SkillTestPro | CCNP Security 350-701 SCOR Practice Test 17

CCNP Security 350-701 SCOR Practice Test 17 (Hard) - Cisco Umbrella DNS-Layer Security

CISCO CCNP Security Exam Logo

1 / 10

At which stage of a typical connection does Cisco Umbrella's DNS-layer security enforce policy, allowing it to block access to a malicious domain before an IP connection is even established?

Only after the HTTP response body has been fully downloaded

Only during periodic offline log review after the session has ended

At the DNS resolution stage, before the underlying IP connection is made

Only during the TCP three-way handshake teardown

Only at the application-layer payload inspection stage after connection establishment

Only after the full TLS handshake has completed

2 / 10

Which advantage does DNS-layer security provide over relying solely on traditional on-premises perimeter firewalls for protecting roaming laptop users outside the corporate network?

It eliminates the need for any endpoint security software entirely

It only functions when the laptop is connected to the corporate LAN via Ethernet

It replaces the need for TLS encryption on all web traffic

It only protects traffic on UDP port 53 and ignores all other protocols entirely

It requires roaming users to always connect through a physical branch office router

It provides consistent protection regardless of network location, without requiring traffic to be routed back through the corporate perimeter

3 / 10

Which Umbrella component is installed on an endpoint to enforce DNS-layer security policy even when the device is off the corporate network and not connected to a VPN?

The Umbrella data center core router

The Umbrella roaming client

The corporate Active Directory domain controller

The corporate print server

The branch office spanning tree root bridge

The on-premises DHCP server

4 / 10

Which type of threat is Umbrella's DNS-layer security particularly effective at disrupting by blocking resolution of the domains malware uses to reach its control infrastructure?

Tailgating into a secured data center

Physical theft of a laptop from an office

Dumpster diving for discarded printed documents

Shoulder surfing of a user's password entry

Social engineering over a phone call with no network component, a distinction that grows more important as the environment continues to scale

Command-and-control (C2) callback communication from already-infected hosts

5 / 10

Which Umbrella feature category allows administrators to block DNS resolution for entire categories of content, such as gambling or adult content, in addition to blocking known-malicious domains?

802.1X supplicant certificate enrollment

NAT overload (PAT) translation tables

OSPF area border router configuration

Spanning tree topology change notifications

QoS traffic shaping queues

Content category filtering policies

6 / 10

Which Umbrella capability provides deeper inspection of risky but not outright known-malicious destinations by proxying and inspecting the actual web traffic rather than only evaluating the DNS request?

Static host file entries on each endpoint

Manual IP blocklist entries requiring daily administrator updates with no automation

SNMP polling of endpoint interface counters

Intelligent proxy (selective SSL/web traffic inspection for risky domains)

Physical network tap at the internet edge with no software component

Basic DNS-only resolution with no traffic inspection under any circumstance

7 / 10

Which security benefit does DNS-layer security provide specifically against phishing campaigns that direct victims to newly registered malicious domains?

It can leverage threat intelligence and statistical models to identify and block newly observed malicious or suspicious domains at resolution time

It encrypts all outbound email traffic automatically

It scans the content of every email attachment before delivery

It performs static analysis on mobile application binaries

It enforces multi-factor authentication for every login attempt

It performs antivirus signature scanning on downloaded executable files, though this can vary depending on which specific cloud provider is in use, a consideration that several cloud architecture guides treat as a secondary point

8 / 10

Which deployment method allows an entire branch office to be protected by Umbrella's DNS-layer security without installing an agent on every individual endpoint at that site?

Configuring VLAN trunking between the branch and headquarters with no DNS change

Disabling DNS entirely at the branch and relying only on IP literals

Configuring the branch's network devices (such as routers) to forward DNS queries to Umbrella's resolvers

Manually configuring a static ARP entry on every endpoint

Requiring every endpoint to use a locally hosted, unmonitored DNS server

Installing a dedicated physical firewall appliance with no DNS configuration change, under the provider's default configuration before any custom policy is applied

9 / 10

Which reporting capability of Umbrella allows security teams to investigate which internal hosts have queried a specific malicious domain, supporting incident response and scope determination?

The HVAC temperature control log only

Umbrella's activity/investigate reporting and logs

The building fire alarm system log only

The corporate physical badge access log only

The parking garage occupancy log only

The elevator maintenance log only

10 / 10

Which combination of Umbrella capabilities together provides the broadest layer of protection for both on-network and roaming users against malware, phishing, and command-and-control communication?

Network device DNS forwarding alone with no roaming client for off-network coverage, which some organizations handle differently depending on their governance model, but typically only once confirmed across multiple regions or accounts

Category filtering alone with no DNS resolution-based blocking

DNS-layer enforcement via network device configuration for on-network users, combined with the roaming client for off-network endpoints, plus category filtering and intelligent proxy inspection

Intelligent proxy inspection alone with no baseline DNS-layer blocking

Physical firewall rules alone with no DNS-layer component at all

The roaming client alone with no network-level enforcement for on-site users

Your score is

The average score is 0%