An attacker calls the IT help desk, claims to be a new employee, and says they need their password reset immediately because they are locked out. The help desk agent resets the password and provides it over the phone. Which social engineering technique is this, and what control would be most effective?

Pretexting; require identity verification through a manager-approved callback

Phishing; enforce MFA for all remote access

Quid pro quo; deploy an email filter to block phishing emails

Baiting; implement a web filter to block malicious downloads

Which of the following is a key component of an effective security awareness training program?

Teaching employees how to identify phishing indicators

Requiring employees to change passwords daily

Disabling all email filters to test users

Providing employees with administrative access to all systems

A company is considering a new email security solution. They have a high volume of legitimate email from external partners, and they want to minimize false positives. They also have a strict compliance requirement to archive all email. Which approach would best balance security and usability?

Use a simple allowlist of approved senders and reject all others

Block all email from external domains and require partners to use a secure portal

Implement a sandboxing solution that detonates all attachments and blocks any that are suspicious

Deploy an email gateway with spam filtering and URL reputation, and use a quarantine that allows users to release messages

CiscoCertified Network Professional Security

Domain 1Objective 4

1.4 Describe the Controls Used to Protect Against Phishing and Social Engineering Attacks 350-701 Practice Questions (Page 5)

Part of the Security Concepts domain, which accounts for 20% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

20%of the exam

Questions 21–25

21foundation · easy
Which technical control is specifically designed to block access to known malicious websites that host phishing pages?
Select an answer first
22application · medium
An attacker calls the IT help desk, claims to be a new employee, and says they need their password reset immediately because they are locked out. The help desk agent resets the password and provides it over the phone. Which social engineering technique is this, and what control would be most effective?
Select an answer first
23foundation · easy
Which of the following is a key component of an effective security awareness training program?
Select an answer first
24foundation · easy
A phishing email is sent to the CEO of a company, impersonating a legal authority and demanding urgent action. Which type of phishing attack is this?
Select an answer first
25expert · hard
A company is considering a new email security solution. They have a high volume of legitimate email from external partners, and they want to minimize false positives. They also have a strict compliance requirement to archive all email. Which approach would best balance security and usability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

1.4 Describe the Controls Used to Protect Against Phishing and Social Engineering Attacks 350-701 Practice Questions (Page 5)

Questions 21–25

Which technical control is specifically designed to block access to known malicious websites that host phishing pages?

Which of the following is a key component of an effective security awareness training program?

A phishing email is sent to the CEO of a company, impersonating a legal authority and demanding urgent action. Which type of phishing attack is this?

A company is considering a new email security solution. They have a high volume of legitimate email from external partners, and they want to minimize false positives. They also have a strict compliance requirement to archive all email. Which approach would best balance security and usability?

Keep studying — Security Concepts