Cisco SCOR / CCNP Security Core 350-701 (350-701) — Questions 676–750

Insider threats often involve unusual access patterns (e.g., accessing sensitive data not needed for the role) and attempts to bypass security controls (e.g., disabling logging).

A high number of messages in the 'Bounced' queue is a classic symptom of a mail loop on a Cisco ESA. When a loop occurs, messages are repeatedly sent back and forth between mail servers, eventually exceeding the maximum hop count or delivery attempts, causing them to be moved to the Bounced queue. This queue specifically holds messages that could not be delivered due to permanent failures, and loops generate many such failures.

AWS WAF uses managed rule groups (e.g., the SQL injection rule group) to detect common attack patterns. Custom rules can also be written but the easiest is to use the managed rule group. NACLs and security groups operate at network level, not application layer.

Checkov is an open-source tool that scans Terraform, CloudFormation, and other IaC templates for security issues.

When integrating Cisco DUO with Azure AD for MFA, the recommended approach is to configure DUO as a secondary authentication provider after Azure AD handles primary authentication. This is achieved by using DUO's Azure AD integration, which acts as a custom control or a conditional access policy that triggers DUO MFA after the user has already authenticated against Azure AD. This ensures that Azure AD remains the identity provider (IdP) for primary authentication, while DUO provides an additional layer of security via a secondary push, phone call, or passcode.

EAP-TLS uses certificates on both the client and server sides for mutual authentication. PEAP-MSCHAPv2 uses server certificate and client credentials (password).

Zero Trust architecture requires continuous verification and least privilege access, never trusting any user or device automatically.

The correct matches are: ip access-group applies ACLs to interfaces; ip inspect enables stateful firewall inspection; crypto map configures IPSec. Common confusions include swapping the functions of 'ip access-group' and 'ip access-list', or misattributing encryption to 'ip inspect'.

In multiple-context mode on a Cisco ASA, inter-context communication (such as allowing a user context to send management traffic to the management context) is achieved by using a shared interface. A shared interface is assigned to multiple security contexts, enabling them to communicate directly without requiring a physical or virtual crossover cable. This design allows the management context to receive traffic from other contexts for monitoring or administrative purposes while maintaining separation of forwarding tables.

In explicit proxy mode, the WSA uses access policies to control web traffic based on URL categories. The administrator should create an access policy that identifies social media traffic and sets the action to 'Block'.

Self-registration is the correct guest access method because it allows guest users to create their own credentials and accept an acceptable use policy (AUP) before being granted internet-only access. Cisco ISE's self-registration portal handles the entire workflow: user provides details, accepts the AUP, and ISE provisions a temporary account with restricted access, typically via a sponsored or direct access policy.

In Cisco FTD access control policy, actions include: TRUST (bypass further inspection), ALLOW (permit with inspection), BLOCK (deny), and INTERACTIVE BLOCK (block with user notification).

Intelligent Proxy allows selective SSL inspection based on policies.

OCSP (Online Certificate Status Protocol) provides real-time revocation status without requiring clients to download a full CRL.

EDR capabilities include file quarantine, process isolation, and remote shell investigation for incident response.

TrustSec requires SGT assignment and SGT-based policies on network devices. Profiling is used to assign SGTs but is not a core component; MAB and 802.1X are authentication methods.

Cisco SecureX integrates with CyberArk to provide just-in-time (JIT) privileged access management.

When using 'decrypt-resign', the FTD generates a new certificate signed by a CA that the organization controls. Clients must trust the organization's CA certificate (root CA) that is used to sign the re-encrypted certificates. Without that, clients will see certificate errors.

Cisco AMP (Advanced Malware Protection) cloud provides threat intelligence including SHA-256 dispositions (clean, malicious, unknown). The FTD queries the AMP cloud for file disposition.

The administrator needs to allow outbound traffic to Office 365, which uses TLS over TCP/443. Since the security group denies all outbound traffic except to specific IP ranges, the most direct and secure method is to add the published Office 365 IP ranges and FQDNs to the allowed list. This ensures the workload can reach the SaaS application without bypassing security controls or introducing additional latency.

Posture assessment checks for compliance with security policies, such as having antivirus software installed and up-to-date, patch levels, and disk encryption enabled.

ARP spoofing allows an attacker to intercept traffic, enabling man-in-the-middle (MITM) attacks.

Cisco Secure Cloud Analytics (Stealthwatch) integrates with AWS Cloud via API to ingest flow logs, VPC logs, and NetFlow, enabling centralized visibility and consistent policy enforcement across hybrid environments. This approach avoids policy fragmentation by applying a unified security analytics layer that can detect anomalies and enforce responses in both AWS and on-premises networks without requiring separate policy management.

The AMP connector's 'IP to Application' mapping telemetry is provided by the Network component, which is separate from the File and Malware components. After a software update, this component may be disabled by default or reset. Enabling the Network component in the AMP connector settings and restarting the service restores the telemetry stream without requiring a full reinstall or policy reload.

CASB provides visibility, DLP, and threat detection for sanctioned and unsanctioned SaaS apps.

In all cloud service models, the customer is always responsible for their own data and access management, including who has access to the data and how it is protected.

Device Trajectory is a core capability of Cisco Threat Response (CTR) that ingests endpoint telemetry from Cisco Secure Endpoint (formerly AMP for Endpoints). It visualizes a timeline of events—such as process executions, file modifications, and network connections—on a specific endpoint, enabling security analysts to quickly reconstruct the sequence of an attack and accelerate detection and response.

The DLP policy uses a regex pattern that expects dashes in the social security numbers (e.g., \d{3}-\d{2}-\d{4}). If the CSV file contained SSNs without dashes (e.g., 123456789), the regex would not match, and no alert would be generated. This is the most likely reason the policy failed to trigger, as the data format did not meet the policy's detection criteria.

B is correct because Security Group Tags (SGTs) are the fundamental building blocks of Cisco TrustSec, used to classify traffic and enforce role-based access control. SGTs can be defined locally on the switch using the 'cts role-based sgt' command or dynamically assigned via a RADIUS server (such as Cisco ISE) during authentication. Without SGTs, the switch cannot perform the source-based or destination-based policy enforcement that TrustSec relies on.

MAC Authentication Bypass (MAB) allows devices that cannot run an 802.1X supplicant to authenticate based on their MAC address, which is sent as the username and password.

Access control rules can be set to 'Allow' with intrusion inspection, 'Allow' without inspection, 'Trust' (bypass inspection), 'Block', or 'Interactive Block'. The question asks for actions regarding intrusion inspection; 'Allow' with inspection, 'Allow' without, and 'Trust' are three possible actions.

In explicit proxy mode, the WSA requires clients to be configured to send traffic to it. If internal websites are not added to the proxy bypass list (or the WSA's PAC file does not direct internal traffic directly), the WSA will attempt to proxy requests for internal sites, which may fail because the WSA cannot route to internal IPs or the internal DNS resolution fails. This is the most likely cause because users can browse the internet (proxied traffic works) but cannot reach internal sites (which should bypass the proxy).

Zero trust assumes no implicit trust; verify every request. MFA, conditional access, and privileged identity management are key components.

Firepower URL filtering can block categories such as 'Social Networking' to prevent access to social media sites.

DHCP Probe analyzes DHCP packet options (e.g., option 55) to identify the device's OS or vendor class, enabling ISE to profile the device type.

Signature-based detection matches known attack patterns; anomaly-based detects deviations from a baseline of normal traffic.

An intermediate CA (subordinate CA) is a CA that is signed by the root CA and issues certificates to end entities, forming a chain of trust.

Cisco Meraki MX appliances have a native, built-in integration with Cisco Umbrella that can be enabled directly from the Meraki dashboard. This integration automatically redirects all DNS traffic from the branch to Umbrella's DNS resolvers (208.67.222.222 and 208.67.220.220) without requiring additional hardware, software, or complex tunnel configurations. It is the simplest and most efficient method for securing DNS traffic when Meraki MX devices are already deployed.

Outbreak Filters leverage TALOS to detect emerging threats in near real-time.

Cisco AMP allows administrators to create custom allow lists using file hashes (SHA-256) to override the file reputation score. Since the file is digitally signed and confirmed legitimate, adding its SHA-256 hash to the AMP custom allow list will permit the download while still scanning other files from that domain, preserving security. This approach directly addresses the false positive without broadly reducing security controls.

Cisco AMP uses retrospective security to continuously analyze file behavior. If a file is later deemed malicious, the Device Trajectory shows its propagation path and actions, allowing for containment and remediation.

The DHCP probe in ISE collects information from DHCP packets, including option 60 (vendor class identifier) and option 12 (hostname), which are used for device profiling.

If the decryption policy excludes certain categories (e.g., Financial), those sites will not be decrypted and will bypass inspection.

Cisco Firepower is an NGFW; Cisco ISE is a NAC; Cisco Umbrella is a cloud security solution; Cisco Stealthwatch is for network security monitoring. Common confusions include swapping Firepower with ISE and Stealthwatch with Firepower.

The correct action is to clear the update cache on the affected endpoints. When endpoints show as 'Out of Date' despite being able to reach the private cloud on TCP 443 and having the correct update policy, the local signature cache is often corrupted or stale. Running `amp_update.exe --clear-cache` forces the connector to discard its cached signature data and download a fresh copy from the private cloud, resolving the update failure without requiring a service restart or policy change.

Traffic from outside (level 0) to DMZ (level 50) is inbound to the DMZ interface, so the ACL should be applied inbound on the outside interface or outbound on the DMZ interface; the standard approach is inbound on the lower security interface.

The Cisco ASA assigns security level 100 to the inside interface, 0 to the outside, and intermediate values for DMZ interfaces.

The ACL is applied inbound on GigabitEthernet0/0 with a single deny statement for source IP 10.0.0.0/8. Since ACLs have an implicit deny any at the end, traffic from the 10.0.0.0/8 range is blocked, but all other IP traffic is implicitly permitted because the explicit deny only matches that source range. This makes option B correct.

MAC Authentication Bypass (MAB) is the correct feature because it allows a device that does not support 802.1X supplicant software to authenticate by using its MAC address as the identity. The switch acts as a proxy, sending the MAC address as the username and password to the RADIUS server, which can then grant or deny access based on the MAC address in its database.

Zero trust relies on strong identity verification: MFA, privileged identity management (PIM) for just-in-time access, and conditional access policies that enforce context-based controls. VPN and network segmentation are network-centric, not identity-centric.

Cisco Cloud Web Security (CWS) with an on-premises connector can integrate with Active Directory via LDAP to perform transparent user identification. This allows the connector to map IP addresses to authenticated user identities without requiring explicit proxy authentication, enabling granular policy enforcement based on AD user or group membership.

Cisco Firepower is an NGFW/IPS, ISE provides identity and access control, and Umbrella is a DNS/cloud security solution. ASA is a stateful firewall, not NGFW; Stealthwatch is for network detection, not endpoint protection.

Ransomware encrypts files and demands a ransom for the decryption key.

The ACL is applied inbound on the interface and contains a single entry that permits TCP traffic from any source to destination 192.168.1.100 on port 80. Because there is an implicit deny all at the end of every standard and extended ACL, only traffic matching this specific permit statement is allowed; all other IP traffic is denied.

Inherence factors are based on biological traits like fingerprints.

Cisco Secure Endpoint (formerly AMP for Endpoints) is the correct answer because it provides cloud-based file reputation and analysis through its Advanced Malware Protection (AMP) cloud. This service uses global threat intelligence and machine learning to analyze file behavior, assign reputation scores, and block or quarantine malicious files on endpoints in real time.

The 'authentication fallback final mab' command includes the 'final' keyword, which configures the switch to authorize the port (place it in the forwarding state) even if MAB fails. In this scenario, both 802.1X and MAB failed, but the 'final' keyword overrides the failure and allows the port to forward traffic. This explains why the device gains network access despite authentication failures.

In IKEv2, IPsec SA parameters like encryption and authentication are defined in a transform set, which is then associated with a crypto map or VTI.

In active/standby failover for FTD, the standby unit monitors the active unit's health via failover link and takes over if the active fails. Configuration synchronization is automatic from active to standby.

To force all outbound internet traffic from the VPC through the on-premises firewall, the VPC route table must have a default route (0.0.0.0/0) pointing to the virtual private gateway (VPG) or transit gateway (TGW) attachment. This directs traffic over the VPN or Direct Connect to the on-premises network, where the security stack inspects it before reaching the internet. The Internet Gateway (IGW) remains present but is not used for this traffic because the route table entry overrides it.

EAP-TLS and PEAP-MSCHAPv2 both support certificate-based authentication, though PEAP-MSCHAPv2 uses certificates for server-side only.

The Cisco Umbrella Secure Internet Gateway (SIG) provides a cloud-delivered firewall that can inspect all traffic (including non-web) and enforce policies without relying solely on DNS blocking.

Zero Trust requires verification for every request regardless of network location, and uses microsegmentation to limit movement.

Active/standby HA with stateful failover syncs connection states. Active/active is typically for routed mode with asymmetric routing.

C is correct because Cisco AMP for Endpoints provides continuous monitoring of file activity and telemetry across endpoints, analyzing behavior in real time to detect threats. This capability ensures that even if a file is initially deemed safe, any subsequent malicious activity is identified and blocked, leveraging cloud-based threat intelligence and analytics.

In Cisco Umbrella, the most immediate way to block a specific malicious domain is to add it to the 'Block List' under the policy's 'Destination Lists'. This list is evaluated in real-time for DNS queries, allowing the administrator to enforce the block without waiting for threat intelligence updates or affecting other policies.

Application Control in Cisco AMP for Endpoints allows administrators to define a whitelist of approved applications by specifying SHA-256 hashes, file paths, or publisher certificates. This feature enforces a 'deny-by-default' policy, blocking any executable not explicitly allowed, which directly meets the requirement to ensure only authorized applications can run on endpoints.

Cisco Cloud Email Security (CES) supports importing configuration files exported from on-premises Cisco ESA, including encryption policies. This ensures consistency by directly transferring the policy definitions without manual re-creation, leveraging the same underlying policy engine and encryption protocols (e.g., TLS, S/MIME, or PGP) used on-premises.

The xlate table holds NAT translations; if no NAT is configured, traffic passes without xlate entries, but connections are still tracked.

The most likely cause is that the RADIUS server (ISE) is not sending the dACL attribute in the Access-Accept packet. Even though the authorization policy applies a dACL, if the RADIUS message does not include the dACL name (e.g., Cisco-AV-Pair = "ip:inacl#100=...") or the switch does not receive it, the switch cannot enforce the filter, leaving the user authenticated but with no internet access due to default deny-all behavior.

A transit VPC with an NGFW instance allows centralized traffic inspection while using BGP dynamic routing to exchange routes between the transit VPC, other VPCs, and the on-premises network. This design minimizes administrative overhead by avoiding static route management and reduces latency by keeping inspection within the cloud, rather than hair-pinning traffic on-premises. BGP enables automatic failover and route propagation, meeting the dynamic routing requirement.