Courseiva

Cisco SCOR / CCNP Security Core 350-701 (350-701) — Questions 1–75

978 questions total · 14pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 14

Page 2
1
Multi-Selecthard

Which THREE of the following are valid considerations when deploying Cisco Advanced Malware Protection (AMP) for Networks on a Firepower system? (Choose three.)

Select 3 answers
A.AMP for Networks should be deployed in inline mode behind the firewall.
B.An AMP subscription must be active on the Firepower Management Center.
C.File inspection must be enabled in the access control policy.
D.The Firepower device must have outbound internet connectivity to the AMP cloud.
E.A dedicated bridge group must be created on the Firepower device.
AnswersB, C, D

Cloud-based file analysis requires a valid license.

Why this answer

An active AMP subscription on the Firepower Management Center (FMC) is required to enable the AMP for Networks feature. Without a valid subscription license tied to the FMC, the system cannot authenticate with the AMP cloud or enforce file-based threat policies.

Exam trap

Cisco often tests the misconception that AMP for Networks requires inline mode or a specific interface configuration like a bridge group, when in fact it works in multiple deployment modes and only requires a valid subscription, file inspection enabled, and outbound cloud connectivity.

Full explanation →
2
MCQhard

A security analyst discovers that an endpoint was infected by a file that initially received a 'clean' disposition from Cisco AMP. The analyst needs to identify all other endpoints that executed the same file and examine their trajectory. Which approach should be used to find these endpoints in the AMP console?

A.Search for the file's SHA-256 hash in the AMP console to see all endpoints with that file
B.Check the Device Trajectory of the infected endpoint and manually correlate with other endpoints
C.Use the IOC scanning feature to scan all endpoints for the file's signature
D.Run a retrospective security scan on all endpoints using the file's SHA-256 hash
AnswerA

Searching by SHA-256 provides a list of all endpoints that have encountered the file, enabling trajectory analysis.

Why this answer

Cisco AMP maintains a global file disposition database that maps SHA-256 hashes to all endpoints that have ever executed or stored that file. By searching for the file's SHA-256 hash in the AMP console, the analyst can instantly retrieve a list of all endpoints with that file, including those that received a 'clean' disposition before the file was later classified as malicious. This leverages AMP's cloud-based telemetry and file reputation system, enabling rapid identification of all affected systems without requiring additional scans or manual correlation.

Exam trap

Cisco often tests the distinction between searching for a file's SHA-256 hash (which directly lists all endpoints with that file) and using retrospective scans or IOC scanning, which serve different purposes and do not provide a simple list of affected endpoints.

How to eliminate wrong answers

Option B is wrong because manually checking the Device Trajectory of the infected endpoint and correlating with other endpoints is inefficient and error-prone; Device Trajectory shows events for a single endpoint, not a cross-endpoint view, and the analyst would need to manually check each endpoint's trajectory, which is impractical in a large environment. Option C is wrong because the IOC scanning feature scans for indicators of compromise (e.g., IP addresses, domains, registry keys) based on predefined rules, not for a specific file's SHA-256 hash; it is designed for threat hunting using IOCs, not for locating all endpoints that executed a particular file. Option D is wrong because retrospective security scans in AMP are used to re-evaluate files that were previously seen and may have changed disposition, but they do not directly list all endpoints that executed the file; instead, they apply updated analysis to files already in the AMP cloud, and the results are typically viewed via the file's analysis page, not by scanning all endpoints with the hash.

Full explanation →
3
MCQeasy

Which Cisco TrustSec feature uses a classification packet to carry security group information across network devices?

A.Security Group Tag (SGT)
B.Security Group Access Control List (SGACL)
C.MACsec
D.Cisco TrustSec (CTS)
AnswerA

SGTs are inserted into packets to carry group information.

Why this answer

The Security Group Tag (SGT) is the Cisco TrustSec mechanism that embeds security group information directly into a packet's Ethernet frame (typically as a Cisco Meta Data or inline tag). This allows the packet to carry its source group identity across network devices, enabling consistent policy enforcement without requiring per-hop reclassification.

Exam trap

Cisco often tests the distinction between the tag that carries the group information (SGT) and the policy that enforces rules based on that tag (SGACL), so candidates mistakenly choose SGACL because they associate it with security group enforcement.

How to eliminate wrong answers

Option B is wrong because a Security Group Access Control List (SGACL) is a policy rule that defines permitted or denied actions based on SGTs, not a classification packet that carries group information. Option C is wrong because MACsec (802.1AE) provides link-layer encryption and integrity, not a mechanism to carry security group tags across devices. Option D is wrong because Cisco TrustSec (CTS) is the overarching architecture that includes SGT, SGACL, and other components; it is not a specific classification packet that carries group information.

Full explanation →
4
Multi-Selectmedium

A network engineer is implementing Cisco TrustSec in an enterprise network. Which two components are required for TrustSec to function correctly? (Choose two.)

Select 2 answers
A.ISE
B.AAA server
C.Firepower
D.SXP
E.SGACL
AnswersA, D

ISE is the policy server that defines TrustSec policies and distributes SGTs.

Why this answer

Cisco TrustSec uses the Identity Services Engine (ISE) as the centralized policy server to define and enforce security group tags (SGTs) and access policies. ISE is the mandatory policy decision point that assigns SGTs to endpoints and distributes them to network devices via SXP or inline tagging. Without ISE, there is no mechanism to create, manage, or propagate the SGT-based policies that TrustSec relies on.

Exam trap

Cisco often tests the distinction between required components (ISE and SXP) and optional or derivative elements (AAA server, Firepower, SGACLs) to catch candidates who confuse the policy enforcement mechanism with the foundational infrastructure.

Full explanation →
5
Multi-Selectmedium

A company is deploying Cisco Secure Endpoint and wants to ensure that endpoints are protected against zero-day exploits. Which two features should be enabled to provide this protection? (Choose two.)

Select 2 answers
A.File Reputation
B.Exploit Prevention
C.Malware Analytics (sandboxing)
D.Application Control
E.Device Control
AnswersB, C

Exploit Prevention protects against exploit techniques used by zero-day attacks.

Why this answer

Exploit Prevention (B) is correct because it uses exploit-specific signatures and behavioral monitoring to block common exploitation techniques (e.g., heap spray, ROP, SEH overwrite) without relying on known malware signatures, making it effective against zero-day exploits. Malware Analytics (C) is correct because it detonates suspicious files in a sandboxed environment to analyze behavior and detect previously unknown threats, providing protection against zero-day malware before signatures are available.

Exam trap

Cisco often tests the distinction between signature-based detection (File Reputation) and behavior-based detection (Exploit Prevention and Malware Analytics), leading candidates to mistakenly choose File Reputation because they assume it covers all unknown threats.

Full explanation →
6
MCQmedium

A security analyst notices that a file that was initially allowed by Cisco AMP for Endpoints has later been determined to be malicious. The analyst needs to investigate the file's propagation across endpoints. Which Cisco AMP feature should the analyst use to view the timeline of events?

A.Exploit Prevention
B.Endpoint IOC scanning
C.SHA-256 file disposition
D.Device Trajectory
AnswerD

Device Trajectory provides a timeline of file activity and propagation across endpoints.

Why this answer

Device Trajectory in Cisco AMP provides a chronological view of events on an endpoint, showing how a file propagated and what actions were taken. Continuous monitoring and retrospective security allow AMP to re-evaluate files that were initially allowed but later deemed malicious.

Full explanation →
7
MCQmedium

A company uses Cisco Firepower Threat Defense (FTD) managed by FMC. They need to create an access control policy that allows traffic from specific source IPs to a web server, but blocks all other traffic. How should the rule base be ordered?

A.Place the block rule first, then the permit rule.
B.Place the permit rule first, then the block rule.
C.Use a single rule with permit and block conditions combined.
D.Order does not matter because FMC processes rules in parallel.
AnswerB

The permit rule matches first for allowed sources; the block rule catches all others.

Why this answer

Access control rules are evaluated in order from top to bottom. The first matching rule is applied. Therefore, the permit rule for the specific source IPs must come before the final block rule.

Full explanation →
8
Multi-Selectmedium

An organization is adopting a zero trust model for cloud access. Which three principles should be implemented? (Select three.)

Select 3 answers
A.Deploy a VPN for all remote users
B.Grant permanent privileged access to administrators
C.Use conditional access policies based on user, device, and location
D.Implement MFA for all cloud access
E.Treat identity as the new perimeter
AnswersC, D, E

Conditional access enforces context-based policies.

Why this answer

Zero trust includes identity as the perimeter, MFA, and conditional access based on context.

Full explanation →
9
MCQeasy

Refer to the exhibit. The tunnel is established but no traffic is encrypted. What is the most likely issue?

A.The transform set uses wrong encryption
B.The crypto map is not applied to the external interface
C.The access-list is too permissive
D.The peer address is wrong
AnswerB

The crypto map must be attached to an interface to enable encryption.

Why this answer

The most likely issue is that the crypto map is not applied to the external interface. In IPsec VPN configuration, the crypto map must be applied to the interface that sends and receives encrypted traffic (typically the outside/public-facing interface). Without this application, the router does not know which traffic to protect or how to negotiate the IPsec tunnel, even if the tunnel is established (e.g., IKE Phase 1 completes).

The tunnel may show as up due to successful ISAKMP negotiation, but no traffic will be encrypted because the crypto map's policy (including the access-list and transform set) is never enforced on the interface.

Exam trap

Cisco often tests the distinction between tunnel establishment (IKE Phase 1) and traffic encryption (IPsec Phase 2 + crypto map application), trapping candidates who assume a tunnel being 'up' means all components are correctly applied.

How to eliminate wrong answers

Option A is wrong because if the transform set used the wrong encryption algorithm (e.g., AES instead of 3DES), the tunnel would fail to establish entirely during IPsec Phase 2 negotiation due to mismatched proposals; the question states the tunnel is established, so the transform set is compatible. Option C is wrong because an overly permissive access-list (e.g., permitting all IP traffic) would actually cause more traffic to be encrypted, not less; the issue is that no traffic is encrypted, which points to the crypto map not being applied, not the ACL being too broad. Option D is wrong because if the peer address were incorrect, the router would be unable to reach the remote peer for IKE negotiation, and the tunnel would not be established at all; since the tunnel is up, the peer address is correctly configured.

Full explanation →
10
Multi-Selecthard

A company is deploying Cisco ISE for network access control. Which three policies must be configured to enforce access based on device posture? (Choose three)

Select 3 answers
A.Authorization policy
B.Posture policy
C.Guest access policy
D.Authentication policy
E.Profiling policy
AnswersA, B, D

Defines access based on posture results.

Why this answer

Authorization policy (A) is correct because it defines the final access permissions (e.g., permit, deny, VLAN assignment, ACL) based on the posture assessment results. After the endpoint's posture is evaluated, the authorization policy uses conditions like 'PostureStatus: Compliant' or 'PostureStatus: NonCompliant' to enforce network access control. Without an authorization policy, the posture check result would have no effect on actual network access.

Exam trap

Cisco often tests the misconception that Profiling policy (E) is involved in posture enforcement, but profiling only identifies the device type and does not evaluate security compliance or trigger remediation.

Full explanation →
11
MCQmedium

A DevOps team is integrating security into their CI/CD pipeline. They want to automatically scan Terraform scripts for misconfigurations before deployment. Which tool is specifically designed for this purpose?

A.SAST (Static Application Security Testing)
B.Container image scanner
C.DAST (Dynamic Application Security Testing)
D.Cisco Cloud Security Posture Management (Cisco CSPM)
AnswerD

Cisco Cloud Security Posture Management (Cisco CSPM) is a tool specifically designed to scan Infrastructure as Code (IaC) files, including Terraform, for misconfigurations before deployment.

Why this answer

Cisco Cloud Security Posture Management (Cisco CSPM) is a Cisco tool designed for static analysis of Infrastructure as Code (IaC) files, including Terraform, to detect misconfigurations. SAST and DAST analyze application code, not IaC. Container image scanning tools focus on container vulnerabilities, not IaC templates.

Full explanation →
12
MCQmedium

A multinational corporation is implementing ISE for wired network access using 802.1X with EAP-TLS certificate authentication. Their Windows 10 laptops have certificates issued by an internal PKI. During testing, some users report that they are repeatedly prompted to select a certificate after connecting, and eventually authentication fails. ISE logs show 'Authentication failed - No matching certificate found'. The engineer checks the client machine and sees multiple certificates, including the correct one, in the personal store. The ISE endpoint identity store is populated with the user's AD credentials. What is the most likely cause of this failure?

A.The client's certificate is expired
B.The Windows supplicant requires a registry modification to enable auto-selection
C.ISE trusted CA certificate list does not include the issuing CA
D.The client certificates lack the 'Client Authentication' extended key usage (EKU)
AnswerD

EAP-TLS requires a certificate with Client Authentication EKU; if missing, ISE will not accept it.

Why this answer

EAP-TLS requires the client to present a certificate that ISE can validate. If the client has multiple certificates and ISE receives one that does not contain the 'Client Authentication' extended key usage (EKU), ISE will reject it, logging 'No matching certificate found'. The correct answer is D because the client certificates must have the EKU for client authentication; otherwise, even if the certificates are trusted and valid, ISE will not accept them for 802.1X.

Option A (expired certificate) would cause a different error. Option B (registry modification) is not standard for Windows 10 supplicant. Option C (missing trusted CA) would cause ISE to not trust any client certificate, affecting all users, not just some.

Full explanation →
13
MCQmedium

A cloud security architect is designing a zero-trust architecture for an enterprise using AWS and Azure. They need to enforce micro-segmentation between application tiers. Which Cisco solution is most appropriate?

A.Cisco Umbrella SIG
B.Cisco Secure Firewall
C.Cisco Secure Workload
D.Cisco Secure Cloud Analytics
AnswerC

Designed for micro-segmentation in zero-trust.

Why this answer

Cisco Secure Workload (formerly Tetration) is the correct solution because it provides agent-based and agentless workload visibility, policy recommendation, and enforcement of micro-segmentation at the application tier level. It uses a combination of NetFlow, IPFIX, and host-based sensors to map inter-tier traffic flows and generate whitelist-based policies that are enforced via host firewall rules or network ACLs, directly addressing the zero-trust requirement to restrict lateral movement between application tiers in multi-cloud environments like AWS and Azure.

Exam trap

Cisco often tests the distinction between visibility-only tools (like Secure Cloud Analytics) and enforcement-capable tools (like Secure Workload), so the trap here is assuming that any security analytics or firewall product can perform micro-segmentation, when in fact only Secure Workload provides the necessary workload-centric policy automation and enforcement for zero-trust micro-segmentation in multi-cloud environments.

How to eliminate wrong answers

Option A is wrong because Cisco Umbrella SIG is a cloud-delivered secure internet gateway (SIG) that provides DNS-layer security, web filtering, and cloud access security broker (CASB) capabilities; it does not enforce micro-segmentation between application tiers as it operates at the internet edge, not within VPCs or virtual networks. Option B is wrong because Cisco Secure Firewall (including Firepower NGFW) is a network firewall that can segment traffic at the network perimeter or between zones, but it lacks the granular workload-level visibility and automated policy recommendation required for true micro-segmentation between individual application tiers in a dynamic cloud environment; it is typically deployed as a gateway or transit firewall, not as a host-based micro-segmentation solution. Option D is wrong because Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) is a network traffic analytics and threat detection tool that uses machine learning to identify anomalies and threats, but it does not enforce micro-segmentation policies; it provides visibility and alerts but cannot block or allow traffic between application tiers.

Full explanation →
14
MCQhard

A company is connecting multiple VPCs in AWS to a shared services VPC using AWS Transit Gateway. They want to inspect east-west traffic between VPCs with a common security policy. Which design best achieves this using Cisco solutions?

A.Deploy a Cisco Firepower instance in each VPC
B.Use VPC peering with no inspection
C.Direct Connect to on-premises Cisco ASA
D.Use AWS Transit Gateway with a centralized Cisco Firepower instance for inspection
AnswerD

Centralized inspection simplifies policy management.

Why this answer

AWS Transit Gateway allows you to route traffic between multiple VPCs through a centralized inspection VPC, where a Cisco Firepower instance can apply a consistent security policy to all east-west traffic. This design avoids deploying separate firewalls in each VPC and ensures that traffic between any two VPCs is inspected by a single, centrally managed policy engine.

Exam trap

Cisco often tests the misconception that deploying a firewall in each VPC (Option A) is the only way to inspect east-west traffic, but the trap here is that a centralized inspection model using Transit Gateway is more scalable and policy-consistent, and candidates may overlook the routing configuration required to force traffic through the inspection VPC.

How to eliminate wrong answers

Option A is wrong because deploying a Cisco Firepower instance in each VPC creates a distributed, per-VPC security model that is difficult to manage and does not enforce a common security policy across all east-west traffic; each VPC would require its own policy configuration and traffic would not be centrally inspected. Option B is wrong because VPC peering with no inspection provides direct connectivity between VPCs without any security appliance, meaning east-west traffic flows unmonitored and violates the requirement to inspect traffic with a common security policy. Option C is wrong because Direct Connect to an on-premises Cisco ASA forces all east-west traffic to hairpin through the on-premises network, which introduces unnecessary latency, bandwidth costs, and dependency on the on-premises link, and is not designed for native AWS VPC-to-VPC traffic inspection.

Full explanation →
15
MCQmedium

An incident responder uses the Cisco AMP for Endpoints console to investigate a potential malware outbreak. The endpoint shows multiple files with high prevalence and cloud verdicts of 'unknown'. The responder wants to quickly identify files that were executed from a malicious parent process. Which console feature best assists this analysis?

A.Device Trajectory to review the event timeline.
B.Group Policy to check applied policies.
C.Dashboard to view overall threat scores.
D.File Search to find files with unknown verdict.
AnswerA

Device Trajectory shows process execution details and parent-child relationships.

Why this answer

Device Trajectory provides a chronological timeline of events on the endpoint, allowing the responder to trace file executions back to their parent processes. By reviewing the trajectory, the responder can identify which files with unknown verdicts were spawned by a known malicious parent process, directly answering the investigation need.

Exam trap

Cisco often tests the distinction between visibility features (Device Trajectory) and search or policy tools (File Search, Group Policy), trapping candidates who confuse file attribute lookup with process lineage analysis.

How to eliminate wrong answers

Option B is wrong because Group Policy is a configuration management tool for applying security policies, not a forensic analysis feature for reviewing process execution chains. Option C is wrong because the Dashboard provides aggregate threat scores and high-level visibility, not the granular, per-file parent-child process relationship needed here. Option D is wrong because File Search only locates files by attributes like hash or name, but does not show the execution context or parent process lineage required to identify malicious parent-child relationships.

Full explanation →
16
MCQmedium

An administrator configures Cisco ISE for guest access with a sponsor portal. What is the primary purpose of the sponsor portal?

A.Provide network access for non-supplicant devices
B.Enable guests to authenticate with MFA
C.Allow sponsors to create and manage guest accounts
D.Allow guests to self-register
AnswerC

The sponsor portal provides a web interface for sponsors to create, approve, or manage guest accounts.

Why this answer

The sponsor portal in Cisco ISE is specifically designed to allow authorized users (sponsors) to create, manage, and approve guest accounts. This enables controlled guest access where a sponsor, such as an employee or administrator, provisions credentials for visitors, ensuring accountability and policy enforcement without requiring guests to self-register.

Exam trap

Cisco often tests the distinction between the sponsor portal and the guest self-registration portal, trapping candidates who confuse the two because both involve guest access but serve different roles—sponsor-managed vs. user-initiated.

How to eliminate wrong answers

Option A is wrong because non-supplicant device access is typically handled via MAC Authentication Bypass (MAB) or device registration, not the sponsor portal. Option B is wrong because guest authentication with MFA is a feature of the guest portal or authentication policy, not the sponsor portal's purpose. Option D is wrong because guest self-registration is a separate portal (the guest portal), whereas the sponsor portal is for sponsor-managed account creation.

Full explanation →
17
MCQeasy

A company wants to prevent users from downloading executable files (.exe) from the internet via the WSA. Which policy type should be configured?

A.URL filtering policy with category blocking
B.Data Security policy
C.Access policy with file type filtering
D.Web Reputation Security policy
AnswerC

File type filtering blocks specific MIME types or extensions.

Why this answer

C is correct because an Access policy in WSA allows granular control over web traffic, including the ability to block specific file types such as .exe via the 'File Type Filtering' action. This directly prevents users from downloading executable files from the internet, as the WSA inspects the MIME type or file extension in the HTTP response and applies the configured block action.

Exam trap

Cisco often tests the distinction between URL filtering (which controls access based on site categories) and file type filtering (which controls downloads based on file type), and the trap here is that candidates confuse 'blocking executable downloads' with 'blocking malicious sites' or 'blocking categories,' leading them to choose URL filtering or Web Reputation policies instead.

How to eliminate wrong answers

Option A is wrong because URL filtering policy with category blocking controls access based on URL categories (e.g., gambling, social media), not on the file type of downloaded content; it cannot block .exe files from allowed categories. Option B is wrong because Data Security policy (DLP) is designed to prevent sensitive data leakage (e.g., credit card numbers, PII) by inspecting content, not to block executable file downloads. Option D is wrong because Web Reputation Security policy uses reputation scores to block malicious or risky sites, but it does not filter by file type; a site with good reputation could still serve .exe files.

Full explanation →
18
MCQhard

A cloud security architect is designing zero trust for a multi-cloud environment. Which principle is most critical?

A.Use of VPNs for all remote access
B.Encryption of all data in transit
C.Network segmentation using firewalls
D.Identity as the new perimeter
AnswerD

Correct. Zero trust uses identity and context for access decisions.

Why this answer

Zero trust assumes no implicit trust; identity becomes the primary perimeter for access control.

Full explanation →
19
MCQmedium

A security engineer needs to block access to social media websites for all users except those in the HR department. The solution must integrate with Active Directory. Which Cisco WSA feature should be used?

A.SSL/TLS decryption
B.Explicit proxy with PAC file
C.Identity-based policies with AD integration
D.Transparent proxy with WCCP
AnswerC

Identity-based policies allow different rules per user or group via AD.

Why this answer

Cisco WSA identity-based policies with AD integration allow different URL filtering rules per user group.

Full explanation →
20
MCQmedium

An organization wants to deploy Cisco ISE to authenticate devices that do not support 802.1X supplicant software, such as printers and IoT sensors. Which authentication method should be configured on the switch port to allow these devices network access?

A.EAP-TLS
B.MAB
C.EAP-FAST
D.PEAP-MSCHAPv2
AnswerB

MAB uses the MAC address for authentication, ideal for devices without 802.1X support.

Why this answer

MAC Authentication Bypass (MAB) allows devices that cannot run 802.1X supplicants to authenticate based on their MAC address. The switch sends the MAC address as the username and password to ISE.

Full explanation →
21
MCQmedium

A Cisco FTD is deployed in inline mode and is configured with a file policy to detect malware. When a file is transferred, the FTD computes a SHA-256 hash and checks it against AMP cloud. The cloud returns 'unavailable' for the hash. What action will the FTD take by default?

A.Allow the file and log the event.
B.Perform a deep packet inspection on the file.
C.Detonate the file in a sandbox before deciding.
D.Block the file because it could not be verified.
AnswerA

Default behavior is to allow and log when disposition is unavailable.

Why this answer

By default, if the cloud lookup cannot determine the disposition (clean, malware, unknown), the file is allowed but logged.

Full explanation →
22
MCQhard

A security engineer is troubleshooting an issue where users can bypass the Cisco WSA by using HTTPS. What must be enabled on the WSA to inspect encrypted traffic?

A.AVC
B.URL Filtering
C.HTTPS Inspection
D.Bandwidth Controls
AnswerC

HTTPS Inspection decrypts SSL/TLS traffic for content scanning.

Why this answer

SSL/TLS decryption (HTTPS inspection) is required to decrypt and inspect encrypted web traffic.

Full explanation →
23
MCQmedium

A security engineer is configuring Cisco Firepower NGFW to block social media applications. Which feature should be used to achieve this?

A.URL filtering
B.Application control
C.Intrusion prevention
D.TLS server identity discovery
AnswerB

Correct. Application control can block social media applications.

Why this answer

Firepower uses application control to identify and block specific applications like social media.

Full explanation →
24
MCQhard

In a Cisco ISE deployment, after a device passes posture assessment, ISE needs to dynamically change the VLAN assignment for the device. Which protocol or feature enables ISE to send a new authorization policy to the network access device without requiring the endpoint to reauthenticate?

A.TrustSec SGT assignment
B.RADIUS Accounting
C.CoA (Change of Authorization)
D.MAB
AnswerC

Correct. CoA dynamically changes authorization attributes like VLAN or ACL.

Why this answer

Change of Authorization (CoA) allows ISE to send real-time authorization changes (e.g., VLAN change) to the NAD using RADIUS Disconnect or Change of Authorization messages, without requiring the client to reauthenticate.

Full explanation →
25
MCQmedium

Cisco ISE performs profiling to identify device type. Which probe collects information by querying the device's MAC address OUI and DHCP options?

A.DHCP probe
B.Device Sensor probe
C.SNMP probe
D.HTTP probe
AnswerA

DHCP probe uses DHCP packets for profiling.

Why this answer

The DHCP probe analyzes DHCP packets to gather information such as vendor class identifier and hostname, helping to profile the device type.

Full explanation →
26
MCQmedium

A web application accepts user input and directly includes it in SQL queries without sanitization. An attacker submits a single quote (') to cause a syntax error. What is this attack called?

A.Cross-site scripting (XSS)
B.Buffer overflow
C.CSRF
D.SQL injection
AnswerD

The description matches SQL injection.

Why this answer

SQL injection occurs when user input is not sanitized and alters SQL query structure.

Full explanation →
27
MCQhard

A security analyst is investigating an incident on an endpoint protected by Cisco AMP. The analyst needs to isolate the compromised process and prevent it from communicating with other processes or the network. Which EDR capability should be used to achieve this?

A.File quarantine
B.IOC scanning
C.Process isolation
D.Remote shell
AnswerC

Process isolation stops the process and blocks its communication, containing the threat.

Why this answer

Process isolation is an EDR capability that terminates the process and blocks its network and inter-process communication, effectively containing the threat.

Full explanation →
28
MCQmedium

A network engineer is implementing TrustSec on a Cisco switch. The goal is to tag traffic from the engineering VLAN with Security Group Tag (SGT) 10 and enforce policies on upstream switches. Which configuration is required on the access switch to propagate the SGT?

A.cts manual policy static sgt 10
B.switchport voice vlan 10
C.authentication host-mode multi-domain
D.spanning-tree portfast
AnswerA

This enables manual SGT tagging on the interface.

Why this answer

The 'cts manual policy static sgt 10' command assigns a static Security Group Tag (SGT) to the switch port, which is then propagated to upstream switches via Cisco TrustSec (CTS) using SGT Exchange Protocol (SXP) or inline tagging. This ensures that traffic from the engineering VLAN is tagged with SGT 10, enabling policy enforcement on upstream devices.

Exam trap

The trap here is that candidates confuse VLAN configuration (e.g., voice VLAN) with Security Group Tag assignment, or assume that authentication or STP features are involved in SGT propagation.

How to eliminate wrong answers

Option B is wrong because 'switchport voice vlan 10' configures a voice VLAN for VoIP traffic, not a Security Group Tag; it does not propagate SGTs. Option C is wrong because 'authentication host-mode multi-domain' is used for 802.1X multi-domain authentication (e.g., voice and data devices), not for static SGT assignment or propagation. Option D is wrong because 'spanning-tree portfast' accelerates the port transition to forwarding state to avoid STP delays, but it has no role in SGT tagging or propagation.

Full explanation →
29
MCQhard

A security engineer is analyzing logs from a Cisco ASA. They notice that a specific internal host is generating a high volume of outbound TCP SYN packets to multiple external IP addresses on port 443, but no SYN-ACK responses are received. What is the most likely explanation?

A.The ASA is configured to block outbound HTTPS traffic
B.The host is downloading a large malware file via HTTPS
C.The host is infected with malware that is performing a SYN flood denial-of-service attack
D.The host is establishing legitimate HTTPS connections
AnswerC

Spoofed or high-volume SYN packets without responses indicate a SYN flood attack.

Why this answer

The host is sending a high volume of TCP SYN packets to multiple external IPs on port 443 without receiving SYN-ACK responses, which is characteristic of a SYN flood attack. In a SYN flood, the attacker (or infected host) sends many SYN packets to exhaust the target's connection table, but the lack of SYN-ACK responses indicates the targets are not completing the handshake, often because the source IP is spoofed or the targets are unresponsive. The Cisco ASA logs show outbound SYN packets with no corresponding SYN-ACKs, which aligns with the host being used as a source for a denial-of-service attack.

Exam trap

Cisco often tests the distinction between a host being the source of an attack versus being the victim, and the trap here is that candidates may assume the host is simply making legitimate outbound connections (Option D) without recognizing that the absence of SYN-ACK responses is the key anomaly that indicates an attack rather than normal traffic.

How to eliminate wrong answers

Option A is wrong because if the ASA were blocking outbound HTTPS traffic, the SYN packets would be dropped at the ASA and not reach the external IPs, so the logs would not show outbound SYN packets to port 443. Option B is wrong because downloading a large malware file via HTTPS would involve a full TCP three-way handshake (SYN, SYN-ACK, ACK) and subsequent data transfer, not just a flood of SYN packets with no responses. Option D is wrong because legitimate HTTPS connections require a completed three-way handshake, so the ASA logs would show SYN-ACK responses from the external servers, which are absent in this scenario.

Full explanation →
30
MCQmedium

An administrator wants to enforce identity-based policies on Cisco WSA by integrating with Active Directory. Which method allows the WSA to identify users transparently without requiring client software?

A.LDAP bind with user credentials
B.Explicit proxy with PAC file
C.Kerberos authentication with keytab file
D.Transparent user identification using Active Directory agent
AnswerD

Correct. The AD agent maps IP addresses to usernames transparently.

Why this answer

Transparent user identification on WSA can be achieved via NTLM authentication or Kerberos, but the most common transparent method is using NTLM challenge/response, or via AD agent. However, the question asks for transparent identification without client software; typical methods include using the AD agent or IP-based mapping. The best answer is 'NTLM authentication with browser integration' which is transparent to the user after initial login.

But among options, 'Transparent user identification using Active Directory agent' is correct.

Full explanation →
31
Multi-Selecthard

A security engineer is designing cloud workload protection (CWPP) for a hybrid environment with VMs and containers. Which TWO capabilities should a CWPP solution provide? (Choose two.)

Select 2 answers
A.Cloud security posture management (CSPM) for configuration
B.Intrusion prevention system (IPS) for workloads
C.DNS-layer security for user devices
D.Data loss prevention (DLP) for SaaS applications
E.Vulnerability scanning for OS and applications
AnswersB, E

IPS is a common CWPP feature.

Why this answer

CWPP solutions focus on workload protection including vulnerability scanning, intrusion detection, file integrity monitoring, and sometimes container security.

Full explanation →
32
MCQhard

A network administrator is configuring Cisco ASA with FirePOWER services. The administrator wants to inspect SSL traffic but is concerned about certificate pinning in modern applications. Which action should the administrator take to ensure that SSL inspection does not break applications that use certificate pinning?

A.Configure SSL inspection to bypass all traffic to avoid any issues
B.Install a custom root CA on all clients and configure the ASA to use that CA
C.Create an SSL decryption rule to exclude traffic from applications known to use certificate pinning
D.Use a decryption policy that decrypts the traffic but does not re-encrypt
AnswerC

Excluding pinned applications prevents the ASA from interfering with certificate validation.

Why this answer

Certificate pinning hardcodes the expected certificate or public key within an application. If the ASA decrypts and re-encrypts the traffic using a different certificate (even one signed by a trusted CA), the pinned certificate will not match, causing the application to reject the connection. By creating an SSL decryption rule that excludes traffic from applications known to use certificate pinning, the administrator avoids breaking those applications while still inspecting other SSL traffic.

Exam trap

Cisco often tests the misconception that installing a trusted root CA on clients is sufficient to handle all SSL inspection scenarios, but the trap here is that certificate pinning bypasses CA trust entirely by comparing against a hardcoded certificate or public key.

How to eliminate wrong answers

Option A is wrong because bypassing all SSL traffic defeats the purpose of SSL inspection and leaves all encrypted traffic uninspected, which is not a valid security strategy. Option B is wrong because installing a custom root CA on all clients does not solve certificate pinning; pinned applications compare the server certificate against a hardcoded value, not against a trusted CA chain, so the ASA's re-encrypted certificate will still fail the pinning check. Option D is wrong because decrypting without re-encrypting would send plaintext traffic to the client, which breaks TLS protocol expectations and would be rejected by the client; the ASA must re-encrypt to maintain a valid TLS session.

Full explanation →
33
Multi-Selectmedium

A company is designing a network segmentation strategy using firewalls. Which THREE considerations are important for a defense-in-depth approach?

Select 3 answers
A.Use a DMZ to host public-facing services.
B.Allow all outbound traffic from internal users.
C.Apply strict inbound ACLs to limit access to critical zones.
D.Place all servers in the same segment for easier management.
E.Implement internal segmentation to contain threats.
AnswersA, C, E

DMZ isolates public services from internal network.

Why this answer

Defense-in-depth involves multiple layers: DMZ for public services, internal segmentation to limit lateral movement, and inbound strict rules.

Full explanation →
34
Multi-Selectmedium

A security engineer is implementing a zero trust architecture. Which TWO principles are foundational to zero trust? (Choose two.)

Select 2 answers
A.Implicit trust for internal users
B.Single perimeter defense
C.All traffic must be inspected by a firewall
D.Least privilege access
E.Never trust, always verify
AnswersD, E

Least privilege is a fundamental concept in zero trust.

Why this answer

Zero trust is based on 'never trust, always verify' and least privilege. Microsegmentation is a technique to enforce least privilege, but the core principles are never trust/always verify and least privilege.

Full explanation →
35
MCQmedium

A Cisco FTD is configured with SSL/TLS inspection using the 'decrypt-known-key' method. Which traffic can be decrypted with this method?

A.Traffic to internal servers whose private key is imported into FTD
B.Traffic to any website on the internet
C.Traffic using self-signed certificates only
D.All SSL traffic regardless of certificate
AnswerA

This method requires the server's private key to decrypt.

Why this answer

Decrypt-known-key is used when the FTD has the server's private key, typically for internal servers.

Full explanation →
36
MCQmedium

An organization uses Cisco ISE to enforce posture compliance. After a user's machine is patched, ISE sends a command to the switch to reclassify the endpoint from a restricted VLAN to a full-access VLAN. Which ISE feature accomplishes this?

A.Posture Assessment
B.Profiling
C.Guest Access
D.Change of Authorization (CoA)
AnswerD

CoA enables dynamic changes to session attributes like VLAN or ACL based on posture updates.

Why this answer

Change of Authorization (CoA) allows ISE to dynamically change an authenticated session's attributes, such as VLAN assignment or ACL, without requiring reauthentication.

Full explanation →
37
MCQhard

A Cisco WSA receives intermittent complaints that legitimate websites are being blocked. The access policy uses reputation scoring and URL filtering. The administrator checks the logs and finds that the blocked requests have a web reputation score of -2.0. What action should be taken to allow these legitimate sites while still blocking malicious ones?

A.Create a custom URL category for the legitimate sites and apply an allow action above the reputation policy.
B.Lower the reputation threshold to -1.0.
C.Set the reputation action to 'Monitor' for suspicious scores.
D.Disable web reputation filtering for that policy.
AnswerA

Allow override bypasses reputation blocking for specific sites.

Why this answer

Creating a custom URL category for the legitimate sites and placing an allow action above the reputation policy ensures that traffic matching that category bypasses the reputation scoring check. This allows the legitimate sites while the reputation policy continues to block malicious sites with scores below the threshold. In Cisco WSA, access policies are evaluated in order, so a higher-priority allow rule for trusted URLs overrides the lower-priority reputation-based block.

Exam trap

Cisco often tests the concept of policy evaluation order in WSA, where candidates mistakenly think adjusting the reputation threshold or disabling filtering is the correct fix, rather than using a higher-priority allow rule for trusted sites.

How to eliminate wrong answers

Option B is wrong because lowering the reputation threshold to -1.0 would allow more sites with poor reputation (scores between -2.0 and -1.0) to pass, increasing the risk of allowing malicious sites. Option C is wrong because setting the reputation action to 'Monitor' for suspicious scores would only log the requests without blocking them, which does not selectively allow the legitimate sites while still blocking malicious ones. Option D is wrong because disabling web reputation filtering entirely removes the reputation-based protection for the whole policy, leaving all sites unguarded against malicious threats.

Full explanation →
38
MCQhard

Refer to the exhibit. An engineer configured 802.1X on two switch ports. On Gi1/0/1, a VoIP phone and a PC are connected via a hub. On Gi1/0/2, only a single PC is connected. Which port will successfully authenticate both devices, and what is the issue with the other port?

A.Both ports will authenticate all connected devices because 802.1X supports multiple hosts by default.
B.Gi1/0/2 will authenticate the PC; Gi1/0/1 will fail because multi-auth is not supported on access ports.
C.Gi1/0/1 will authenticate both devices; Gi1/0/2 will fail because the tx-period is too long.
D.Gi1/0/1 will authenticate both devices; Gi1/0/2 will only authenticate the PC, and any additional device will be denied.
AnswerD

Multi-auth allows multiple devices; single-host allows only one.

Why this answer

Gi1/0/1 is configured with the `authentication port-control auto` and `authentication host-mode multi-auth` commands, which allow both the VoIP phone and the PC to authenticate independently. Gi1/0/2 is configured with `authentication host-mode single-host` (the default), which only permits a single authenticated device; any additional device, such as a second PC connected via a hub, will be denied access.

Exam trap

Cisco often tests the distinction between `multi-auth` and `single-host` modes, and the trap here is that candidates assume 802.1X inherently supports multiple devices or that a long tx-period is the cause of failure, rather than recognizing the default single-host restriction on Gi1/0/2.

How to eliminate wrong answers

Option A is wrong because 802.1X does not support multiple hosts by default; the default host mode is single-host, which only allows one authenticated MAC address per port. Option B is wrong because multi-auth is supported on access ports; the issue with Gi1/0/1 is not about support but about the specific host-mode configuration shown in the exhibit. Option C is wrong because the tx-period (60 seconds) does not cause a failure on Gi1/0/2; the tx-period is a timer for reauthentication or EAP retransmission, and the exhibit shows Gi1/0/2 is configured with single-host mode, which is the actual reason it cannot authenticate multiple devices.

Full explanation →
39
MCQmedium

A company uses Cisco ISE for posture assessment. They require that all endpoints meet a certain set of compliance rules before being granted network access. Which service is responsible for performing the posture assessment on the endpoint?

A.ISE Policy Service
B.Cisco AnyConnect ISE Posture Module
C.Cisco ISE pxGrid
D.Network Access Device (switch)
AnswerB

The AnyConnect Posture Module runs on the endpoint and performs the actual posture checks.

Why this answer

The Cisco AnyConnect ISE Posture Module is the client-side software agent installed on the endpoint that performs the actual posture assessment. It collects compliance information such as OS patch level, antivirus status, and running processes, then reports this data to the ISE Policy Service for evaluation. Without this module running on the endpoint, ISE cannot perform a posture check.

Exam trap

Cisco often tests the distinction between the server-side policy evaluation (ISE Policy Service) and the client-side agent (AnyConnect Posture Module) that performs the actual endpoint scan, leading candidates to incorrectly select the Policy Service.

How to eliminate wrong answers

Option A is wrong because the ISE Policy Service is the server-side component that evaluates posture policies and makes access decisions, but it does not perform the assessment on the endpoint itself. Option C is wrong because pxGrid is a publish/subscribe messaging protocol used for sharing context data between ISE and other security systems, not for endpoint posture assessment. Option D is wrong because the Network Access Device (switch) enforces access control based on ISE decisions (e.g., via dACL or VLAN change) but does not perform posture assessment on the endpoint.

Full explanation →
40
MCQmedium

An organization deploys Cisco FTD in a high-availability pair using active/standby. If the active unit fails, what happens to existing connections?

A.Existing connections are preserved if stateful failover is configured.
B.All connections are dropped and must be re-established.
C.The standby unit cannot take over because it has no configuration.
D.Only TCP connections are preserved; UDP connections are dropped.
AnswerA

Correct.

Why this answer

In active/standby, state information is synchronized. When the standby becomes active, existing connections are preserved if the failover is stateful.

Full explanation →
41
Multi-Selectmedium

A company uses Amazon Web Services (AWS) and wants to integrate with Cisco Defense Orchestrator (CDO) for centralized security management. Which THREE capabilities does CDO provide when managing AWS security services? (Choose three.)

Select 3 answers
A.Monitor AWS CloudTrail logs for security events.
B.Manage AWS Identity and Access Management (IAM) roles.
C.Deploy and manage Cisco virtual firewalls in AWS.
D.Create and modify AWS security group rules.
E.Provision and configure AWS VPC subnets.
AnswersA, C, D

Correct: CDO can ingest CloudTrail logs for analysis.

Why this answer

A is correct because Cisco Defense Orchestrator (CDO) can ingest and monitor AWS CloudTrail logs to detect security events, such as unauthorized API calls or policy violations. This integration allows CDO to correlate cloud-native audit logs with firewall events for centralized visibility and alerting, which is a key capability for cloud security management.

Exam trap

Cisco often tests the distinction between security management (CDO) and infrastructure provisioning (AWS native services), so candidates mistakenly assume CDO can manage IAM roles or VPC subnets, but CDO is strictly a security orchestration tool, not a cloud infrastructure manager.

Full explanation →
42
MCQmedium

An engineer is troubleshooting a user who cannot access the network after successful 802.1X authentication. The user's PC receives an IP address from DHCP, but cannot reach the internet. The switch port is in the correct VLAN (10) after authentication. The ISE posture policy requires the user to install a corporate certificate, but the user skipped that step. What is the most likely cause of the internet access failure?

A.The user is not logged into the domain
B.The switchport is still in the default VLAN
C.The DHCP server does not have a scope for VLAN 10
D.The ISE posture policy returned 'NonCompliant' and ISE applied a Change of Authorization (CoA) to place the port in a remediation VLAN
AnswerD

ISE can use CoA to dynamically move the port to a remediation VLAN with no internet access.

Why this answer

The ISE posture policy requires a corporate certificate, and since the user skipped that step, the endpoint is marked as 'NonCompliant'. ISE then sends a Change of Authorization (CoA) to the switch, which dynamically moves the port from the authorized VLAN (10) to a remediation VLAN. This remediation VLAN typically has restricted access, such as no internet connectivity, while still allowing DHCP to assign an IP address from that VLAN's scope.

Exam trap

Cisco often tests the distinction between authentication success and posture compliance; the trap here is that candidates assume a successful 802.1X authentication and DHCP lease guarantee full network access, overlooking the fact that ISE can dynamically re-VLAN the port via CoA based on posture policy results.

How to eliminate wrong answers

Option A is wrong because domain login status is not directly tied to 802.1X posture enforcement; the user already authenticated successfully, and the issue is post-authentication compliance, not authentication itself. Option B is wrong because the question explicitly states the switch port is in the correct VLAN (10) after authentication, so it is not in the default VLAN. Option C is wrong because the user receives an IP address from DHCP, indicating that a DHCP scope exists for the VLAN the port is currently in; the problem is that the port was moved to a remediation VLAN with no internet access, not that DHCP failed.

Full explanation →
43
Multi-Selectmedium

A Cisco FTD is deployed in inline mode and configured with an access control policy. The policy includes rules with actions: Trust, Allow, Block, and Interactive Block. Which two statements about these actions are correct? (Choose two.)

Select 2 answers
A.Trust action bypasses all further inspection modules.
B.Interactive Block action shows a block page to the user.
C.Allow action is the default action if no rule matches.
D.Block action logs the traffic and allows it to pass.
E.Allow action applies only URL filtering but not IPS.
AnswersA, B

Trust skips IPS, file, and URL filtering.

Why this answer

Trust bypasses all further inspection. Allow permits traffic but subjects it to inspection. Block drops traffic.

Interactive Block challenges the user with a block page and allows them to proceed if they accept.

Full explanation →
44
MCQmedium

An engineer configures a Cisco ASA in a DMZ architecture. The DMZ hosts web servers that need to be accessible from the internet. Which security level should be assigned to the DMZ interface to ensure proper traffic flow without additional ACLs for return traffic?

A.255
B.0
C.50
D.100
AnswerC

Correct. Level 50 is between 0 and 100, allowing return traffic from DMZ to outside without ACLs.

Why this answer

For internet-to-DMZ traffic, the DMZ interface should have a security level higher than outside (0) but lower than inside (100) to allow return traffic from DMZ to outside without explicit ACLs. Level 50 is common.

Full explanation →
45
MCQhard

A Cisco FTD device is deployed inline and configured with an access control policy that includes a rule to block traffic from a specific source IP address. However, traffic from that IP is still passing through. What is the most likely cause?

A.The rule is assigned to the wrong interface
B.The intrusion policy is overriding the block action
C.The device is in passive mode
D.A trust rule exists before the block rule in the policy
AnswerD

Correct. Traffic matching an earlier trust rule will bypass later block rules.

Why this answer

In Cisco FTD, the access control policy rules are evaluated in order. If a rule earlier in the order permits the traffic (e.g., a trust rule), subsequent block rules are not evaluated. The rule order must be correct.

Full explanation →
46
MCQmedium

An organization is deploying Cisco Firepower Threat Defense (FTD) in a high-availability (HA) pair in active/standby mode. Which statement about state synchronization is true?

A.The standby unit mirrors all traffic and builds its own connection table.
B.Both units process traffic simultaneously and share states via the control link.
C.Connection states are synchronized from active to standby over the failover link.
D.Only configuration is synchronized; connection states are not replicated.
AnswerC

Correct. Stateful failover replicates connection state information.

Why this answer

In active/standby HA, the active unit replicates connection states to the standby unit so that if a failover occurs, the standby can take over without disrupting existing connections. Stateful failover requires synchronization of connection tables.

Full explanation →
47
MCQeasy

A company wants to use Cisco Umbrella to block access to malicious domains. They have deployed the Umbrella roaming client on all endpoints. However, traffic from a specific application is still reaching a known malicious domain. What is the most likely reason?

A.The Umbrella policy is configured to allow that specific application.
B.The domain is not categorized as malicious in Umbrella's database.
C.The Umbrella roaming client is not installed on the server.
D.The application uses a hardcoded IP address or non-DNS protocol.
AnswerD

Umbrella blocks at the DNS layer; if the application does not use DNS, the block does not apply.

Why this answer

Cisco Umbrella operates at the DNS layer, meaning it can only block domains that are resolved via DNS queries. If an application uses a hardcoded IP address or communicates using a non-DNS protocol (e.g., direct IP connections or protocols like HTTP/HTTPS without DNS resolution), the traffic bypasses Umbrella's DNS-based enforcement entirely. This is why the malicious domain is still reachable despite the roaming client being deployed.

Exam trap

Cisco often tests the misconception that Umbrella blocks all traffic regardless of how the destination is resolved, when in fact it only blocks based on DNS queries, not direct IP connections or non-DNS protocols.

How to eliminate wrong answers

Option A is wrong because Umbrella policies apply globally to all traffic passing through the DNS layer; there is no per-application allow/block policy that would override DNS-based blocking for a specific application. Option B is wrong because even if a domain is not categorized as malicious, Umbrella can still block it via custom block lists or security categories; the question states the domain is known malicious, implying it should be blocked. Option C is wrong because the roaming client is deployed on all endpoints, and the traffic originates from an endpoint, not a server; the roaming client on the endpoint handles DNS resolution for all applications on that endpoint.

Full explanation →
48
MCQmedium

A network engineer is trying to establish a site-to-site IPsec VPN between two Cisco routers. The IKEv2 proposal uses AES-256 encryption and SHA-256 hash. On the remote router, the configuration shows only AES-128 and SHA-1. What will happen during IKEv2 negotiation?

A.The router with stronger proposal will override the other.
B.The IKEv2 negotiation will fail because no common proposal exists.
C.The routers will automatically fall back to IKEv1.
D.The routers will negotiate and use AES-128 with SHA-256.
AnswerB

Both sides must have at least one matching proposal for IKEv2 to establish.

Why this answer

IKEv2 negotiation requires that both peers have at least one matching proposal (encryption, hash, DH group, etc.) in their configured transform sets. Since the local router offers AES-256/SHA-256 and the remote router only offers AES-128/SHA-1, there is no common proposal. IKEv2 does not perform automatic fallback or mixing of parameters; it simply fails if no match is found.

Exam trap

Cisco often tests the misconception that IKEv2 will automatically negotiate a 'best common' set of parameters or fall back to IKEv1, when in fact it requires an exact match on the entire proposal and has no backward compatibility with IKEv1.

How to eliminate wrong answers

Option A is wrong because IKEv2 does not allow one peer to override the other's proposal; negotiation is a matching process, not a strength-based override. Option C is wrong because IKEv2 and IKEv1 are separate protocols; there is no automatic fallback from IKEv2 to IKEv1 during negotiation—the administrator must explicitly configure IKEv1 if desired. Option D is wrong because IKEv2 does not mix parameters from different proposals; it requires an exact match on the entire proposal set (encryption AND hash), so AES-128 with SHA-256 is not a valid negotiated combination unless explicitly configured on both sides.

Full explanation →
49
MCQeasy

Refer to the exhibit. An engineer configured ISE to use both Active Directory and LDAP for authentication. Users from Active Directory are unable to authenticate. What is the most likely reason?

A.Active Directory users are not allowed in the policy
B.The LDAP identity store is unreachable and ISE is attempting LDAP before AD
C.The Active Directory identity store is disconnected
D.The authentication sequence is set to 'AD then LDAP'
AnswerB

If LDAP is configured as the first authentication source, the timeout causes authentication to fail before AD is tried.

Why this answer

When ISE is configured with both Active Directory and LDAP identity stores, the authentication sequence determines the order in which they are tried. If the sequence is set to 'LDAP then AD' and the LDAP server is unreachable, ISE will attempt LDAP first, fail (due to unreachability), and then proceed to AD. However, if the LDAP server is unreachable but the sequence is 'AD then LDAP', AD would be tried first and succeed for AD users.

The most likely reason AD users fail is that the sequence is 'LDAP then AD' and LDAP is unreachable, causing ISE to attempt LDAP first and fail before ever reaching AD, or the sequence is misconfigured such that AD is not tried at all. This aligns with the exhibit's implication that LDAP is attempted before AD, and LDAP being unreachable blocks AD authentication.

Exam trap

Cisco often tests the misconception that a disconnected identity store is the root cause, when in fact the authentication sequence order and reachability of the first store in the list is the critical factor that causes users from a secondary store to fail authentication.

How to eliminate wrong answers

Option A is wrong because the policy itself does not inherently block Active Directory users; the issue is the authentication sequence order and reachability, not a policy rule that explicitly denies AD users. Option C is wrong because if the AD identity store were disconnected, ISE would typically log a join/disconnect error and authentication would fail for all AD users, but the question states AD users are unable to authenticate specifically, implying a sequencing issue rather than a complete disconnection. Option D is wrong because if the authentication sequence were set to 'AD then LDAP', AD would be tried first and succeed for AD users (assuming AD is reachable), so this would not cause AD users to fail; the failure occurs when LDAP is attempted first and is unreachable.

Full explanation →
50
MCQhard

A multinational company has recently deployed Cisco WSA with explicit proxy for 10,000 users across two data centers. The WSA is configured with multiple identities based on IP subnets and authentication via LDAP. Users in the R&D department (subnet 192.168.10.0/24) are configured with an access policy that blocks all social media, but they can access web-based email like Gmail. The administrator receives complaints that R&D users cannot access a critical partner's HTTPS website (https://portal.partner.com) that is not categorized. The access policy for R&D has a default action of 'Monitor' for uncategorized URLs, but the site is blocked. The web reputation score for the site is +1.5 (low risk). The global web reputation threshold is set to -1.0. The administrator checks the access logs and sees that the request is denied with the reason 'URL is blocked by policy'. The R&D policy has an explicit 'Deny' action for the URL category 'Uncategorized URLs' set to 'Block', but the default action for the policy is 'Monitor'. The identity matching is correct. What is the most likely cause and solution?

A.Change the R&D policy's Uncategorized URLs action from Block to Monitor.
B.Lower the global web reputation threshold to -2.0 to allow more sites.
C.Create a custom URL category for portal.partner.com and configure the R&D policy to allow it.
D.Disable authentication for the R&D identity to bypass policy.
AnswerC

Custom allow rule overrides the category block.

Why this answer

The R&D access policy has an explicit 'Deny' action for the 'Uncategorized URLs' category, which overrides the default 'Monitor' action. Since portal.partner.com is uncategorized, it is blocked by this explicit deny. Creating a custom URL category for the partner site and configuring an explicit 'Allow' action in the R&D policy will bypass the uncategorized URL block while preserving the rest of the policy.

Exam trap

Cisco often tests the concept that explicit policy actions for a URL category override the default action, leading candidates to incorrectly assume the default 'Monitor' action would allow the traffic when an explicit 'Deny' is present.

How to eliminate wrong answers

Option A is wrong because changing the Uncategorized URLs action from Block to Monitor would allow all uncategorized sites, including potentially malicious ones, which violates the security intent of blocking social media and could expose the R&D department to risks. Option B is wrong because the global web reputation threshold is already set to -1.0, and the site has a reputation score of +1.5 (low risk), so lowering the threshold would not affect this block; the block is due to the explicit policy action on uncategorized URLs, not reputation. Option D is wrong because disabling authentication would bypass identity-based policy matching, potentially applying a different policy that might allow the site, but it would also remove access controls for all R&D users, breaking the intended security posture and is not a recommended practice.

Full explanation →
51
MCQmedium

A company deploys a web application firewall (WAF) from Cisco on AWS Marketplace. They want to integrate with AWS CloudTrail for logging. What is the primary benefit?

A.Simplified compliance reporting
B.Elimination of false positives
C.Automatic WAF rule updates
D.Centralized logging of WAF events in CloudTrail
AnswerD

Enables centralized audit and monitoring.

Why this answer

Integrating a Cisco WAF deployed via AWS Marketplace with AWS CloudTrail provides centralized logging of all WAF events, including allowed and blocked requests, directly into CloudTrail. This enables a single, auditable log stream for security monitoring and compliance, as CloudTrail captures API calls and WAF events for analysis in AWS services like CloudWatch Logs or Amazon S3.

Exam trap

The trap here is that candidates may confuse the primary benefit of CloudTrail integration (centralized logging) with secondary benefits like compliance or automation, but Cisco specifically tests the understanding that CloudTrail's core function is logging and monitoring, not rule management or false positive reduction.

How to eliminate wrong answers

Option A is wrong because simplified compliance reporting is a potential benefit of centralized logging, but it is not the primary or direct benefit of CloudTrail integration; CloudTrail provides raw event logs, not pre-built compliance reports. Option B is wrong because false positive reduction is achieved through tuning WAF rules and signatures, not through logging integration with CloudTrail. Option C is wrong because automatic WAF rule updates are managed by Cisco or the WAF service itself, not by CloudTrail, which is solely a logging and monitoring service.

Full explanation →
52
MCQhard

After deploying a Cisco Cloudlock policy, a user reports that a sanctioned application (Salesforce) is being blocked for file downloads. What is the most likely cause?

A.The Salesforce API token has expired
B.The file being downloaded contains sensitive data flagged by DLP
C.The user's browser is not configured with the corporate proxy
D.The Cloudlock policy for Salesforce is set to 'Block' due to misconfiguration
AnswerD

A misconfigured policy can block sanctioned applications.

Why this answer

Cloudlock policies are configured to enforce actions such as 'Allow', 'Block', or 'Monitor' on sanctioned applications like Salesforce. If a policy is misconfigured to 'Block' for file downloads, Cloudlock will intercept the API call and deny the download regardless of the file's content. This is a common administrative error when setting granular controls for cloud app activities.

Exam trap

The trap here is that candidates may assume DLP is the only reason for blocking downloads, but Cisco tests whether you understand that Cloudlock policies have explicit actions (Allow/Block/Monitor) that can be misconfigured independently of DLP rules.

How to eliminate wrong answers

Option A is wrong because an expired Salesforce API token would cause authentication failures across all API interactions, not selectively block file downloads while other operations succeed. Option B is wrong because DLP-triggered blocking would only occur if the policy is set to 'Monitor' or 'Block' for sensitive data; the question states the policy is blocking all downloads, not just those with sensitive content. Option C is wrong because Cloudlock operates at the API level for sanctioned apps, not via browser proxy configuration; browser proxy settings affect web traffic interception, not API-based policy enforcement.

Full explanation →
53
MCQmedium

A security administrator notices that several endpoints in the finance department are exhibiting unusual network behavior, including connections to known malicious IP addresses. The administrator has deployed Cisco Secure Endpoint (formerly AMP for Endpoints) with TETRA and has enabled the built-in firewall. What is the best course of action to quickly identify the root cause and contain the threat?

A.Disable the built-in firewall on the endpoints to allow full traffic inspection by the TETRA engine.
B.Use the Cisco Secure Endpoint console to review the TETRA engine's real-time traffic analysis and isolate the affected endpoints.
C.Wait for the weekly threat report from Cisco Talos to identify the malware family and then apply a signature update.
D.Uninstall the Cisco Secure Endpoint connector and reinstall it with a fresh policy.
AnswerB

TETRA provides real-time traffic analysis; the console allows immediate visibility and isolation.

Why this answer

Cisco Secure Endpoint with TETRA provides real-time traffic analysis and endpoint isolation capabilities directly from the console. The TETRA engine inspects network flows using behavioral analysis and machine learning, and the administrator can immediately isolate affected endpoints to prevent lateral movement while reviewing the root cause.

Exam trap

Cisco often tests the misconception that disabling security controls (like the firewall) will improve detection, when in fact the TETRA engine operates independently and isolation is the correct containment step.

How to eliminate wrong answers

Option A is wrong because disabling the built-in firewall removes a critical layer of defense and does not improve TETRA's inspection; TETRA operates independently of the host firewall. Option C is wrong because waiting for a weekly Talos report is too slow for an active threat, and signature updates are reactive rather than providing immediate containment. Option D is wrong because reinstalling the connector with a fresh policy is disruptive, time-consuming, and does not address the need for rapid root cause analysis and containment.

Full explanation →
54
MCQhard

A Cisco FTD device managed by FMC is processing traffic. An access control rule is configured with the action 'Interactive Block'. What behavior does this action trigger?

A.The packet is dropped and logged without any user notification.
B.The connection is reset and the source IP is added to a block list permanently.
C.The traffic is allowed but inspected more closely.
D.The user is shown a block page and can click to bypass the block for a specified time.
AnswerD

Interactive Block allows the user to request bypass.

Why this answer

Interactive Block presents a user with a block page with an option to bypass; it is not a simple block or allow.

Full explanation →
55
MCQhard

An organization is implementing a zero trust strategy for cloud access. They require that all access to cloud resources be authenticated and authorized based on user identity and device health, with session risk assessment. Which Azure AD feature should they primarily use?

A.Azure AD Identity Protection
B.Privileged Identity Management (PIM)
C.Azure AD Multi-Factor Authentication
D.Conditional Access
AnswerD

Conditional Access enforces policies based on user, device, location, and risk signals, essential for zero trust.

Why this answer

Conditional Access policies in Azure AD evaluate signals (user, device, location, risk) to enforce access controls, aligning with zero trust principles.

Full explanation →
56
MCQeasy

Which Cisco security product provides network visibility and traffic analytics using NetFlow and IPFIX?

A.Cisco Firepower Management Center
B.Cisco Stealthwatch
C.Cisco Umbrella
D.Cisco ISE
AnswerB

Cisco Stealthwatch uses NetFlow/IPFIX for network visibility and threat detection.

Why this answer

Cisco Stealthwatch uses NetFlow/IPFIX for network visibility and threat detection. Option A (FMC) is for firewall management. Option D (ISE) is for identity services.

Option C (Umbrella) is for cloud security.

Full explanation →
57
MCQmedium

An attacker injects a malicious SQL query into a web application's login form, bypassing authentication. Which type of exploitation is this?

A.Cross-site request forgery (CSRF)
B.Buffer overflow
C.SQL injection
D.Cross-site scripting (XSS)
AnswerC

SQL injection manipulates database queries through user input.

Why this answer

SQL injection is an attack where malicious SQL statements are inserted into an entry field for execution.

Full explanation →
58
MCQeasy

A network administrator notices that an endpoint running the AMP connector is not sending events to the cloud. The connector status shows 'Connected' in the AMP console. What is the most likely cause?

A.The AMP license has expired.
B.The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud.
C.Inbound firewall rules block incoming connections to the AMP connector.
D.The AMP connector service is stopped on the endpoint.
AnswerB

The connector can establish a TCP connection (appear connected) but event submission over HTTPS fails through the proxy.

Why this answer

The AMP connector status shows 'Connected' in the AMP console, which indicates that the endpoint has successfully established a TCP connection and authenticated with the AMP cloud. However, if the endpoint is behind a proxy that does not allow HTTPS (TCP/443) traffic to the AMP cloud, the connector may appear connected (due to a persistent keep-alive or cached status) but cannot send event data because the proxy is blocking the actual data-plane traffic. This is a common misconfiguration where the proxy allows the initial handshake but filters subsequent HTTPS requests.

Exam trap

Cisco often tests the distinction between a 'Connected' status (which only indicates a control-plane or registration state) and actual data-plane functionality (event uploads), leading candidates to overlook proxy or firewall egress issues that block HTTPS traffic.

How to eliminate wrong answers

Option A is wrong because an expired AMP license would prevent the connector from authenticating or registering, resulting in a 'Disconnected' or 'Unlicensed' status, not 'Connected'. Option C is wrong because inbound firewall rules block incoming connections to the endpoint, but the AMP connector initiates outbound HTTPS connections to the cloud; inbound rules are irrelevant for event uploads. Option D is wrong because if the AMP connector service is stopped on the endpoint, the connector would not be able to maintain a 'Connected' status in the AMP console; the status would show 'Disconnected' or 'Offline'.

Full explanation →
59
MCQeasy

A company uses Cisco Umbrella for cloud-delivered security. Users report that some websites are incorrectly blocked. The security team wants to allow a specific website temporarily while investigating. Which action should the administrator take?

A.Disable the Umbrella policy entirely.
B.Configure a Proxy Auto-Config (PAC) file to exclude the domain.
C.Create a custom policy rule to allow the specific domain.
D.Change the internal DNS servers to use a public resolver like 8.8.8.8.
AnswerC

Correct: This adds a targeted bypass without affecting other security.

Why this answer

The correct action is to create a custom policy rule to allow the specific domain. Cisco Umbrella uses policy-based rules to control DNS and web traffic; a custom allow rule overrides the default block for that domain without affecting other security settings. This provides a temporary, targeted exception while the investigation continues.

Exam trap

The trap here is that candidates may confuse PAC file configuration (a proxy bypass mechanism) with Umbrella's cloud-based policy enforcement, but PAC files only affect proxy traffic and cannot override DNS-layer filtering in Umbrella.

How to eliminate wrong answers

Option A is wrong because disabling the entire Umbrella policy removes all security controls, exposing the network to threats, which is excessive for a single domain issue. Option B is wrong because a PAC file controls proxy settings on endpoints, not Umbrella's cloud-based DNS or web filtering; it cannot bypass Umbrella's enforcement at the DNS layer. Option D is wrong because changing internal DNS servers to a public resolver like 8.8.8.8 bypasses Umbrella's DNS security entirely, breaking all cloud-delivered protection, not just for the specific domain.

Full explanation →
60
MCQmedium

An engineer is configuring Dynamic Access Policy (DAP) on an ASA for AnyConnect VPN. They want to assign different access policies based on the client's anti-virus status and device posture. What must be configured to obtain this information?

A.Cisco Secure Client (formerly AnyConnect) with posture module
B.Group policy with split tunneling enabled
C.Cisco ISE as the AAA server
D.SSL VPN with DTLS enabled
AnswerA

Correct. The posture module collects endpoint compliance information.

Why this answer

DAP can use endpoint attributes from the AnyConnect client, such as antivirus status, via the Secure Endpoint or posture module. The ASA obtains this information through the AnyConnect client's posture assessment.

Full explanation →
61
MCQmedium

A user reports slow performance when accessing cloud-based applications. Which Cisco tool provides visibility into SaaS application performance?

A.Cisco ThousandEyes
B.Cisco Firepower URL filtering
C.Cisco Umbrella SIG
D.Cisco WSA bandwidth controls
AnswerA

ThousandEyes monitors application performance across networks.

Why this answer

Cisco ThousandEyes provides monitoring and visibility into the performance of cloud and SaaS applications.

Full explanation →
62
Multi-Selecthard

Which THREE of the following are required for a successful 802.1X authentication on a Cisco switch? (Choose THREE)

Select 3 answers
A.Security Group Tag (SGT) must be assigned
B.A downloadable ACL (dACL) must be configured on ISE
C.The switch must be configured as a RADIUS client to ISE
D.The switch port must be configured with 'authentication port-control auto'
E.The endpoint must have a valid credential (certificate or password)
AnswersC, D, E

The switch must communicate with ISE via RADIUS for authentication.

Why this answer

For 802.1X authentication, the switch must act as a RADIUS client (authenticator) forwarding EAP frames to the ISE (authentication server). Without this configuration, the switch cannot communicate with ISE to validate the endpoint's credentials, making it a mandatory requirement.

Exam trap

Cisco often tests the distinction between authentication prerequisites and post-authentication policies, leading candidates to mistakenly select optional features like dACLs or SGTs as mandatory for the 802.1X authentication step.

Full explanation →
63
MCQmedium

A company is deploying workloads in AWS and wants to ensure that the security groups are not overly permissive. They need to continuously monitor for misconfigurations and compare against the CIS AWS Foundations Benchmark. Which tool should be used?

A.AWS CloudTrail
B.AWS WAF
C.CASB
D.CSPM
AnswerD

CSPM is designed for posture management and compliance with benchmarks.

Why this answer

CSPM (Cloud Security Posture Management) tools continuously monitor cloud configurations and compare against benchmarks like CIS to detect misconfigurations.

Full explanation →
64
MCQmedium

A network administrator is configuring site-to-site VPN between two Cisco ASA firewalls using IKEv2. The administrator wants to ensure that the VPN tunnel uses the most secure encryption algorithm available. Which encryption algorithm should be selected in the IKEv2 proposal?

A.AES-256
B.AES-128
C.DES
D.3DES
AnswerA

AES-256 is the strongest encryption algorithm listed.

Why this answer

AES-256 provides the highest security among the options. DES and 3DES are weak and deprecated, while AES-128 is less secure than AES-256.

Full explanation →
65
MCQhard

You are troubleshooting a Cisco ISE deployment where some endpoints are stuck in the 'Not Compliant' posture after a posture scan. ISE logs show 'Conditional NAC Agent result: Not Compliant due to missing required application.' The application is installed on the endpoint. What should you check?

A.The NAC Agent is running an outdated version.
B.The posture policy requires a specific version that is not installed.
C.The endpoint's firewall is blocking the ISE posture probe.
D.The antivirus definition file is outdated.
AnswerB

The policy may require a particular version or update, causing the check to fail even if the application exists.

Why this answer

The log indicates a missing application, but it is installed. This often occurs when the posture policy requires a specific version or patch level. Option A is incorrect because antivirus definitions are separate.

Option C is incorrect because agent version would cause a different error. Option D is incorrect because firewall blocking would prevent scan results.

Full explanation →
66
MCQhard

Refer to the exhibit. Enter the command output from a Cisco Umbrella deployment. An administrator observes that 25 DNS queries were blocked. What does this indicate?

A.Successful DNS resolution for those queries
B.Internal DNS resolution failures
C.Network congestion causing queries to timeout
D.Policy enforcement blocking malicious or unwanted domains
AnswerD

Umbrella's security policy blocks malicious domains, resulting in blocked queries.

Why this answer

The command output from a Cisco Umbrella deployment shows that 25 DNS queries were blocked. In Umbrella, DNS queries are blocked due to policy enforcement, typically when the domain being queried matches a security category (e.g., malware, phishing, command-and-control) or a custom block list. This indicates that Umbrella's cloud-delivered security policy actively prevented resolution of those 25 domains, protecting the network from malicious or unwanted content.

Exam trap

The trap here is that candidates may confuse 'blocked' with 'failed to resolve' due to network issues (like timeouts or internal DNS failures), but Cisco specifically tests that Umbrella's block count is a deliberate policy enforcement action, not a connectivity or resolution error.

How to eliminate wrong answers

Option A is wrong because a blocked DNS query means the resolution was not successful; Umbrella returns a sinkhole IP or NXDOMAIN response, preventing the client from reaching the domain. Option B is wrong because internal DNS resolution failures (e.g., server timeout, misconfiguration) would not be logged as 'blocked' by Umbrella; Umbrella blocks based on policy, not internal infrastructure issues. Option C is wrong because network congestion causing timeouts would result in query failures or retransmissions, not a deliberate block count; Umbrella's block count specifically reflects policy-driven denials, not transport-layer timeouts.

Full explanation →
67
Multi-Selecthard

An organization is experiencing repeated SQL injection attacks. A security analyst is tasked with recommending mitigations. Which THREE actions are most effective in preventing SQL injection? (Choose three.)

Select 3 answers
A.Use prepared statements with parameterized queries
B.Disable detailed database error messages in production
C.Use a web application firewall (WAF) to filter malicious requests
D.Implement strict input validation on all user inputs
E.Enforce strong password policies for database accounts
AnswersA, C, D

This is the most effective defense against SQL injection.

Why this answer

Prepared statements/parameterized queries prevent SQL injection by separating code from data. Input validation and stored procedures (if properly parameterized) also help. WAFs can detect and block SQLi attempts.

Disabling error messages prevents information leakage.

Full explanation →
68
MCQmedium

A company is deploying Cisco Web Security Appliance (WSA) to enforce acceptable use policies. Users report that some legitimate websites are being blocked incorrectly. The security team wants to allow these sites while still blocking known malware sites. Which action should the administrator take?

A.Create a custom URL filtering policy to allow the specific URLs.
B.Disable HTTPS decryption to bypass filtering for encrypted sites.
C.Enable Data Loss Prevention (DLP) to allow the sites.
D.Increase the HTTPS decryption depth to inspect more content.
AnswerA

Custom URL filtering policies can whitelist specific URLs while keeping other blocking rules intact.

Why this answer

The Cisco WSA uses URL filtering policies to control access based on URL categories and individual URLs. By creating a custom URL filtering policy that allows the specific URLs, the administrator can whitelist legitimate sites while the WSA continues to block known malware sites through its reputation-based and category-based filtering. This approach maintains security enforcement without disabling broader protections.

Exam trap

Cisco often tests the distinction between URL filtering policies (which control access based on URL categories) and other security features like DLP or HTTPS decryption, leading candidates to confuse content inspection with access control.

How to eliminate wrong answers

Option B is wrong because disabling HTTPS decryption would prevent the WSA from inspecting encrypted traffic, potentially allowing malware to pass through encrypted connections, and it does not address the issue of incorrectly blocked legitimate sites. Option C is wrong because Data Loss Prevention (DLP) is designed to prevent sensitive data from leaving the network, not to allow or block websites based on URL filtering. Option D is wrong because increasing HTTPS decryption depth allows the WSA to inspect more layers of encrypted content, but it does not resolve false positives in URL categorization; it could even increase inspection overhead without fixing the whitelisting need.

Full explanation →
69
MCQmedium

A security analyst notices that a user is receiving a high volume of emails from unknown senders with links to malicious sites. The ESA is configured with Cisco TALOS threat intelligence. Which ESA feature should the analyst configure to block these emails based on the reputation of the sender before they reach the user's inbox?

A.Anti-malware with AMP for Email
B.Outbreak filters
C.DLP policies
D.IronPort SenderBase reputation
AnswerD

SenderBase reputation uses SBRS scores to block low-reputation senders.

Why this answer

The IronPort SenderBase reputation system uses SBRS scores to filter email based on sender reputation, blocking messages from low-reputation senders before delivery.

Full explanation →
70
MCQhard

A user in the Engineering group reports that they cannot access a banking website (https://www.examplebank.com). The website is categorized as 'Financial' by the WSA. Based on the exhibit, what is the most likely cause?

A.The Malware Scanning action is set to 'Scan' but blocks the site
B.The user identification is not configured correctly
C.The Web Reputation threshold of -6.0 is blocking the site due to a low reputation score
D.The Social Networking category is set to 'Monitor' and is blocking the site
AnswerC

If the site's reputation is below -6.0, it will be blocked regardless of URL filtering.

Why this answer

The exhibit shows a Web Reputation threshold of -6.0, meaning any website with a reputation score lower than -6.0 will be blocked. The banking site 'examplebank.com' likely has a low reputation score (e.g., due to being newly registered or hosting malicious content), causing it to fall below the threshold and be blocked. This is the most direct cause because the WSA applies reputation-based filtering before other policies, and the user's inability to access the site aligns with a reputation block rather than a category or scanning issue.

Exam trap

Cisco often tests the distinction between URL category actions (Allow, Block, Monitor) and Web Reputation thresholds, where candidates mistakenly think a category like 'Financial' being allowed means the site is accessible, ignoring that a low reputation score can override category-based policies.

How to eliminate wrong answers

Option A is wrong because Malware Scanning set to 'Scan' does not block sites; it scans traffic for malware and may block only if malware is detected, but the question does not indicate malware presence. Option B is wrong because user identification misconfiguration would affect policy application based on user/group, but the exhibit shows a global reputation threshold that applies regardless of user identity, and the user is in the Engineering group which is not explicitly blocked by any policy shown. Option D is wrong because the Social Networking category is set to 'Monitor', which logs traffic without blocking it; 'Monitor' actions do not deny access, so it cannot be the cause of the block.

Full explanation →
71
Multi-Selecthard

Which TWO of the following are valid action types that can be assigned to a file in an AMP policy rule?

Select 2 answers
A.Scan
B.Monitor
C.Quarantine
D.Block
E.Delete
AnswersC, D

Quarantine moves the file to a secure location and prevents access.

Why this answer

In an AMP policy rule, the valid action types that can be assigned to a file are 'Quarantine' and 'Block'. Quarantine isolates the file to prevent execution or spread, while Block denies access to the file entirely. Both are core enforcement actions in Cisco AMP for Endpoints, used to stop threats based on file reputation or analysis.

Exam trap

Cisco often tests the distinction between 'Monitor' (a detection mode that logs but does not act) and actual enforcement actions like 'Block' or 'Quarantine', leading candidates to incorrectly select 'Monitor' as a valid action.

Full explanation →
72
MCQmedium

An engineer configures a Cisco ASA firewall with three interfaces: inside (security level 100), outside (security level 0), and DMZ (security level 50). Traffic from the inside network to the DMZ network is sourced from 10.1.1.0/24 and destined to 192.168.1.0/24. The inside interface is configured with IP 10.1.1.1, DMZ interface with IP 192.168.1.1. An ACL on the inside interface permits IP traffic from 10.1.1.0/24 to 192.168.1.0/24. What happens when a packet from 10.1.1.10 to 192.168.1.10 arrives at the inside interface?

A.The packet is forwarded because the security levels allow traffic from higher to lower, and an ACL permits it.
B.The packet is dropped because no ACL is applied to the DMZ interface.
C.The packet is dropped because traffic from higher to lower security levels is implicitly denied.
D.The packet is forwarded only if a NAT rule exists for the source address.
AnswerA

Correct. Higher to lower is allowed by default, and the ACL explicitly permits the traffic.

Why this answer

The ASA allows traffic from higher to lower security levels by default, but only if an ACL permits it. Since the inside level (100) is higher than DMZ (50), and the ACL permits the traffic, the packet is forwarded.

Full explanation →
73
MCQeasy

A network engineer is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration includes a crypto map with a matching access list. Which command should be used to verify the security associations and error counters for the IPsec phase?

A.show crypto ipsec sa
B.show crypto engine statistics
C.debug crypto isakmp
D.show crypto isakmp sa
AnswerA

Displays IPsec security associations and packet/error counters.

Why this answer

The 'show crypto ipsec sa' command displays the IPsec security associations (SAs) and their associated packet/byte counters, including error counters such as 'pkts encaps failed' and 'pkts decap failed'. This directly verifies the IPsec Phase 2 SAs and identifies failures in encryption/decryption or integrity checks, which is essential for troubleshooting a tunnel that fails to establish.

Exam trap

Cisco often tests the distinction between IKE Phase 1 (ISAKMP) and IPsec Phase 2 (IPsec SA) commands, so the trap here is that candidates confuse 'show crypto isakmp sa' (Phase 1) with 'show crypto ipsec sa' (Phase 2) when the question specifically asks about IPsec phase verification.

How to eliminate wrong answers

Option B is wrong because 'show crypto engine statistics' shows the overall cryptographic hardware/software engine utilization and throughput, not per-SA IPsec phase details or error counters. Option C is wrong because 'debug crypto isakmp' is a debug command that shows IKEv1/IKEv2 Phase 1 negotiation messages, not the IPsec Phase 2 SA state or error counters; it is disruptive and should not be used for initial verification. Option D is wrong because 'show crypto isakmp sa' displays IKE Phase 1 security associations (ISAKMP SAs), not the IPsec Phase 2 SAs that are established after IKE negotiation completes.

Full explanation →
74
MCQeasy

Which Cisco content security solution uses DNS to block access to malicious domains and provides cloud-based proxy protection?

A.Cisco WSA
B.Cisco ESA
C.Cisco Firepower NGFW
D.Cisco Umbrella
AnswerD

Umbrella provides DNS-layer security and a cloud proxy for web traffic.

Why this answer

Cisco Umbrella is a cloud-delivered security solution that uses DNS to block requests to malicious domains. It also includes a cloud proxy for full URL filtering and threat protection.

Full explanation →
75
MCQeasy

A security analyst is reviewing Snort rule output and sees an alert with the following details: action: alert, protocol: tcp, src: any, dst: any, content: 'malicious'. What type of detection is this rule using?

A.Behavioral detection
B.Heuristic detection
C.Anomaly-based detection
D.Signature-based detection
AnswerD

Correct. The rule matches a specific content string, which is a signature.

Why this answer

The rule uses a specific content pattern 'malicious' to match traffic, which is characteristic of signature-based detection. Signature-based IDS relies on predefined patterns or signatures to identify known threats.

Full explanation →

Page 1 of 14

Page 2

All pages

1234567891011121314

Practice 350-701 by domain

Target a specific domain to shore up weak areas.

Security ConceptsNetwork SecurityCloud SecurityContent SecurityEndpoint Protection and DetectionSecure Network Access, Visibility and Enforcement
See all domains with question counts →