A university is replacing its legacy stateful firewall with a next-generation firewall (NGFW). The security team wants to enforce policies that allow or block traffic based on the user's identity and the specific application being used, rather than only IP addresses and ports. Which feature of the NGFW should they configure to achieve this?

Application visibility and control with user identity integration

Intrusion prevention system (IPS) signatures

Virtual private network (VPN) termination

Stateful packet inspection with access control lists

A hospital is deploying a firewall to protect its internal network. The firewall must be able to identify and control traffic based on the specific application (e.g., WebEx, Skype) even if the traffic uses non-standard ports. Which firewall technology provides this capability?

Next-generation firewall (NGFW)

A company is deploying an IPS to protect its internal servers. The security team wants the IPS to automatically block malicious traffic based on signatures, but they also want to receive alerts when a new attack pattern is detected that has no signature yet. Which IPS feature should they enable?

Both signature-based and anomaly-based detection

Anomaly-based detection with alerting

Threat intelligence feed integration

Signature-based detection with auto-block

A company wants to enforce security policies based on the user's role in the organization. For example, only HR employees should access the HR portal. Which firewall capability should they use?

Identity-based firewall policies integrated with Active Directory

Stateful inspection with port-based rules

A company's IPS is generating a high number of false positives, overwhelming the security team. They want to reduce false positives while still detecting real threats. Which action should they take?

Disable all IPS signatures that generate alerts

Increase the sensitivity of all signatures

Integrate the IPS with a SIEM to correlate alerts

Tune IPS signatures and policies based on the network's normal traffic patterns

CiscoCertified Network Professional Security

Domain 2Objective 1

2.1 Describe Network Security Solutions and Deployment Models That Provide Intrusion Prevention and Firewall Capabilities 350-701 Practice Questions (Page 5)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

5concepts

25%of the exam

Questions 21–25

21application · medium
A university is replacing its legacy stateful firewall with a next-generation firewall (NGFW). The security team wants to enforce policies that allow or block traffic based on the user's identity and the specific application being used, rather than only IP addresses and ports. Which feature of the NGFW should they configure to achieve this?
Select an answer first
22application · medium
A hospital is deploying a firewall to protect its internal network. The firewall must be able to identify and control traffic based on the specific application (e.g., WebEx, Skype) even if the traffic uses non-standard ports. Which firewall technology provides this capability?
Select an answer first
23application · medium
A company is deploying an IPS to protect its internal servers. The security team wants the IPS to automatically block malicious traffic based on signatures, but they also want to receive alerts when a new attack pattern is detected that has no signature yet. Which IPS feature should they enable?
Select an answer first
24application · medium
A company wants to enforce security policies based on the user's role in the organization. For example, only HR employees should access the HR portal. Which firewall capability should they use?
Select an answer first
25application · medium
A company's IPS is generating a high number of false positives, overwhelming the security team. They want to reduce false positives while still detecting real threats. Which action should they take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.