Cisco SCOR / CCNP Security Core 350-701 (350-701) — Questions 901–975

AMP for Endpoints allows file quarantine and remote shell for investigation. Process isolation is not a standard action; endpoint isolation is a separate action.

CSPM tools continuously monitor cloud configurations against security benchmarks and alert on violations like open SSH.

Option C is correct because HTTPS with a valid certificate ensures that the username and password submitted by the guest are encrypted in transit between the browser and the Cisco ISE portal. This prevents man-in-the-middle attacks and credential sniffing, which is critical for a self-provisioned guest portal where users create their own credentials over an untrusted network.

Option B is correct because the current DLP policy action 'Continue (with disclaimer)' allows the email to be delivered after appending a disclaimer, which does not prevent data leakage. Changing the action to 'Drop' will block the email entirely, preventing the credit card data from leaving the organization. This directly addresses the requirement to stop the data leakage.

The file policy may be configured to block files based on file type or other criteria regardless of malware disposition. In this case, the PDF may be blocked by file type restriction, not by malware detection. The Intrusion policy might also generate alerts but not block the file; the file policy is the one blocking.

Cisco Identity Services Engine (ISE) is the correct answer because it provides centralized policy management for both wired and wireless users through a unified, context-aware platform. ISE uses 802.1X, MAC Authentication Bypass (MAB), and posture assessment to enforce access policies based on user identity, device type, and location, integrating with network devices via RADIUS (RFC 2865) and TACACS+ for authentication, authorization, and accounting (AAA).

File policy is used to inspect files, and it can be configured to send SHA-256 hashes to AMP cloud for malware detection. Intrusion policy is for signatures, access control policy for traffic flow, and network discovery for host detection.

Option B is correct because the 'cts role-based sgt' command on a network access device (switch) statically assigns an SGT to an endpoint based on its IP address or MAC address. Option E is correct because ISE can dynamically assign an SGT to an endpoint as part of an authorization policy during authentication, using RADIUS attributes like cisco-av-pair=CTS:SGT=value.

Cloudlock UEBA is the correct answer because it establishes behavioral baselines for user and entity activities, such as S3 bucket replication patterns. When cross-region replication deviates from the learned baseline—e.g., unusual volume, frequency, or destination—UEBA generates an anomaly alert, directly detecting potential data exfiltration. This is a core capability of Cisco Cloudlock's cloud access security broker (CASB) functionality.

Cisco Umbrella is a cloud-based security solution that provides DNS-layer protection to block malicious domains before a connection is established.

SSL stripping is a MITM attack that downgrades HTTPS connections to HTTP by intercepting the initial HTTPS request and maintaining a plaintext connection with the client.

Cisco AMP for Endpoints includes an Intelligent Proxy feature that can inspect and block file downloads based on real-time threat intelligence, even if the website itself is not categorized as malicious by Cisco Umbrella. In this scenario, the user can access the site but the file download is blocked, which aligns with AMP's Intelligent Proxy intercepting the download and determining it to be potentially malicious.

In IaaS, the cloud provider manages the physical infrastructure, virtualization, and network, while the customer manages the operating system, applications, and data.

The 'No route to host' drop on a Cisco ASA indicates that the firewall has no valid route in its routing table to reach the destination IP address of the packet. Option C is correct because a missing static route (or dynamic route) for the destination network prevents the ASA from performing a route lookup, causing it to drop the packet with this specific syslog message. This is a Layer 3 forwarding issue, not a policy or NAT problem.

Application whitelisting, host-based IPS, and EDR capabilities are all endpoint hardening techniques that protect endpoints by controlling what runs, detecting threats, and enabling response.

Orbital Advanced Search is the correct feature because it provides a powerful, query-based search capability across all endpoints managed by Cisco Secure Endpoint. It allows the security team to search for specific file hashes (like SHA256: 8f4a...b2c) across the entire endpoint fleet, identifying any endpoint that has the file present, regardless of whether it has been quarantined or not. This is the only option that enables proactive, organization-wide file discovery beyond simple alert-based or policy-driven actions.

The error 'IPSEC(validate_proposal): transform set proposal mismatch' indicates that the IPsec transform sets proposed by the two peers do not match during IKE phase 2 negotiation. Even if the transform sets appear identical in configuration, a mismatch in the encryption algorithm (e.g., AES-256 vs AES-128) or authentication algorithm (e.g., SHA-1 vs SHA-256) will cause this failure. Since IKE phase 1 completed successfully, the pre-shared key and routing are not the issue, and lifetime mismatches typically generate a different error.

Hardware token generates a one-time passcode (OTP) that the user enters to authenticate.

Multi-domain authentication (MDA) allows a switch port to authenticate multiple devices (e.g., phone and PC) separately, each with its own VLAN.

Session recording of administrative activities (Option B) is a core capability of CyberArk PAM, as it captures and logs all keystrokes, commands, and screen activity during privileged sessions. This recording is stored securely and can be replayed for audit and compliance purposes, integrating with Cisco SecureX for centralized visibility and threat detection.

Option A is correct because the SGT (Security Group Tag) is assigned by ISE via a RADIUS AV (Attribute-Value) pair during the 802.1X authorization phase. The Cisco AV pair 'cts:security-group-tag=15' explicitly instructs ISE to send SGT value 15 in the RADIUS Access-Accept message. Without this AV pair in the authorization profile, ISE defaults to SGT 0 (untrusted/unassigned), even if the user successfully authenticates.

Checkov is a static analysis tool specifically designed to scan Infrastructure as Code (IaC) files like Terraform for security misconfigurations.

In IaaS, the cloud provider manages the physical infrastructure and hypervisor, while the customer manages the operating system, applications, and data.

The ASA requires a static NAT for inbound traffic and an ACL on the outside interface to permit the traffic.

Firepower Device Manager (FDM) is the on-box management interface for a single FTD device. FMC is a centralized management platform for multiple devices.

VTI uses a tunnel interface that is dedicated to the VPN, and the crypto map is applied to the tunnel interface rather than the physical interface. For IKEv2, the tunnel mode is enabled and the crypto map is applied to the VTI.

To block and decrypt HTTPS traffic for specific categories, you need URL filtering, decryption policy, and identity-based policies for granular control.

WCCP (Web Cache Communication Protocol) allows routers to redirect web traffic to the WSA transparently.

D is correct because Cisco ESA includes a Data Loss Prevention (DLP) feature that can scan email content for sensitive data patterns, such as credit card numbers (matching Luhn algorithm and known issuer prefixes). When a match is found, the DLP policy can trigger an encryption action, automatically encrypting the email before delivery to protect the sensitive information in transit.

MAC Authentication Bypass (MAB) allows non-802.1X-capable devices to authenticate based on their MAC address.

The EAP timeout errors and intermittent nature point to the RADIUS timeout being too low on the switch, causing it to drop EAP conversations during periods of high latency. Options A, B, and D would cause consistent failures for affected users, not intermittent issues.

RATs provide remote control, often allowing data exfiltration and keystroke logging. Ransomware encrypts files, and botnets perform DDoS; those are not typical RAT behaviors.

MD5 is a hashing algorithm with known collision vulnerabilities, making it unsuitable for security-sensitive applications like digital signatures.

Cisco AMP's EDR capabilities include file quarantine, process isolation, and remote shell investigation. These allow investigation and containment of threats on endpoints.

Option D is correct because it places Cisco CES (cloud) first in the email flow to handle spam filtering, then forwards the cleaned messages to the on-premises ESA for DLP and encryption before delivery to the internal mail server. This matches the requirement that inbound emails be processed by the cloud first, then the on-premises ESA, with CES acting as the initial SMTP gateway via MX record.

OCSP (Online Certificate Status Protocol) provides real-time revocation status without the overhead of CRLs.

Option A is correct because the `authentication host-mode multi-domain` command allows one device in the voice domain (IP phone) and one device in the data domain (PC) to authenticate on the same switch port. This is the standard Cisco configuration for a phone-PC daisy-chain topology, where the phone acts as a bridge and the switch must distinguish between the two devices using separate VLANs (voice and data).

Option A is correct because the AMP for Endpoints connector policy must be configured to submit files to the on-premises Threat Grid appliance. This directs the endpoint connector to send suspicious files to the local Threat Grid for dynamic analysis instead of the public cloud. Option C is correct because the Threat Grid appliance must be registered in the AMP cloud as a private analysis provider, which creates a secure tunnel (using TLS) between the AMP cloud and the on-premises appliance, enabling file submission and result retrieval.

MACsec (IEEE 802.1AE) provides hop-by-hop encryption, integrity, and authentication at Layer 2 (the data link layer) directly on Ethernet frames. It uses GCM-AES-128 or GCM-AES-256 to encrypt the entire payload and authenticate the frame, ensuring confidentiality and integrity between directly connected switches without requiring IP-layer processing.

The switch logs show 'Authentication failed' messages for MAC addresses in the finance VLAN, and switchport security is enabled. When a switchport security violation occurs (e.g., due to a MAC address limit or an unauthorized MAC address), the port can be configured to error-disable or drop traffic. This explains why users in the finance VLAN cannot reach the server, as the access ports are effectively blocking traffic due to the security violation.

The 'Connection refused' error during peak hours indicates that the Cisco ESA's listener service is actively rejecting new SMTP connections because the configured listener pool has reached its maximum capacity. The 'Pool of listeners' option defines a set of listener processes that handle inbound mail; if the pool size is too small for the traffic volume, new connections are refused. This is a resource exhaustion issue specific to the listener pool, not a service outage or external blocking.

MAC Authentication Bypass (MAB) allows devices that cannot run an 802.1X supplicant to authenticate based on their MAC address. The printer's MAC is used as the credential against the authentication server.

Whaling targets senior executives with personalized attacks.

The condition `"aws:SecureTransport": "true"` in an S3 bucket policy enforces that all requests to the bucket must be made over HTTPS (TLS). This ensures that data in transit is encrypted, preventing man-in-the-middle attacks or eavesdropping. The condition evaluates the `aws:SecureTransport` key, which is `true` only when the request uses SSL/TLS.

Cisco AMP for Endpoints uses advanced endpoint detection capabilities, including behavioral analysis and machine learning, to detect fileless attack techniques such as PowerShell injection. These techniques do not rely on traditional file-based signatures, but AMP monitors process execution, script activity, and memory patterns to identify malicious behavior in real time.

The most likely cause is that IP ACLs on the switch interfaces are overriding the SGACL. In Cisco TrustSec, SGACLs are applied after SGT classification and are evaluated in the forwarding path, but if a traditional IP ACL is configured on the same interface, it is processed first and can permit or deny traffic independently of the SGACL. Since the IP ACLs are present and not configured to match the required policy, they allow traffic on ports other than TCP 443, bypassing the SGACL enforcement.

A NAT exemption rule with 'nat 0' (on ASA 9.x+) or 'nat (inside,outside) source static' with an identity NAT can be used. In modern ASA, 'nat (inside,outside) source static NET NET no-proxy-arp route-lookup' is typical.

Option D is correct because the current policy uses a wildcard file exclusion for the entire FinanceApp folder, which causes the AMP engine to skip scanning all files within that folder, including unknown executables. By changing the exclusion to the exact full path of the legitimate 'app.exe', only that specific file is excluded from scanning, while other unknown executables in the folder remain subject to the 'block' action for unknown files. This allows the known good file to execute without being blocked, while still blocking other unknown files that may be malicious.

When Cisco AMP for Endpoints is in offline mode, the connector cannot communicate with the cloud-based threat intelligence and reputation servers. This prevents it from performing file reputation lookups and retrieving the latest malware signatures, so even known malware samples will not be detected. The connector relies on cloud lookups for real-time detection of new or known threats, and offline mode disables this critical function.

If the security policy does not block the 'Phishing' category, or if the destination is not categorized, the request may be allowed by default.

Encrypted Traffic Analytics (ETA) is the correct feature because it uses machine learning and behavioral analysis to inspect metadata (e.g., flow records, packet lengths, timing) of encrypted traffic without decrypting it. This allows Stealthwatch Cloud to detect anomalies like command-and-control communication or data exfiltration even when the payload is encrypted.

Private connectivity options like Dedicated Interconnect or Partner Interconnect provide direct, private connections to GCP.

Managed identities (such as Azure Managed Identities or AWS IAM Roles for EC2) eliminate the need to store credentials in code or configuration files. The cloud provider automatically rotates the credentials and binds the identity to the compute resource, enforcing least-privilege by granting only the permissions required for that resource to function.

Option B is correct because to enable OSPF MD5 authentication on a Cisco router, the 'ip ospf authentication message-digest' command must be applied under the specific interface. This command tells OSPF to use MD5 (message-digest) authentication for that interface, and it must be paired with an 'ip ospf message-digest-key' command to define the actual key. The authentication type is configured at the interface level, not globally under the OSPF routing process.

Fingerprints are inherent characteristics of a person, placing them in the 'inherence' category (something you are).

Security groups act as virtual firewalls for EC2 instances, and network ACLs provide subnet-level filtering. Security groups are stateful and can be used to allow traffic from web servers to database servers based on source security group. NACLs are stateless and less granular for this purpose.

Option B is correct because the ACE uses the 'ip' protocol to block all traffic from the specific source host 10.1.1.1 to any destination, which is the most comprehensive way to block all IP traffic from that address. In Cisco ASA ACLs, the order of source and destination is 'source destination', so 'deny ip host 10.1.1.1 any' correctly matches packets with source IP 10.1.1.1 and any destination, applied inbound on the outside interface to block traffic entering the network.

When the hash is unknown, the file may be submitted for static or dynamic analysis depending on the disposition. If the hash is unknown, the file may be allowed or blocked based on additional configuration; typically it is allowed pending analysis.

Cisco Secure Cloud Analytics (Stealthwatch) is the correct choice because it provides centralized visibility and threat detection across hybrid cloud environments, including AWS. It integrates with AWS CloudWatch and VPC Flow Logs to ingest network telemetry, and it can correlate alerts from AWS GuardDuty, WAF, and Cognito into a single pane of glass for security operations. This aligns with the CISO's requirement for centralized management and visibility using Cisco's security portfolio.

Cisco Umbrella offers both DNS security and cloud proxy (SIG). Cisco ThousandEyes is for performance, not security. WSA and ESA are on-premises.

When an attacker compromises a legitimate email account within the organization and uses it to send malicious emails, it is an account takeover attack, which is a form of Business Email Compromise (BEC). Since the email authenticated correctly, it bypassed email authentication checks.

In passive mode, the sensor cannot block traffic, but it should still detect and alert. If it's not alerting, perhaps the traffic is not being seen correctly (e.g., due to asymmetric routing or tap issues) or the intrusion policy is not applied correctly. However, given the scenario, a common issue is that passive deployment can miss attacks if traffic is not visible to the sensor.

Option B is correct because Cisco AMP for Endpoints offers a Private Cloud appliance that can be deployed on-premises in an offline environment. This appliance replicates all cloud-based threat intelligence and analysis locally, allowing endpoints to communicate with it via the AMP connector without requiring internet access. The Private Cloud appliance handles all file disposition, retrospective alerts, and policy updates within the local network.

The correct answer is A (NetFlow probe) because when endpoints do not send DHCP requests, the DHCP probe cannot collect any data. The NetFlow probe analyzes network traffic flows to identify endpoints based on IP addresses, ports, and protocols, even without DHCP activity. This allows Cisco ISE to profile endpoints by observing their communication patterns, such as HTTP or DNS traffic, which still occur even if DHCP is not used.

EAP-TLS (Transport Layer Security) is the correct choice because it provides certificate-based mutual authentication, where both the supplicant (Windows laptop) and the authentication server (ISE) present X.509 certificates to verify each other's identity. This meets the requirement for certificate-based authentication and is the only EAP method listed that inherently requires certificates on both sides for mutual authentication.

MAC Authentication Bypass (MAB) is the correct Cisco ISE feature because it allows network access for devices that cannot perform 802.1X, such as IoT devices. MAB works by using the device’s MAC address as the authentication credential; ISE checks the MAC address against an allowed list (e.g., endpoint identity store) and grants or denies access accordingly. This is the standard fallback mechanism for non-802.1X-capable endpoints in a wired or wireless network.