A hospital network uses an NGFW at the internet edge. The security team wants to block a specific malware family that uses TLS-encrypted HTTP/2 traffic to a known command-and-control domain. The NGFW currently performs stateful inspection and URL filtering but does not inspect encrypted traffic. Which capability must be enabled on the NGFW to meet this requirement?

Configure a URL filter rule to block the domain category

Enable SSL/TLS inspection and configure a security policy to block the domain and application signature

Deploy a separate passive IDS sensor on the same segment

Enable the intrusion prevention system (IPS) signature for the malware family

A manufacturing company has a flat network with no segmentation. They have deployed an intrusion detection system (IDS) in promiscuous mode on the core switch. The security team notices that the IDS detects attacks but the attacks still succeed. What is the most likely reason for this?

The IDS is not receiving traffic because it is connected to the wrong SPAN port.

The IDS signature database is outdated and misses some attacks.

The IDS is passive and cannot block traffic; it only generates alerts.

The IDS is configured in inline mode but without a fail-open configuration.

A company's endpoints are infected with ransomware that encrypts files and then attempts to spread to other hosts. The security team wants to detect and respond to this behavior quickly, including isolating affected hosts. Which endpoint security technology should be prioritized in the design?

Endpoint detection and response (EDR) with automated isolation capabilities

Host intrusion prevention system (HIPS) with application control

Network-based IPS at the internet edge

Traditional antivirus with signature-based scanning

What is the concept of defense-in-depth in network security design?

Using a single, very strong security control to protect the entire network

Placing all security devices at the network perimeter

Ensuring that all security devices are from the same vendor

Layering multiple security controls so that if one fails, others still provide protection

A company is deploying an NGFW with SSL/TLS inspection. The security team is concerned about breaking access to banking and healthcare websites that use certificate pinning. Which policy approach best balances security and usability?

Create an SSL/TLS inspection bypass list for domains that use certificate pinning, while inspecting all other traffic

Disable SSL/TLS inspection entirely

Inspect all traffic and block any site that fails certificate validation

Use a proxy that re-signs certificates for all sites

CiscoCertified Network Professional Enterprise

Domain 5Objective 4

5.4 Describe the Components of Network Security Design 350-401 Practice Questions (Page 10)

Part of the 5.0 Security domain, which accounts for 20% of the 350-401 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

13concepts

20%of the exam

Questions 46–50

46application · medium
A hospital network uses an NGFW at the internet edge. The security team wants to block a specific malware family that uses TLS-encrypted HTTP/2 traffic to a known command-and-control domain. The NGFW currently performs stateful inspection and URL filtering but does not inspect encrypted traffic. Which capability must be enabled on the NGFW to meet this requirement?
Select an answer first
47application · medium
A manufacturing company has a flat network with no segmentation. They have deployed an intrusion detection system (IDS) in promiscuous mode on the core switch. The security team notices that the IDS detects attacks but the attacks still succeed. What is the most likely reason for this?
Select an answer first
48application · medium
A company's endpoints are infected with ransomware that encrypts files and then attempts to spread to other hosts. The security team wants to detect and respond to this behavior quickly, including isolating affected hosts. Which endpoint security technology should be prioritized in the design?
Select an answer first
49foundation · easy
What is the concept of defense-in-depth in network security design?
Select an answer first
50expert · hard
A company is deploying an NGFW with SSL/TLS inspection. The security team is concerned about breaking access to banking and healthcare websites that use certificate pinning. Which policy approach best balances security and usability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-401” is a trademark of its owner, used for identification only.