A university allows students to connect personal devices to the campus Wi-Fi. The security team wants to ensure that only devices with a compliant OS version and a functioning host firewall can access the network. They also want to block peer-to-peer file sharing. They have Cisco ISE and Cisco Firepower NGFW. Which combination of features should they use to meet both requirements with the least administrative overhead?

ISE only with posture assessment and an access control policy that blocks P2P

ISE posture assessment for compliance and Firepower application control for P2P blocking

Firepower only with SSL decryption and a file-type blocking rule

ISE for both posture and application control using its built-in application visibility

A company wants to allow employees to use web-based email but block the use of personal webmail services like Gmail and Yahoo Mail. They have a Cisco Firepower NGFW. Which application control rule should they implement?

Block the 'Gmail' and 'Yahoo Mail' applications by their IP addresses

Use SSL decryption to inspect all HTTPS traffic and block by URL category

Create a rule that allows the 'Webmail' application and blocks 'Gmail' and 'Yahoo Mail'

Block all traffic to port 443 and allow only corporate email server IPs

What is the primary purpose of device compliance in a network security architecture?

To provide encrypted remote access for users from any device

To monitor network traffic for malicious signatures in real time

To enforce that endpoints meet security requirements before being granted network access

To automatically patch all software vulnerabilities on endpoints

Which Cisco technology is primarily used to enforce device compliance through posture assessment and policy-based access control?

Cisco Identity Services Engine (ISE)

Cisco AnyConnect Secure Mobility Client

Cisco Next-Generation Firewall (NGFW)

A hospital network requires that only managed Windows 10 laptops with up-to-date antivirus definitions and a specific registry key present can access the guest Wi-Fi SSID. The network team has Cisco ISE deployed and wants to enforce this without requiring users to install any additional client software. Which ISE feature should they configure to meet this requirement?

MAC Authentication Bypass (MAB) with endpoint classification

RADIUS Change of Authorization (CoA) with dACL enforcement

Posture assessment with AnyConnect posture module

NAC agentless posture assessment via the ISE web portal

CiscoCertified Network Professional Security

Domain 6Objective 2

6.2 Describe Device Compliance and Application Control 350-701 Practice Questions (Page 3)

Part of the Network Access, Visibility, and Enforcement domain, which accounts for 15% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 15 practice questions to prepare you well beyond it. (estimate)

15questions here

3free pages

3concepts

15%of the exam

Questions 11–15

11expert · hard
A university allows students to connect personal devices to the campus Wi-Fi. The security team wants to ensure that only devices with a compliant OS version and a functioning host firewall can access the network. They also want to block peer-to-peer file sharing. They have Cisco ISE and Cisco Firepower NGFW. Which combination of features should they use to meet both requirements with the least administrative overhead?
Select an answer first
12application · medium
A company wants to allow employees to use web-based email but block the use of personal webmail services like Gmail and Yahoo Mail. They have a Cisco Firepower NGFW. Which application control rule should they implement?
Select an answer first
13foundation · easy
What is the primary purpose of device compliance in a network security architecture?
Select an answer first
14foundation · easy
Which Cisco technology is primarily used to enforce device compliance through posture assessment and policy-based access control?
Select an answer first
15application · medium
A hospital network requires that only managed Windows 10 laptops with up-to-date antivirus definitions and a specific registry key present can access the guest Wi-Fi SSID. The network team has Cisco ISE deployed and wants to enforce this without requiring users to install any additional client software. Which ISE feature should they configure to meet this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

6.2 Describe Device Compliance and Application Control 350-701 Practice Questions (Page 3)

Questions 11–15

A company wants to allow employees to use web-based email but block the use of personal webmail services like Gmail and Yahoo Mail. They have a Cisco Firepower NGFW. Which application control rule should they implement?

What is the primary purpose of device compliance in a network security architecture?

Which Cisco technology is primarily used to enforce device compliance through posture assessment and policy-based access control?

Keep studying — Network Access, Visibility, and Enforcement