A security engineer is hardening a Cisco FTD device. The engineer has applied the CIS Benchmark recommendations, including disabling the HTTP server and enabling SSH. However, the NOC reports that they can no longer manage the device from their management station. The engineer verifies that SSH is enabled and the management interface is reachable. What is the most likely cause of the issue?

The SSH access list is not configured to permit the NOC's management station

The HTTP server was disabled, which also disables SSH

The management interface is down

Which section of a CIS Benchmark document typically contains the specific configuration settings and commands to be applied?

The 'Revision History' section, which tracks changes to the benchmark

The 'Glossary' section, which defines technical terms used in the document

The 'Executive Summary' section, which provides a high-level overview of the benchmark

The 'Recommendations' section, which includes audit steps and remediation procedures

What is the primary purpose of CIS Benchmarks in the context of network device security?

To replace vendor-specific security documentation with a single universal configuration standard

To provide vendor-neutral, consensus-based configuration guidelines for securely hardening systems and devices

To certify that a device is completely immune to all known security threats

To automate the deployment of security patches and firmware updates across all network devices

When applying CIS Benchmark recommendations to a Cisco FTD device, which configuration step is commonly required to secure the management plane?

Configuring an access list to restrict management access to trusted hosts

Disabling all authentication to simplify access

Allowing management access from any source for flexibility

Enabling the HTTP server for management access

A security engineer is asked to justify the use of CIS Benchmarks for hardening a Cisco FTD appliance. Which statement best describes the scope of these benchmarks?

They are proprietary standards owned by Cisco and only available to Cisco customers

They are legally binding regulatory requirements that must be implemented exactly as written

They are vendor-neutral guidelines that can be applied to various technologies, including network devices, operating systems, and cloud services

They are specific to Cisco products and provide step-by-step commands for every Cisco platform

CiscoCertified Network Professional Security

Domain 2Objective 5

2.5 Describe CIS Benchmarks for Hardening Devices Such as Cisco Secure Firewall (FTD) and Cisco IOS XE 350-701 Practice Questions (Page 3)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

25%of the exam

Questions 11–15

11expert · hard
A security engineer is hardening a Cisco FTD device. The engineer has applied the CIS Benchmark recommendations, including disabling the HTTP server and enabling SSH. However, the NOC reports that they can no longer manage the device from their management station. The engineer verifies that SSH is enabled and the management interface is reachable. What is the most likely cause of the issue?
Select an answer first
12foundation · easy
Which section of a CIS Benchmark document typically contains the specific configuration settings and commands to be applied?
Select an answer first
13foundation · easy
What is the primary purpose of CIS Benchmarks in the context of network device security?
Select an answer first
14foundation · easy
When applying CIS Benchmark recommendations to a Cisco FTD device, which configuration step is commonly required to secure the management plane?
Select an answer first
15foundation · easy
A security engineer is asked to justify the use of CIS Benchmarks for hardening a Cisco FTD appliance. Which statement best describes the scope of these benchmarks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.