A company has a Cisco Firepower NGFW and wants to block a custom internal application that uses a non-standard port and is not in the default Application Detector list. The application is critical and must not be blocked for the IT department. What is the most efficient way to achieve this?

Create a custom Application Detector for the application and use it in an access control rule

Block the non-standard port for all users

Use QoS to prioritize IT traffic and deprioritize others

Use SSL decryption to inspect the traffic and block by URL

A company has a mixed environment with both corporate-managed Windows laptops and employee-owned personal devices. They want to enforce a strict compliance policy (mandatory antivirus and OS patches) on corporate devices, but only require a basic check (device not jailbroken/rooted) on personal devices. They use Cisco ISE. How should they configure this?

Create a single posture policy with the strictest requirements for all devices

Use ISE profiling to differentiate device types and apply different posture policies

Use AnyConnect on all devices to enforce the same posture policy

Use MAB to allow all devices and rely on the NGFW for compliance

A company wants to ensure that only devices with a compliant OS and a functioning host firewall can access the network. They have Cisco ISE and want to enforce this for both wired and wireless connections. Which feature should they use?

MAC Authentication Bypass (MAB)

Posture assessment with AnyConnect

What is the primary purpose of application control in a network security context?

To identify, monitor, and control the use of applications on the network

To prioritize bandwidth for business-critical applications only

To block all traffic that does not use standard ports

To encrypt all application traffic between clients and servers

CiscoCertified Network Professional Security

Domain 6Objective 2

6.2 Describe Device Compliance and Application Control 350-701 Practice Questions (Page 2)

Part of the Network Access, Visibility, and Enforcement domain, which accounts for 15% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 15 practice questions to prepare you well beyond it. (estimate)

15questions here

3free pages

3concepts

15%of the exam

Questions 6–10

6foundation · easy
Which mechanism is used by device compliance to evaluate an endpoint's security state before granting network access?
Select an answer first
7expert · hard
A company has a Cisco Firepower NGFW and wants to block a custom internal application that uses a non-standard port and is not in the default Application Detector list. The application is critical and must not be blocked for the IT department. What is the most efficient way to achieve this?
Select an answer first
8expert · hard
A company has a mixed environment with both corporate-managed Windows laptops and employee-owned personal devices. They want to enforce a strict compliance policy (mandatory antivirus and OS patches) on corporate devices, but only require a basic check (device not jailbroken/rooted) on personal devices. They use Cisco ISE. How should they configure this?
Select an answer first
9application · medium
A company wants to ensure that only devices with a compliant OS and a functioning host firewall can access the network. They have Cisco ISE and want to enforce this for both wired and wireless connections. Which feature should they use?
Select an answer first
10foundation · easy
What is the primary purpose of application control in a network security context?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

6.2 Describe Device Compliance and Application Control 350-701 Practice Questions (Page 2)

Questions 6–10

Which mechanism is used by device compliance to evaluate an endpoint's security state before granting network access?

A company has a Cisco Firepower NGFW and wants to block a custom internal application that uses a non-standard port and is not in the default Application Detector list. The application is critical and must not be blocked for the IT department. What is the most efficient way to achieve this?

A company wants to ensure that only devices with a compliant OS and a functioning host firewall can access the network. They have Cisco ISE and want to enforce this for both wired and wireless connections. Which feature should they use?

What is the primary purpose of application control in a network security context?

Keep studying — Network Access, Visibility, and Enforcement