocols.
   

   CGRE provides its own encryption mechanism.
   

   DIPsec with crypto map oilers better scalability.
   

   Correct answer: B

   The difference between GRE over IPsec and IPsec with crypto map is that GRE (Generic Routing Encapsulation) over IPsec can encapsulate and transport non-IP protocols across an IP network, whereas IPsec with crypto map is typically used for IP traffic. GRE tunnels wrapped in IPsec provide a way to transport multicast traffic and other protocol types across an IPsec VPN, offering greater flexibility in the types of traffic that can be secured.

   
   

5. Question 5

   [Secure Network Access, Visibility, and Enforcement]

   Which command enables 802.1X globally on a Cisco switch?

   Adot1x system-auth-control
   

   Bdot1x pae authenticator
   

   Cauthentication port-control aut
   

   Daaa new-model
   

   Correct answer: A

   The dot1x system-auth-control command enables 802.1X globally on a Cisco switch. This command allows the switch to act as an authenticator for 802.1X clients connected to the switch ports. The switch will then communicate with a RADIUS server to authenticate the clients and grant or deny access to the network. The other commands are not related to enabling 802.1X globally. The dot1x pae authenticator command enables 802.1X authentication on a specific interface. The authentication port-control aut command enables automatic port-based authentication on an interface. The aaa new-model command enables the AAA framework for authentication, authorization, and accounting.Reference:=

   https://www.cisco.com/c/en/us/support/docs/smb/switches/cisco-small-business-300-series-managed-switches/smb5635-configure-global-802-1x-properties-on-a-switch-through-the-c.html

   https://www.cisco.com/c/en/us/td/docs/routers/nfvis/switch_command/b-nfvis-switch-command-reference/802_1x_commands.html