Knowledge + Practice

Cisco SCOR / CCNP Security Core 350-701 (350-701) — Questions 151–225

978 questions total · 14pages · All types, answers revealed

Take a mock exam Exam hub

Page 3 of 14

151

MCQmedium

A company uses Cisco ISE for network access control. They have deployed TrustSec and want to enforce segmentation using Security Group Tags (SGTs). The network team reports that SGTs are not being propagated correctly. Which protocol is responsible for SGT propagation between switches?

A.NETCONF

B.RADIUS

C.CDP

D.SXP

AnswerD

SXP is the protocol designed to exchange SGT mappings between Cisco devices.

Why this answer

SXP (SGT Exchange Protocol) is the protocol used for propagating Security Group Tags (SGTs) between switches that do not support inline tagging. Option A is incorrect because NETCONF is a network configuration protocol and not used for SGT propagation. Option B is incorrect because while RADIUS can carry SGTs in AV pairs from ISE to the network device, it is not used for switch-to-switch propagation.

Option C is incorrect because CDP (Cisco Discovery Protocol) is used for device discovery and not for SGT propagation.

Full explanation →

152

MCQhard

During a phishing simulation, an employee receives an email that appears to be from the CEO requesting an urgent wire transfer. This type of attack is known as:

A.Whaling

B.Business Email Compromise (BEC)

C.Spear phishing

D.Malspam

AnswerB

BEC involves impersonating executives to request money transfers.

Why this answer

Business Email Compromise (BEC) is a targeted attack where the attacker impersonates a senior executive to request fraudulent transfers.

Full explanation →

153

Multi-Selectmedium

A network engineer is configuring Cisco ISE to assign Security Group Tags (SGTs) to endpoints based on their identity and role. Which two components are required for TrustSec SGT classification and enforcement? (Choose two.)

Select 2 answers

A.Cisco AnyConnect client

B.Network devices (switches/firewalls) that enforce SGACLs

C.Cisco AMP for Endpoints

D.Cisco ISE as the policy server

E.Cisco Duo

AnswersB, D

Network devices enforce access based on SGTs using SGACLs.

Why this answer

TrustSec uses SGTs assigned by ISE (policy enforcement point) and enforced by network devices (e.g., switches) that can apply security group ACLs (SGACLs) based on the SGT.

Full explanation →

154

MCQeasy

What is the primary purpose of a digital signature?

A.Encrypt data

B.Generate random numbers

C.Verify the sender's identity and data integrity

D.Compress data

AnswerC

Correct answer. Digital signatures verify identity and integrity.

Why this answer

Digital signatures provide authentication, integrity, and non-repudiation by signing data with a private key.

Full explanation →

155

MCQhard

A company has a hybrid cloud environment with workloads in AWS and Azure, and an on-premises data center. They use Cisco Tetration for micro-segmentation and Cisco CloudCenter for orchestration. Recently, they deployed a new multi-tier application in AWS: a web tier, an application tier, and a database tier, all across multiple Availability Zones. After deployment, the application is unreachable. The security team reviews Tetration policies and finds that a policy is in place to allow traffic between tiers, but the web tier cannot communicate with the application tier. The Tetration agent status shows all agents are healthy. The administrator checks the AWS security groups and notices that the web tier's security group allows inbound HTTP from 0.0.0.0/0, but the application tier's security group does not allow inbound traffic from the web tier's subnet. The application tier's security group only allows inbound traffic from the on-premises CIDR block in error. The network team requests a fix that does not impact other ongoing audits. What should the administrator do?

A.Redeploy the application using Cisco CloudCenter to ensure proper security group association.

B.Configure Tetration to use 'full enforcement' mode for all policies, which overrides AWS security groups.

C.Update the AWS security group for the application tier to allow inbound traffic from the web tier's subnet.

D.Remove the Tetration policy for the application tier to allow all traffic.

AnswerC

Correct: This directly fixes the misconfigured security group blocking traffic.

Why this answer

The root cause is that the AWS security group for the application tier is misconfigured to only allow inbound traffic from the on-premises CIDR block, rather than from the web tier's subnet. Cisco Tetration enforces micro-segmentation policies at the host level via agents, but it does not override or bypass native cloud security groups; both layers must permit the traffic. Updating the security group to allow inbound traffic from the web tier's subnet resolves the connectivity issue without affecting other audits, as it is a targeted, non-disruptive change.

Exam trap

Cisco often tests the misconception that Tetration's micro-segmentation policies can override or bypass cloud-native security groups, when in fact both layers must be correctly configured for traffic to flow.

How to eliminate wrong answers

Option A is wrong because redeploying the application with Cisco CloudCenter would not fix the existing security group misconfiguration; CloudCenter orchestrates deployment but does not automatically correct security group rules that were manually set or incorrectly applied. Option B is wrong because Tetration's 'full enforcement' mode enforces policies at the host level via agents, but it cannot override or bypass AWS security groups, which are enforced at the hypervisor/network level before traffic reaches the instance. Option D is wrong because removing the Tetration policy would disable micro-segmentation for the application tier, potentially exposing it to unauthorized traffic, and would not address the underlying security group misconfiguration that blocks legitimate inter-tier traffic.

Full explanation →

156

MCQmedium

An organization is using Cisco ISE to enforce posture compliance. Endpoints that are non-compliant should be placed into a quarantine VLAN. Which ISE policy component is used to assign the VLAN?

A.Authorization profile

B.Policy set

C.Profiling policy

D.Authentication policy

AnswerA

Authorization profile contains attributes like VLAN ID, dACL, etc.

Why this answer

An Authorization Profile in Cisco ISE defines the enforcement actions to be applied to an endpoint after successful authentication and authorization. When a posture assessment determines an endpoint is non-compliant, the authorization policy can match that condition and return an authorization profile that includes a specific VLAN ID (e.g., quarantine VLAN) via RADIUS attributes such as Tunnel-Private-Group-ID (RFC 2868). This VLAN assignment is a core function of the authorization profile, not of authentication or profiling.

Exam trap

The trap here is that candidates often confuse the role of the Authorization Profile with the Policy Set or Authentication Policy, mistakenly thinking that VLAN assignment is part of the authentication decision rather than a separate authorization action applied after successful authentication.

How to eliminate wrong answers

Option B is wrong because a Policy Set is a container that groups authentication and authorization policies based on conditions like identity source or network device; it does not itself assign VLANs or other enforcement attributes. Option C is wrong because a Profiling Policy is used to identify and classify endpoints based on attributes like MAC OUI or DHCP fingerprint, but it does not enforce network access restrictions such as VLAN assignment. Option D is wrong because an Authentication Policy determines whether a user or device is allowed to access the network (e.g., via credentials or certificate), but it does not define the post-authentication enforcement actions like VLAN placement.

Full explanation →

157

Multi-Selecthard

A company uses AWS and Azure and wants to protect its cloud workloads (VMs and containers) from threats. Which TWO technologies are specifically designed for workload protection in the cloud?

Select 2 answers

A.CWPP (Cloud Workload Protection Platform)

B.CASB

C.Cloud WAF

D.Container image scanning

E.CSPM

AnswersA, D

CWPP provides workload security for VMs and containers.

Why this answer

CWPP (Cloud Workload Protection Platform) is specifically for workload security, and container image scanning is a key component of CWPP for containers.

Full explanation →

158

MCQmedium

A network administrator is configuring NAT on a Cisco ASA to allow internal users to access the internet using a single public IP address. The internal network uses RFC 1918 addresses. Which type of NAT should be configured?

A.Dynamic NAT

B.Static NAT

C.Identity NAT

D.PAT (Port Address Translation)

AnswerD

PAT overloads a single IP by using unique port numbers.

Why this answer

PAT (Port Address Translation) allows many internal IPs to share a single public IP by using unique source ports. Dynamic NAT would require a pool of public IPs, and static NAT provides one-to-one mapping.

Full explanation →

159

MCQhard

A security engineer is configuring a Cisco Firepower Threat Defense (FTD) device managed by FMC. They want to create a rule that blocks access to social media applications regardless of port or protocol. Which policy should be used?

A.Intrusion Policy

B.Prefilter Policy

C.SSL Policy

D.Access Control Policy with Application and URL filtering

AnswerD

Access control policies can include application and URL conditions.

Why this answer

An Access Control Policy with Application and URL filtering is the correct choice because it allows the security engineer to create a rule that blocks social media applications based on application signatures, independent of the port or protocol used. This policy inspects traffic at Layer 7, using the Cisco Firepower application detector database to identify and block applications like Facebook or Twitter even if they use non-standard ports or encryption.

Exam trap

The trap here is that candidates often confuse Prefilter Policy (which is for fast-path or block based on IP/port) with application-level blocking, but Cisco tests that only an Access Control Policy with application filtering can block applications regardless of port or protocol.

How to eliminate wrong answers

Option A is wrong because an Intrusion Policy is designed to detect and prevent network-based attacks using signatures and vulnerabilities, not to block specific applications based on identity. Option B is wrong because a Prefilter Policy operates at Layer 3/4 to fast-path or block traffic based on IP addresses, ports, or protocols, and cannot perform application-level identification to block social media regardless of port. Option C is wrong because an SSL Policy is used to decrypt or inspect encrypted traffic, but it does not contain rules to block applications; application blocking requires an Access Control Policy with application filtering.

Full explanation →

160

MCQhard

A Cisco ISE administrator is configuring guest access with a sponsor portal. Which type of guest account requires approval from a sponsor before network access is granted?

A.Sponsor portal

B.Hotspot guest

C.MAB guest

D.Self-registration

AnswerA

Sponsor portal requires sponsor approval for guest access.

Why this answer

Sponsor portal allows a sponsor to create and approve guest accounts, requiring approval before access.

Full explanation →

161

Matchingmedium

Match each threat type to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Fraudulent emails to steal sensitive info

Malware that encrypts data for ransom

Distributed attack to overwhelm a service

Attacker intercepts communications

Attack on unknown vulnerability

Why these pairings

Correct matches: DDoS = traffic flood, Phishing = fraudulent emails, Malware = malicious software, Ransomware = encryption extortion. Common confusions: associating DDoS with encryption or phishing with traffic overload.

Full explanation →

162

MCQmedium

Which email authentication method allows the domain owner to publish a policy that instructs receiving mail servers on how to handle messages that fail SPF and DKIM checks?

A.DMARC

B.SPF

C.SenderBase

D.DKIM

AnswerA

Correct. DMARC provides a policy framework.

Why this answer

DMARC builds on SPF and DKIM to specify policies (none, quarantine, reject) for failed messages.

Full explanation →

163

MCQmedium

Which Cisco security product provides identity-based access control and policy enforcement for wired and wireless networks?

A.Cisco ISE

B.Cisco Stealthwatch

C.Cisco Firepower

D.Cisco ASA

AnswerA

ISE provides authentication, authorization, and accounting (AAA).

Why this answer

Cisco Identity Services Engine (ISE) is a policy platform for secure access control.

Full explanation →

164

Multi-Selecteasy

A cloud engineer is deploying a web application on AWS and needs to control inbound and outbound traffic at both the instance and subnet levels. Which two AWS security controls should they configure? (Select two.)

Select 2 answers

A.AWS PrivateLink

B.Security Groups

C.AWS WAF

D.AWS Shield

E.Network ACLs (NACLs)

AnswersB, E

Security groups are stateful instance-level firewalls.

Why this answer

Security groups act as instance-level firewalls, and NACLs provide stateless subnet-level filtering.

Full explanation →

165

MCQhard

During a penetration test, an attacker sends a malicious payload to a web application that causes the server to execute arbitrary SQL commands on the backend database. Which type of attack is being performed?

A.Cross-Site Request Forgery (CSRF)

B.Buffer Overflow

C.Cross-Site Scripting (XSS)

D.SQL Injection

AnswerD

SQL injection directly targets the database layer via crafted input.

Why this answer

SQL injection occurs when user input is improperly sanitized and concatenated into SQL queries, allowing attackers to execute arbitrary SQL commands.

Full explanation →

166

MCQeasy

Which deployment mode allows a Cisco Firepower NGFW to inspect traffic without being in the direct forwarding path?

A.Transparent

B.Routed

C.Passive

D.Inline

AnswerC

Passive mode uses a network tap or SPAN port.

Why this answer

Inline deployment is in the path; passive mode (or SPAN) monitors a copy of traffic.

Full explanation →

167

MCQhard

In Cisco Firepower, an access control policy has multiple rules. Rule 1: Allow HTTP from any to any. Rule 2: Block HTTP from 10.0.0.0/8 to any. A packet from 10.0.0.1 to 192.168.1.1 with destination port 80 is inspected. What action is taken?

A.The packet is allowed only if no intrusion policy triggers.

B.The packet is allowed because Rule 1 is matched first.

C.The packet is blocked because Rule 2 is more specific.

D.The packet is blocked and an alert is generated.

AnswerB

Correct. The first matching rule determines the action.

Why this answer

Rules are evaluated top-down. The packet matches Rule 1 first (Allow HTTP), so it is allowed. Even though Rule 2 would block it, Rule 1 is matched first.

Full explanation →

168

Drag & Dropmedium

Drag and drop the steps to configure a Cisco IOS router as a Zone-Based Firewall (ZBF) in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First assign interfaces to zones, then create class-map, policy-map, zone-pair, and apply the policy to the zone-pair.

Full explanation →

169

Multi-Selectmedium

A security team is evaluating cloud security solutions. Which TWO of the following are core capabilities of a Cloud Access Security Broker (CASB)?

Select 2 answers

A.Provisioning and de-provisioning of cloud resources

B.Container image scanning

C.Shadow IT discovery and visibility

D.Intrusion prevention for virtual machines

E.Data loss prevention (DLP) for cloud applications

AnswersC, E

CASBs provide discovery of unauthorized cloud applications.

Why this answer

Shadow IT discovery and visibility is a core CASB capability. CASBs discover unsanctioned cloud applications (Shadow IT) by analyzing network traffic logs, API integrations, or proxy data to identify cloud services used without IT approval, providing visibility into usage, risk posture, and user activity.

Exam trap

Cisco often tests the distinction between CASB capabilities (focused on cloud application security, DLP, and Shadow IT) and other security domains like cloud workload protection (CWPP) or cloud infrastructure security, leading candidates to confuse VM or container security features with CASB functions.

Full explanation →

170

Multi-Selecthard

A security analyst is investigating a malware outbreak that occurred on endpoints protected by Cisco AMP for Endpoints. The malware was initially undetected but later identified as malicious based on new threat intelligence. Which THREE capabilities of AMP allow the analyst to trace the infection and remediate?

Select 3 answers

A.Endpoint IOC scanning

B.SHA-256 file disposition

C.Device Trajectory

D.Exploit Prevention

E.Retrospective security

AnswersA, C, E

IOC scanning searches for indicators of compromise on endpoints.

Why this answer

Device Trajectory shows the timeline of file activity and propagation. Retrospective security allows file disposition to be updated after detection. IOC scanning identifies indicators of compromise on endpoints.

Exploit Prevention is a proactive measure, and SHA-256 disposition is a static verdict.

Full explanation →

171

MCQmedium

A security engineer wants to implement file reputation analysis using Cisco AMP for Endpoints. The policy must block files that are known to be malicious in the cloud and quarantine unknown files for further analysis. Which AMP policy configuration achieves this?

A.Create a policy with File Reputation rules: Malware -> Block, Unknown -> Quarantine.

B.Create a policy with Application Control to block all executables from the internet.

C.Create a policy with File Reputation rules: Malware -> Block, Unknown -> Allow.

D.Create a policy with Custom Detection rules for specific SHA256 hashes only.

AnswerA

This matches the requirement to block known malware and quarantine unknown files.

Why this answer

Cisco AMP for Endpoints File Reputation rules allow granular control over file disposition. Setting 'Malware -> Block' ensures files with a known malicious disposition are prevented from executing, while 'Unknown -> Quarantine' sends files with an unknown disposition to the AMP cloud for retrospective analysis and containment. This directly matches the requirement to block known threats and quarantine unknowns for further analysis.

Exam trap

Cisco often tests the distinction between 'Block' and 'Quarantine' actions in File Reputation rules, where candidates may mistakenly think 'Unknown -> Allow' is acceptable, but the exam requires understanding that unknown files must be quarantined for further analysis, not allowed to execute.

How to eliminate wrong answers

Option B is wrong because Application Control blocks executables based on source (e.g., internet) rather than file reputation or disposition, which does not address the requirement for cloud-based file reputation analysis. Option C is wrong because setting 'Unknown -> Allow' would permit unknown files to execute without quarantine, failing the requirement to quarantine unknowns for further analysis. Option D is wrong because Custom Detection rules based on specific SHA256 hashes only block or detect known hashes, but do not leverage cloud reputation for unknown files or provide dynamic quarantine of unknown dispositions.

Full explanation →

172

MCQeasy

Which security principle ensures that a user or system is granted only the minimum permissions necessary to perform a specific function?

A.Need-to-know

B.Least privilege

C.Separation of duties

D.Defense in depth

AnswerB

Directly refers to granting minimal necessary permissions.

Why this answer

The principle of least privilege dictates that a user, process, or system should be granted only the minimum permissions necessary to perform a specific function. In Cisco security contexts, this is enforced through features like Role-Based Access Control (RBAC) on Cisco IOS devices, where privilege levels (0-15) are assigned to restrict command access, or via TrustSec Security Group Tags (SGTs) that limit traffic flows to only required resources.

Exam trap

Cisco often tests least privilege by pairing it with 'need-to-know' as a distractor, hoping candidates confuse the data-centric 'need-to-know' with the permission-centric 'least privilege' principle.

How to eliminate wrong answers

Option A is wrong because need-to-know is an access control model that restricts access to data based on the user's requirement to know that information to perform their job, but it does not inherently limit the permissions to the minimum necessary for a function; it focuses on data classification and clearance levels, not on the granularity of permissions. Option C is wrong because separation of duties is a security principle that prevents a single individual from having conflicting responsibilities (e.g., both creating and approving a change), which reduces fraud risk, but it does not address the minimization of permissions for a single function. Option D is wrong because defense in depth is a layered security strategy that uses multiple overlapping controls (e.g., firewalls, IPS, VPNs) to protect assets, but it is not a principle that governs the granularity of permissions assigned to a user or system.

Full explanation →

173

Multi-Selectmedium

A company is migrating critical workloads to AWS and wants to ensure secure connectivity between their on-premises network and the VPC. Which TWO actions should be taken to meet this requirement?

Select 2 answers

A.Attach an internet gateway to the VPC and allow all inbound traffic.

B.Configure a security group that allows all traffic from the on-premises network.

C.Provision an AWS Direct Connect connection for a private, dedicated link.

D.Use security groups to allow traffic from the on-premises IP range.

E.Deploy an AWS Site-to-Site VPN connection using IPsec.

AnswersC, E

Direct Connect provides a private, low-latency connection bypassing the internet.

Why this answer

Options C and E are correct. AWS Direct Connect (C) provides a private, dedicated link from on-premises to AWS, bypassing the public internet for consistent latency and enhanced security. AWS Site-to-Site VPN (E) also provides secure connectivity over the internet using IPsec tunnels, offering a more cost-effective alternative.

Both options meet the requirement for secure connectivity between on-premises and the VPC. Options A and D are incorrect because security groups and internet gateways alone do not establish a secure connection; they require an underlying encrypted transport. Option B is vague and not a best practice for secure connectivity.

Exam trap

Cisco often tests the misconception that security groups or network ACLs alone can provide secure connectivity, when in fact they are only access control mechanisms that require an underlying transport (VPN or Direct Connect) to establish the link.

Full explanation →

174

Multi-Selectmedium

A network security engineer is configuring Cisco ASA for remote access VPN using AnyConnect. Which two components must be configured to enable split tunneling? (Choose two.)

Select 2 answers

A.A crypto map that specifies the VPN encryption parameters.

B.An access list that defines the networks to be tunneled or excluded.

C.A group policy that references the split tunneling ACL.

D.A dynamic access policy (DAP) that enforces split tunneling.

E.A tunnel group that defines the VPN connection parameters.

AnswersB, C

The ACL defines which traffic is encrypted.

Why this answer

Split tunneling requires defining an ACL that specifies which traffic goes through the tunnel, and applying that ACL in the group policy. The ACL is configured on the ASA and referenced in the group policy.

Full explanation →

175

MCQeasy

A company is implementing cloud security posture management (CSPM). Which Cisco product provides CSPM capabilities?

A.Cisco Tetration

B.Cisco Firepower

C.Cisco ISE

D.Cisco Cloudlock

AnswerD

Cloudlock provides CSPM and CASB capabilities.

Why this answer

Cisco Cloudlock is the correct answer because it is Cisco's cloud-native cloud security posture management (CSPM) solution. It continuously monitors cloud infrastructure (e.g., AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks, providing automated remediation and visibility into cloud security posture. This directly aligns with the CSPM use case described in the question.

Exam trap

Cisco often tests the distinction between network security products (Firepower, ISE) and cloud-native security tools (Cloudlock), so the trap here is assuming that a well-known network security product like Firepower or ISE can also handle cloud posture management, when in fact CSPM requires a dedicated cloud-integrated solution like Cloudlock.

How to eliminate wrong answers

Option A is wrong because Cisco Tetration is a workload security and micro-segmentation platform for on-premises data centers, not a cloud security posture management tool; it focuses on application dependency mapping and zero-trust segmentation, not cloud configuration monitoring. Option B is wrong because Cisco Firepower is a next-generation firewall (NGFW) and intrusion prevention system (IPS) for network security, not a CSPM solution; it does not provide cloud-native posture assessment or compliance monitoring. Option C is wrong because Cisco ISE (Identity Services Engine) is a network access control (NAC) and policy enforcement platform for on-premises networks, not a cloud security posture management tool; it handles authentication, authorization, and guest access, not cloud configuration auditing.

Full explanation →

176

MCQmedium

A company uses Cisco AMP for Endpoints and also deploys Cisco Firepower Next-Generation Firewall (NGFW) with AMP integration. The security team wants to see endpoint detections in the Firepower Management Center (FMC). What must be configured to enable this integration?

A.Enable the AMP integration in the FMC and ensure the AMP cloud account is configured with the correct API credentials.

B.Configure the AMP connectors to send Syslog events to the FMC.

C.Deploy an on-premises AMP console to forward events to FMC.

D.Configure the Firepower NGFW to be the default gateway for the endpoints.

AnswerA

The integration uses API calls between FMC and AMP cloud to exchange threat intelligence.

Why this answer

Cisco AMP for Endpoints integrates with Firepower Management Center (FMC) via the AMP cloud API. To enable this, the FMC must have the AMP integration enabled and be configured with the correct API credentials (Client ID and API Key) from the AMP cloud console. This allows the FMC to pull endpoint detection events directly from the AMP cloud, correlating them with network-based detections from the Firepower NGFW.

Exam trap

Cisco often tests the misconception that on-premises components or Syslog are required for AMP-FMC integration, when in fact the integration relies solely on cloud-based API credentials and does not involve Syslog or an on-premises AMP console.

How to eliminate wrong answers

Option B is wrong because AMP connectors do not send Syslog events to FMC; AMP for Endpoints uses the cloud-based API for event sharing, not Syslog forwarding. Option C is wrong because AMP for Endpoints is a cloud-managed solution and does not require or support an on-premises console to forward events to FMC; the integration is direct via the AMP cloud. Option D is wrong because configuring the Firepower NGFW as the default gateway for endpoints is unrelated to AMP integration; it would affect network routing but not enable event sharing between AMP and FMC.

Full explanation →

177

MCQhard

A Cisco FTD device is configured with an access control policy that has multiple rules. The first rule is 'Allow' for all traffic from the internal network to the internet. The second rule is 'Block' for traffic from a specific internal host to any destination. However, the administrator notices that the specific host can still access the internet. What is the most likely cause?

A.The block rule is placed after the allow rule.

B.The block rule is not applied to the correct interface.

C.The block rule is configured with 'Trust' action.

D.The block rule has a lower priority than the allow rule.

AnswerA

Correct. The first matching rule is applied; thus the allow rule matches before the block rule.

Why this answer

Access control rules are evaluated in order. The first rule allows all internal traffic, and since rules are processed top-down, the first match applies. The second rule is never reached because the first rule already matched.

To block the specific host, the more specific rule must be placed before the general allow rule.

Full explanation →

178

Multi-Selecthard

A security team is implementing CSPM to ensure cloud compliance. Which three checks would a CSPM tool typically perform? (Choose three.)

Select 3 answers

A.Verifying that EBS volumes are encrypted

B.Checking S3 buckets for public read access

C.Monitoring user behavior analytics

D.Scanning container images for vulnerabilities

E.Ensuring IAM roles follow least privilege

AnswersA, B, E

CSPM checks encryption settings.

Why this answer

CSPM checks cloud configurations against benchmarks like CIS, including public access to storage, encryption settings, and IAM policies.

Full explanation →

179

MCQhard

A network administrator has configured the above on a Cisco switch port for a device that supports both MAB and 802.1X. The device sends an EAPOL-start but the switch responds with an EAP-Request/Identity. The device does not respond to the EAP-Request/Identity. After a timeout, the switch attempts MAB. However, MAB also fails because the RADIUS server does not have the MAC address. Which of the following best describes the final port state?

A.The port will be placed in a critical authentication VLAN

B.The port will be error-disabled due to authentication failure

C.The port will remain in an unauthorized state, blocking all traffic

D.The port will be placed in VLAN 10 with restricted access

AnswerC

With auto port control, failed auth results in unauthorized state.

Why this answer

When 802.1X authentication fails because the device does not respond to the EAP-Request/Identity, and MAB also fails because the RADIUS server lacks the MAC address, the switch port remains in an unauthorized state. This is the default behavior for a port configured with both authentication methods: if neither succeeds, the port stays in the 802.1X unauthorized state, blocking all traffic until a successful authentication occurs or a fallback action (like a critical VLAN) is explicitly configured.

Exam trap

Cisco often tests the distinction between authentication failure and RADIUS server unavailability, where candidates mistakenly assume a guest VLAN or critical VLAN is automatically applied, but these require explicit configuration and are not default behaviors.

How to eliminate wrong answers

Option A is wrong because a critical authentication VLAN is only used when the RADIUS server is unreachable, not when authentication fails due to a missing MAC address or unresponsive client. Option B is wrong because authentication failure does not cause an error-disabled state; error-disable typically results from port security violations or other physical-layer issues, not from 802.1X or MAB failure. Option D is wrong because VLAN 10 is the configured guest VLAN, which would only be applied if the switch were configured to use a guest VLAN as a fallback for failed authentication, but the scenario does not mention any guest VLAN configuration, and the port remains unauthorized by default.

Full explanation →

180

MCQhard

A security team is troubleshooting an incident where a compromised application running in a Kubernetes cluster on AWS EKS is being used to exfiltrate data to an external IP. They have deployed Cisco Secure Workload. How would the agent on the container report the exfiltration attempt?

A.By creating a violation for a policy that denies egress to unknown IPs

B.By generating a syslog alert for outbound traffic

C.By sending a NetFlow export to the controller

D.By blocking the traffic automatically and terminating the pod

AnswerA

Policy violation is the standard reporting mechanism.

Why this answer

Cisco Secure Workload uses a policy-based enforcement model where agents enforce micro-segmentation rules. When a container attempts egress to an external IP not permitted by an explicit allow policy, the agent creates a violation event for the deny rule that blocks unknown destinations. This violation is the primary reporting mechanism for policy violations, including exfiltration attempts.

Exam trap

Cisco often tests the distinction between reporting mechanisms (violation events) and data-plane telemetry (NetFlow, syslog), expecting candidates to know that Secure Workload's primary incident reporting is through policy violation events, not traditional logging or flow exports.

How to eliminate wrong answers

Option B is wrong because Cisco Secure Workload does not rely on syslog for reporting policy violations; it uses its own violation event system and API, not generic syslog alerts. Option C is wrong because NetFlow is a flow-level telemetry protocol used for traffic analysis, not for reporting policy violations; Secure Workload agents do not export NetFlow to the controller. Option D is wrong because Secure Workload can enforce policies to block traffic, but it does not automatically terminate pods; that action would require integration with Kubernetes admission controllers or separate automation.

Full explanation →

181

MCQmedium

A company has deployed Cisco AnyConnect VPN for remote access. They want to enforce that only company-managed devices with compliant antivirus and disk encryption can connect. Which solution should be added to the ASA?

A.Cisco Identity Services Engine (ISE) with posture assessment

B.Cisco Firepower Threat Defense (FTD) with intrusion policy

C.Cisco Umbrella with DNS filtering

D.Cisco Stealthwatch with NetFlow

AnswerA

ISE performs posture checks to ensure devices meet compliance requirements.

Why this answer

Cisco ISE with posture assessment is the correct solution because it integrates with the ASA to enforce endpoint compliance before granting VPN access. Posture assessment checks for specific conditions such as antivirus status, disk encryption, and OS patch levels, ensuring only company-managed devices that meet security policies can connect via AnyConnect.

Exam trap

Cisco often tests the distinction between network security controls (like IPS, DNS filtering, or flow analysis) and endpoint compliance enforcement, leading candidates to confuse a posture assessment requirement with a general security appliance.

How to eliminate wrong answers

Option B is wrong because Firepower Threat Defense (FTD) with intrusion policy focuses on network-based threat detection and prevention (e.g., IPS/IDS), not on endpoint compliance checks like antivirus or disk encryption. Option C is wrong because Cisco Umbrella with DNS filtering provides cloud-delivered security by blocking malicious domains and enforcing web policies, but it does not assess the posture of the connecting device. Option D is wrong because Cisco Stealthwatch with NetFlow is used for network visibility and anomaly detection through flow analysis, not for enforcing endpoint security requirements like antivirus or encryption.

Full explanation →

182

MCQhard

An engineer is troubleshooting an IPsec VPN between two Cisco routers. The tunnel is up, but traffic is not passing. The encryption domain on both sides is correctly configured. What is the most likely cause?

A.Mismatched IPSec transform sets

B.Routing loop

C.ACL on the WAN interface blocking ESP traffic

D.Mismatched IKE phase 1 parameters

AnswerC

ESP traffic (IP protocol 50) may be dropped by an inbound or outbound ACL.

Why this answer

When the IPsec tunnel is up but no traffic passes, the most common cause is that the WAN interface ACL is blocking ESP (protocol 50) or UDP/4500 (NAT-T) traffic. Even though IKE and IPsec SAs are established, if the ACL drops the encrypted packets, the tunnel appears operational but cannot forward data. This is distinct from transform set or IKE mismatches, which would prevent the tunnel from coming up at all.

Exam trap

Cisco often tests the distinction between tunnel establishment (IKE phase 1 and 2) and data-plane forwarding, tricking candidates into thinking a tunnel being 'up' guarantees traffic flow, when in fact ACLs or firewall rules can block the encrypted payload.

How to eliminate wrong answers

Option A is wrong because mismatched IPsec transform sets would prevent the IPsec SAs from being established, causing the tunnel to fail or not come up, not remain up with no traffic. Option B is wrong because a routing loop would cause traffic to be forwarded in a cycle, not simply stop passing; the tunnel being up indicates the routers can communicate, but a loop would manifest as high CPU or TTL expiration, not a silent traffic drop. Option D is wrong because mismatched IKE phase 1 parameters (e.g., encryption, hash, DH group) would prevent IKE phase 1 from completing, so the tunnel would never reach an 'up' state.

Full explanation →

183

MCQhard

A financial services company recently migrated from a legacy web filter to Cisco WSA in explicit proxy mode. The company has 5000 users across three offices, each connected via MPLS. The WSA is deployed in the data center. A week after deployment, users in the remote office report that web pages load extremely slowly, while users in the main office near the data center experience normal speeds. The network team confirms there is no WAN congestion. The WSA administrator checks the logs and sees that the remote users are being authenticated via NTLM and that the WSA's CPU and memory usage are below 50%. However, the number of concurrent connections from the remote office is very high, with many connections in a TIME_WAIT state. What is the most likely cause of the slow web performance for remote users?

A.The WSA's proxy process is overloaded due to high SSL decryption demands.

B.Remote users are using an outdated browser that does not support modern protocols.

C.The WSA is not configured to reuse TCP connections, causing high connection overhead for remote users.

D.NTLM authentication is causing authentication delays over the MPLS link.

AnswerC

Connection reuse reduces latency.

Why this answer

The high number of concurrent connections in TIME_WAIT state indicates that TCP connections are being closed after each request instead of being reused. In explicit proxy mode, the WSA can reuse persistent connections to reduce latency, but if connection reuse is not configured, each HTTP request from a remote user requires a new TCP handshake, which adds significant round-trip time (RTT) over the MPLS link. This overhead explains the slow performance for remote users while main office users, with lower latency, are unaffected.

Exam trap

The trap here is that candidates often attribute slow performance to authentication delays (NTLM) or SSL decryption, but the key clue is the high number of TIME_WAIT connections, which points to TCP connection overhead rather than authentication or encryption processing.

How to eliminate wrong answers

Option A is wrong because the WSA's CPU and memory usage are below 50%, and the issue is not related to SSL decryption demands; the logs show NTLM authentication, not SSL-related problems. Option B is wrong because outdated browser support would cause compatibility issues, not a sudden increase in TIME_WAIT connections and connection overhead after a migration. Option D is wrong because NTLM authentication occurs once per session and does not cause a high number of concurrent connections in TIME_WAIT state; authentication delays would manifest as slow initial logins, not persistent slow page loads.

Full explanation →

184

MCQhard

A security analyst is investigating a malware incident on an endpoint protected by Cisco AMP for Endpoints. The Device Trajectory shows that a file named 'invoice.exe' was detonated from a USB drive. The file's cloud verdict was 'Unknown' at the time of execution. The analyst sees that the file spawned multiple child processes that made outbound connections to a malicious IP. The AMP policy has 'Exploit Prevention' enabled but 'File Reputation' is set to 'Monitor' only. The analyst wants to prevent similar incidents in the future without blocking legitimate applications. Which action should the analyst recommend?

A.Block all execution of applications from removable media via Group Policy.

B.Enable all Exploit Prevention rules, including those for script-based attacks.

C.Add the SHA256 hash of 'invoice.exe' to the global blacklist.

D.Change the File Reputation setting to 'Block' for files with 'Unknown' disposition.

AnswerD

Prevents execution of unknown files while allowing known good files.

Why this answer

Changing the File Reputation setting to 'Block' for files with 'Unknown' disposition would prevent unknown files like 'invoice.exe' from executing in the future, while still allowing files with known good reputations. This balances security with usability. Option A (blocking all USB execution via Group Policy) is too restrictive as it would block legitimate applications from removable media.

Option B (enabling all Exploit Prevention rules) targets exploit techniques, not malware executables like 'invoice.exe'. Option C (adding the hash to a global blacklist) is reactive and would only block that specific hash, not similar unknown files.

Full explanation →

185

MCQhard

A network administrator is configuring Cisco Umbrella for web security. They want to ensure that all DNS requests from branch offices are sent to Umbrella for policy enforcement, but they have limited control over the branch routers. What is the most effective deployment method?

A.Deploy the Umbrella roaming client on endpoints

B.Set up a transparent proxy on the branch routers

C.Configure Umbrella as DNS forwarder on the branch routers

D.Use PAC files on the clients to redirect web traffic

AnswerA

Endpoints send DNS directly to Umbrella, no network changes needed.

Why this answer

The Umbrella roaming client (Option A) is the most effective method because it can be deployed on endpoints to redirect all DNS queries to Umbrella's cloud resolvers, regardless of branch router configuration. This client works at the OS level, intercepting DNS traffic and enforcing policies even when the network path is uncontrolled, making it ideal for scenarios with limited router access.

Exam trap

Cisco often tests the misconception that DNS forwarding or proxy configurations on routers are always the best approach, but the trap here is that the question explicitly states 'limited control over branch routers,' making endpoint-based solutions like the roaming client the only viable option for comprehensive DNS security enforcement.

How to eliminate wrong answers

Option B is wrong because setting up a transparent proxy on branch routers requires administrative control over those routers, which contradicts the constraint of limited control. Option C is wrong because configuring Umbrella as a DNS forwarder on branch routers also demands router-level configuration, and it only redirects DNS traffic, not all web traffic, potentially missing HTTP/HTTPS policy enforcement. Option D is wrong because PAC files only redirect web traffic for browsers that support them, leaving non-browser applications and DNS queries unaffected, and they require client-side configuration that may not be feasible in a limited-control environment.

Full explanation →

186

MCQeasy

On a Cisco ASA, which table holds information about translated addresses for active connections?

A.ARP table

B.Conn table

C.Xlate table

D.Routing table

AnswerC

Correct. The xlate table stores address translation mappings.

Why this answer

The xlate table stores translation entries (NAT translations) for active sessions.

Full explanation →

187

MCQmedium

A company is migrating a web application to AWS and wants to protect against DDoS attacks at the application layer. Which Cisco security solution should they deploy?

A.Cisco Umbrella

B.Cisco WAF (Web Application Firewall)

C.Cisco Firepower NGFW

D.Cisco Stealthwatch

AnswerB

Cisco WAF protects web applications from application-layer DDoS attacks.

Why this answer

A Web Application Firewall (WAF) is the correct solution because it specifically inspects and filters HTTP/HTTPS traffic at the application layer (Layer 7), protecting against DDoS attacks such as HTTP floods, SQL injection, and cross-site scripting. Cisco WAF (often delivered via Cisco Secure Web Application or integrated with AWS WAF) can rate-limit requests, block malicious payloads, and enforce positive security models to mitigate application-layer DDoS. This directly addresses the requirement to protect a web application migrating to AWS against Layer 7 attacks.

Exam trap

The trap here is that candidates often confuse a network-layer DDoS mitigation solution (like Firepower NGFW or Umbrella) with an application-layer WAF, failing to recognize that only a WAF provides the deep HTTP inspection and rate-limiting needed for Layer 7 attacks.

How to eliminate wrong answers

Option A is wrong because Cisco Umbrella is a cloud-delivered DNS-layer security solution that protects against malicious domains and phishing, but it does not inspect application-layer HTTP traffic or mitigate DDoS attacks at Layer 7. Option C is wrong because Cisco Firepower NGFW is a network firewall that operates primarily at Layers 3 and 4, with some Layer 7 capabilities via IPS, but it is not optimized for web application-specific DDoS mitigation and lacks the granular HTTP inspection and rate-limiting features of a dedicated WAF. Option D is wrong because Cisco Stealthwatch is a network visibility and analytics tool that uses NetFlow/IPFIX to detect anomalies and threats, but it does not actively block or mitigate application-layer DDoS attacks; it is a detection-only solution.

Full explanation →

188

MCQhard

An enterprise migrated its e-commerce application to AWS. They use Cisco Secure Workload (Tetration) for microsegmentation. After enabling enforcement, legitimate traffic between the web tier and database tier is being blocked. The security team verified that the policy allows the traffic based on labels. The Tetration console shows the enforcement mode as 'active blocking'. The database server is in a different VPC, and the web server is in a public subnet. The agents are running on both workloads and report correctly. Which configuration step is most likely missing?

A.The cloud connector (e.g., AWS cloud connector) is not configured

B.The enforcement scope does not include the VPC peering connection

C.The application dependency mapping needs to be refreshed

D.The agents on the database server are not running

AnswerA

Cloud connector provides metadata that allows Tetration to understand cloud networking and apply policies correctly across VPCs.

Why this answer

Cisco Secure Workload (Tetration) relies on cloud connectors to synchronize cloud infrastructure metadata (e.g., VPCs, subnets, instances) and enforce microsegmentation policies across VPC boundaries. Without a configured AWS cloud connector, Tetration cannot discover or enforce policies on resources in a different VPC, even if agents are running and labels are correctly assigned. The 'active blocking' enforcement mode indicates the policy is being applied, but the missing connector prevents the policy from being properly mapped to the database server in the separate VPC, causing legitimate traffic to be blocked.

Exam trap

Cisco often tests the misconception that agents alone are sufficient for policy enforcement across VPCs, when in fact the cloud connector is required to bridge the cloud infrastructure metadata gap.

How to eliminate wrong answers

Option B is wrong because the enforcement scope in Tetration is defined by labels and agent groupings, not by VPC peering connections; VPC peering is a network-layer construct that Tetration does not directly manage or require for policy enforcement. Option C is wrong because application dependency mapping is used for visibility and policy recommendation, not for the active enforcement of existing policies; refreshing it would not resolve a connectivity issue caused by a missing cloud connector. Option D is wrong because the question explicitly states that agents are running on both workloads and report correctly, so the agents are not the problem.

Full explanation →

189

Multi-Selecthard

Which THREE attributes can be used in an ISE authorization policy based on endpoint identity?

Select 3 answers

A.Certificate subject DN

B.AD user group

C.Time of day

D.Switch IP address

E.Device MAC address

AnswersA, B, E

Subject DN from a client certificate identifies the endpoint or user.

Why this answer

Options A, B, and E are correct because endpoint identity attributes include the device's MAC address, its certificate subject DN (from certificates), and its Active Directory user group membership. Option C is incorrect because time of day is an environmental attribute, not an endpoint identity attribute. Option D is incorrect because switch IP address is a network location attribute, not endpoint identity.

Full explanation →

190

MCQeasy

Based on the exhibit, what does the 'Isolated: Yes' status indicate?

A.The connector is disconnected from the cloud and requires a reboot.

B.The connector is in a quarantine mode due to a loss of cloud connectivity.

C.The connector is permanently blocked by a firewall and needs manual reconfiguration.

D.The network component is disabled, preventing network traffic monitoring.

AnswerB

'Isolated' indicates the connector cannot reach the cloud but continues to protect with local rules.

Why this answer

In Cisco AMP (Advanced Malware Protection) for Endpoints, the 'Isolated: Yes' status indicates that the connector has entered quarantine mode because it has lost connectivity to the AMP cloud. This is a security feature that prevents the endpoint from communicating with other hosts on the network while still allowing outbound traffic to the cloud for reconnection attempts. The connector remains functional but isolated to contain potential threats until cloud connectivity is restored.

Exam trap

Cisco often tests the misconception that 'Isolated: Yes' means the connector is completely disabled or blocked by a firewall, when in fact it is a deliberate quarantine mode triggered by loss of cloud connectivity, not a permanent failure.

How to eliminate wrong answers

Option A is wrong because the connector is not disconnected from the cloud; it has lost connectivity, which triggers isolation, and a reboot is not required to resolve the issue—re-establishing cloud connectivity will automatically lift isolation. Option C is wrong because the connector is not permanently blocked by a firewall; isolation is a temporary, software-enforced state that can be cleared once connectivity is restored, and manual reconfiguration is not needed unless a persistent firewall rule is the root cause. Option D is wrong because the network component is not disabled; the connector still monitors traffic and enforces policies, but it restricts communication to other hosts while in isolation mode.

Full explanation →

191

MCQhard

During an email security audit, it is discovered that some phishing emails are passing through the Cisco ESA. Analysis shows the emails have valid SPF and DKIM signatures but are classified as phishing. What additional Cisco ESA feature should be tuned to improve detection?

A.Disable SPF checking

B.Increase the SBRS threshold

C.Enable DMARC with reject policy

D.Reduce DLP scanning sensitivity

AnswerC

DMARC can reject emails that fail alignment even if SPF/DKIM pass.

Why this answer

Even with valid SPF/DKIM, phishing can occur if the domain is compromised. Tuning anti-spam or outbreak filters can help, but DMARC can provide additional protection by enforcing alignment.

Full explanation →

192

MCQeasy

Which type of VPN on Cisco ASA is typically used for site-to-site connectivity and encrypts all traffic between two sites?

A.IKEv2 IPsec site-to-site VPN

B.L2TP VPN

C.DTLS VPN

D.SSL VPN

AnswerA

Correct. IKEv2 IPsec is used for site-to-site VPNs.

Why this answer

IKEv2 IPsec site-to-site VPN encrypts traffic between two gateways.

Full explanation →

193

MCQmedium

A remote user is unable to connect to the corporate VPN using Cisco AnyConnect. The user has internet access and can reach the ASA's public IP. The ASA administrator checks and sees that the remote access VPN configuration is correct. What is the most likely client-side issue?

A.The client is using an outdated version of AnyConnect.

B.The client's DNS is not resolving the VPN hostname.

C.The client's firewall is blocking TCP port 443.

D.The client's certificate is expired or not trusted.

AnswerD

Certificate authentication failure is a common cause when ASA configuration is correct.

Why this answer

The user can reach the ASA's public IP and has internet access, which rules out basic connectivity issues. Since the ASA's VPN configuration is correct, the problem is likely on the client side. A common cause is an expired or untrusted certificate, as AnyConnect uses certificate-based authentication for the SSL/TLS handshake; if the client does not trust the server's certificate or the client's own certificate is expired, the VPN tunnel will fail to establish.

Exam trap

Cisco often tests the distinction between network-layer reachability (IP connectivity) and application-layer authentication (certificate trust), leading candidates to incorrectly choose firewall or DNS issues when the user can already reach the ASA's IP.

How to eliminate wrong answers

Option A is wrong because an outdated AnyConnect version typically causes feature incompatibility or connection failures only if the ASA requires a specific minimum version, but the question states the ASA configuration is correct and does not mention version mismatch; the user can reach the ASA's public IP, so the client is likely running a supported version. Option B is wrong because the user can reach the ASA's public IP directly, meaning DNS resolution is not required for the connection; if the hostname were used, DNS failure would prevent reaching the IP, but the user has already reached the IP. Option C is wrong because TCP port 443 is the default HTTPS port for AnyConnect SSL VPN; if the client's firewall were blocking TCP 443, the user would not be able to reach the ASA's public IP (since HTTPS traffic uses port 443), but the user can reach the IP, indicating port 443 is open.

Full explanation →

194

MCQmedium

In AWS, which resource acts as a stateful firewall at the instance level to control inbound and outbound traffic?

A.Network ACL

B.Internet Gateway

C.VPC Flow Logs

D.Security Group

AnswerD

Security groups are stateful instance-level firewalls.

Why this answer

Security groups in AWS are stateful firewalls that operate at the instance level, while NACLs are stateless at the subnet level.

Full explanation →

195

MCQmedium

An organization uses Cisco ESA to enforce DLP policies. Which of the following is an example of a DLP policy that can be configured on the ESA?

A.Scanning for credit card numbers in outbound email

B.Blocking email attachments over 10 MB

C.Quarantining messages with malware

D.Filtering spam based on SenderBase reputation

AnswerA

Correct. DLP policies identify sensitive data like credit card numbers.

Why this answer

DLP policies on ESA scan for patterns like credit card numbers, SSNs, etc., in outbound email to prevent data leaks.

Full explanation →

196

MCQmedium

A network architect is designing a DMZ for a web server farm. The ASA firewall will have three interfaces: inside (level 100), DMZ (level 50), and outside (level 0). They want to allow HTTP traffic from the internet to the DMZ web servers and also allow the web servers to initiate connections to the inside for database updates. What is the minimal ACL configuration to achieve this?

A.ACL on outside interface inbound permitting HTTP to DMZ; ACL on inside interface inbound permitting database traffic from DMZ.

B.No ACL needed because traffic from higher to lower is implicitly allowed.

C.ACL on inside interface inbound permitting HTTP to DMZ; ACL on DMZ interface inbound permitting database traffic to inside.

D.ACL on outside interface inbound permitting HTTP to DMZ; ACL on DMZ interface inbound permitting database traffic to inside.

AnswerD

Correct. Allows inbound HTTP from outside to DMZ, and outbound database from DMZ to inside.

Why this answer

Traffic from higher to lower security is implicitly allowed, so from inside (100) to DMZ (50) is allowed by default. Traffic from DMZ (50) to inside (100) is blocked by default, so an ACL on the DMZ interface inbound (or inside interface outbound) is needed to permit the database updates. For traffic from outside (0) to DMZ (50), it is from lower to higher, so an ACL on the outside interface inbound is needed to permit HTTP.

Full explanation →

197

MCQeasy

A security administrator is tasked with implementing a solution that provides single sign-on (SSO) for users accessing multiple enterprise applications. The solution must support SAML 2.0 and integrate with the existing Microsoft Active Directory. Which component is essential for this architecture?

A.Certificate Authority (CA)

B.RADIUS server

C.Identity Provider (IdP)

D.Service Provider (SP)

AnswerC

The IdP authenticates users and generates SAML assertions for SSO.

Why this answer

An Identity Provider (IdP) is the essential component that authenticates users against Microsoft Active Directory and issues SAML 2.0 assertions to enable single sign-on (SSO) across multiple enterprise applications. The IdP acts as the trusted source of identity, validating credentials and generating signed SAML tokens that Service Providers (SPs) accept without requiring separate logins.

Exam trap

Cisco often tests the distinction between the IdP and SP roles in SAML, and the trap here is that candidates mistakenly choose 'Service Provider' thinking it is the main component for SSO, when in fact the IdP is the central authentication authority that enables SSO across multiple SPs.

How to eliminate wrong answers

Option A is wrong because a Certificate Authority (CA) issues and manages digital certificates for encryption and signing, but it does not perform user authentication or issue SAML assertions, so it is not the core component for SSO with SAML 2.0. Option B is wrong because a RADIUS server provides AAA services for network access (e.g., VPN, wireless) using protocols like EAP, but it does not natively support SAML 2.0 or act as an identity provider for web-based SSO. Option D is wrong because a Service Provider (SP) is the application or resource that consumes SAML assertions to grant access, but it relies on an IdP to perform authentication and generate the assertions, making the IdP essential for the architecture.

Full explanation →

198

MCQhard

A network administrator notices that users in the finance department are unable to access a legitimate business web application that uses custom port 8443. The WSA is configured with a decryption policy that decrypts all traffic on port 443. What is the most likely cause of the issue?

A.The decryption policy is not applied to port 8443, so the WSA treats it as non-decrypted traffic which may be blocked by default

B.The WSA is configured with a time-based access rule that only allows access during business hours

C.The WSA cannot decrypt traffic on port 8443, causing a certificate mismatch

D.The web application is blocked by an identity-based access policy

AnswerA

Default access policies often block non-decrypted or non-standard ports unless explicitly allowed.

Why this answer

The WSA's decryption policy is configured to decrypt traffic only on port 443 (HTTPS). Since the finance department's web application uses custom port 8443, the traffic is not subject to decryption. By default, the WSA may block non-decrypted traffic that matches certain security or access policies, or it may treat it as untrusted, leading to access failure.

The most likely cause is that the decryption policy does not cover port 8443, so the WSA applies a default action (often block) to non-decrypted traffic.

Exam trap

Cisco often tests the misconception that decryption policies automatically apply to all HTTPS traffic regardless of port, when in fact they are port-specific and require explicit configuration for non-standard ports.

How to eliminate wrong answers

Option B is wrong because time-based access rules would affect access regardless of port, but the issue is specific to port 8443 not being decrypted, not a time restriction. Option C is wrong because the WSA does not attempt to decrypt traffic on port 8443; it simply does not apply decryption, so no certificate mismatch occurs. Option D is wrong because identity-based access policies would block based on user or group, not specifically due to the port mismatch; the core problem is the decryption policy scope, not identity.

Full explanation →

199

Multi-Selectmedium

An organization wants to implement multi-factor authentication (MFA) for VPN access using Cisco AnyConnect and Duo. Which TWO authentication factors can Duo provide? (Choose two.)

Select 2 answers

A.TOTP

B.LDAP

C.Push notification

D.802.1X

E.RADIUS

AnswersA, C

Time-based one-time password from an authenticator app.

Why this answer

Duo provides TOTP (Time-based One-Time Password) as an authentication factor by generating a temporary six-digit code based on RFC 6238, which the user enters during the AnyConnect VPN login process. Push notification is another Duo factor, where a request is sent to the user's registered mobile device, and the user approves or denies the login attempt via the Duo Mobile app. Both factors satisfy the requirement for multi-factor authentication by adding a second layer beyond the primary password.

Exam trap

Cisco often tests the distinction between authentication factors (like TOTP and push) and authentication protocols (like RADIUS and LDAP), leading candidates to mistakenly select protocols as factors.

Full explanation →

200

MCQhard

A security engineer is investigating a suspicious process on an endpoint. Using Cisco Secure Endpoint, which EDR capability allows the engineer to isolate the process and prevent it from executing further?

A.File quarantine

B.IOC scanning

C.Remote shell

D.Process isolation

AnswerD

Process isolation stops and blocks the process.

Why this answer

Cisco Secure Endpoint provides EDR capabilities including process isolation, which terminates and prevents the process from running again.

Full explanation →

201

MCQmedium

Which Cisco security product is primarily used for endpoint threat detection and retrospective security?

A.Cisco ESA

B.Cisco AMP for Endpoints

C.Cisco Firepower

D.Cisco WSA

AnswerB

Correct answer. AMP for Endpoints provides endpoint threat detection.

Why this answer

Cisco AMP (Advanced Malware Protection) provides endpoint protection with retrospective analysis and threat detection.

Full explanation →

202

MCQmedium

An organization uses Cisco Umbrella's Secure Internet Gateway (SIG). Which of the following sets of capabilities is typically included in a SIG solution?

A.Intrusion prevention system (IPS)

B.DLP for data at rest

C.DNS-layer security only

D.Cloud-delivered firewall and web proxy

AnswerD

Correct. A Secure Internet Gateway typically includes cloud-delivered firewall and web proxy as core capabilities to secure internet traffic.

Why this answer

The correct answer is D, which lists two core capabilities of a Secure Internet Gateway (SIG): cloud-delivered firewall and web proxy. Options A, B, and C are incorrect because A (IPS) is often a separate security function, B (DLP for data at rest) is not typically part of a SIG (DLP for data in motion may be included), and C (DNS-layer security only) is a subset but not the full SIG capability.

Full explanation →

203

Multi-Selecteasy

Which TWO of the following are common causes of email delivery delays in Cisco Email Security Appliance (ESA)? (Select exactly two.)

Select 2 answers

A.Too many recipients in a single message

B.High volume of email in the delivery queue

C.Slow response from the destination mail server during SenderBase reputation check

D.Incorrect MX record for the destination domain

E.Improper SPF record on the sender's domain

AnswersB, C

Causes queuing delays.

Why this answer

A high volume of email in the delivery queue indicates that the ESA is experiencing a backlog of messages awaiting delivery. This can occur due to rate limiting, transient delivery failures, or a large number of messages being processed simultaneously, which directly causes delays in email delivery as the queue must be drained sequentially.

Exam trap

Cisco often tests the distinction between causes of delays (e.g., queue buildup or slow external responses) versus causes of permanent failures (e.g., incorrect MX records) or authentication issues (e.g., SPF), leading candidates to confuse delivery failures with delays.

Full explanation →

204

MCQhard

A company is using Cisco ISE for guest access. They have configured a guest portal with a self-registration page. Some guests report that after registering, they are not redirected to the success page but instead see a '401 Unauthorized' error. What is the most likely cause?

A.The ISE node is not configured for HTTP redirect.

B.The guest portal certificate is not trusted by the client.

C.The central web authentication (CWA) is not enabled on the switch.

D.The authorization policy for guests is missing.

AnswerC

Without CWA, the switch does not redirect HTTP traffic to ISE, causing a 401 unauthorized error.

Why this answer

Central web authentication (CWA) must be enabled on the switch to redirect HTTP traffic from unauthenticated guests to the ISE portal. If CWA is not enabled, the switch will not redirect the traffic, resulting in a 401 Unauthorized error after registration. Option A is incorrect because HTTP redirect is configured on the ISE portal itself, not the ISE node, and is not the cause of a 401 error.

Option B is incorrect because an untrusted portal certificate would cause a browser security warning, not a 401 error. Option D is incorrect because a missing authorization policy would typically result in an 'Access Denied' message after authentication, not a 401 during the registration redirect.

Full explanation →

205

MCQmedium

A company wants to implement software-defined segmentation using Cisco ISE and TrustSec. Which component is responsible for assigning the Security Group Tag (SGT) to packets at the ingress?

A.Endpoint with posture agent

B.Firewall with IPS capability

C.Cisco ISE Policy Service Node

D.Cisco Catalyst switch with CTS

AnswerD

Ingress switch classifies and tags packets with SGT.

Why this answer

The Cisco Catalyst switch with Cisco TrustSec (CTS) is responsible for assigning the Security Group Tag (SGT) to packets at the ingress. When a packet enters the network, the switch performs a lookup based on the source identity (e.g., IP address, user, or device) against the SGT mapping received from Cisco ISE, and then tags the packet with the appropriate SGT using the SGT header (Cisco proprietary, often carried in the MACsec or VXLAN header). This inline tagging at the ingress switch is the core mechanism of software-defined segmentation in TrustSec.

Exam trap

Cisco often tests the distinction between the policy decision point (ISE) and the enforcement point (switch/router), so the trap here is that candidates mistakenly think ISE itself assigns the SGT to packets, when in fact ISE only provides the classification rules while the ingress switch performs the actual tagging.

How to eliminate wrong answers

Option A is wrong because an endpoint with a posture agent can report the endpoint's security posture to ISE, but it does not assign SGTs to packets at the network ingress; SGT assignment is a network device function. Option B is wrong because a firewall with IPS capability inspects and filters traffic based on security policies, but it is not the device that tags packets with SGTs at the ingress; firewalls typically enforce policies based on SGTs already assigned by a switch or router. Option C is wrong because the Cisco ISE Policy Service Node (PSN) is the policy decision point that defines SGT-to-identity mappings and distributes them to network devices, but it does not perform the actual packet tagging at the ingress; that is the role of the enforcement device (e.g., switch).

Full explanation →

206

MCQmedium

A network administrator is troubleshooting why users in the marketing department cannot access a specific cloud storage site through the Cisco WSA. The access policy for marketing is set to 'Monitor' for the File Sharing category, but the site is blocked. What is the most likely reason?

A.Web reputation threshold is set to block the site.

B.The site is mis-categorized as an unknown URL.

C.A more specific identity or policy is applying a block action.

D.URL filtering is disabled for that policy.

AnswerC

For example, a time-based or user-specific policy may override.

Why this answer

Cisco WSA applies policies in a hierarchical order, and a more specific identity or policy (e.g., one based on user group, subnet, or time range) can override a broader policy set to 'Monitor'. Even though the marketing department's access policy is configured to monitor the File Sharing category, a more granular rule may explicitly block the cloud storage site, causing the unexpected block.

Exam trap

The trap here is that candidates assume a policy set to 'Monitor' for a category will always allow traffic, forgetting that Cisco WSA's policy evaluation uses a first-match model where more specific policies can override broader ones.

How to eliminate wrong answers

Option A is wrong because the web reputation threshold is a separate security measure that evaluates the risk score of a URL; if it were blocking the site, the action would be based on reputation, not the File Sharing category policy. Option B is wrong because if the site were mis-categorized as an unknown URL, it would fall under the 'Uncategorized URLs' category, not the File Sharing category, and the policy for marketing would need to explicitly handle that category. Option D is wrong because URL filtering being disabled for that policy would mean no category-based actions apply at all, so the site would not be blocked by a category action; instead, it would be allowed or handled by other mechanisms.

Full explanation →

207

MCQmedium

An engineer is designing a cloud security solution using Cisco SD-WAN with cloud on-ramp. They want to ensure that traffic to a specific IaaS provider is inspected by the Cisco Umbrella SIG. Which configuration is necessary on the SD-WAN edge?

A.Configure a service insertion policy for the cloud security provider

B.Apply a DNS security policy

C.Set up a site-to-site VPN to the IaaS

D.Enable direct internet access for the branch

AnswerA

Service insertion redirects traffic to the cloud security service for inspection.

Why this answer

To direct specific traffic to Cisco Umbrella SIG for cloud security inspection, you must configure a service insertion policy on the SD-WAN edge. This policy intercepts traffic based on match criteria (e.g., destination IaaS provider IP/subnet) and forwards it to the cloud security service via a secure tunnel (e.g., IPsec or TLS). Without this policy, the SD-WAN edge will not redirect traffic to Umbrella for inspection.

Exam trap

Cisco often tests the distinction between DNS-layer security (Umbrella DNS) and full proxy-based SIG inspection; candidates mistakenly think DNS security alone provides the same traffic inspection as a service insertion policy.

How to eliminate wrong answers

Option B is wrong because DNS security policy only enforces DNS-layer filtering (e.g., blocking malicious domains) but does not redirect traffic to Umbrella SIG for full HTTP/HTTPS inspection. Option C is wrong because a site-to-site VPN to the IaaS provider would send traffic directly to the IaaS without passing through Umbrella SIG, bypassing cloud security inspection. Option D is wrong because enabling direct internet access (DIA) for the branch allows traffic to exit locally without being steered to the cloud security service; DIA alone does not enforce SIG inspection.

Full explanation →

208

Multi-Selectmedium

A security administrator is deploying a Cisco ASA in a DMZ architecture. The inside interface is security 100, outside interface is security 0, and DMZ interface is security 50. Which TWO statements about traffic flow are correct?

Select 2 answers

A.Traffic from DMZ to outside is denied by default.

B.Traffic from inside to DMZ is allowed by default.

C.Traffic from outside to inside is allowed by default without ACL.

D.Traffic from inside to outside is allowed by default.

E.Traffic from DMZ to inside is allowed by default.

AnswersB, D

Inside security 100 > DMZ security 50.

Why this answer

Traffic from higher to lower security levels is allowed by default; lower to higher requires ACLs. Also, traffic from inside to DMZ is allowed, but return traffic is allowed due to stateful inspection.

Full explanation →

209

MCQmedium

A company uses Azure and wants to restrict network traffic between subnets. Which Azure resource should they use?

A.Network Security Group (NSG)

B.Azure DDoS Protection

C.Azure Policy

D.Azure Firewall

AnswerA

Correct. NSGs filter traffic between subnets.

Why this answer

Network Security Groups (NSGs) filter traffic between subnets based on rules.

Full explanation →

210

MCQeasy

Which authentication factor relies on something the user is, such as a fingerprint or retina scan?

A.Knowledge

B.Possession

C.Inherence

D.Location

AnswerC

Inherence factors are biometrics, such as fingerprints or iris patterns.

Why this answer

Inherence factors are biometric characteristics unique to the user.

Full explanation →

211

Drag & Dropmedium

Drag and drop the steps to troubleshoot an IPsec VPN failure where Phase 1 is not completing into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start with reachability, then check UDP 500, compare IKE proposals, verify pre-shared keys, and finally use debug for detailed errors.

Full explanation →

212

Multi-Selecthard

An engineer is deploying Cisco ISE for posture assessment. Which THREE conditions can ISE check during posture assessment before granting full network access? (Choose three.)

Select 3 answers

A.Patch level

B.SSID

C.Disk encryption status

D.Antivirus status

E.Device MAC address

AnswersA, C, D

Checks for missing critical patches.

Why this answer

ISE posture assessment can check antivirus status, patch level, and disk encryption status to ensure endpoint compliance.

Full explanation →

213

Multi-Selecthard

A company is designing a remote access VPN solution using Cisco ASA with load balancing. Which three features are essential for high availability and redundancy? (Choose three.)

Select 3 answers

A.Failover

B.Object tracking

C.Split tunneling

D.AnyConnect profiles

E.Clustering

AnswersA, B, E

Failover provides active/standby redundancy, ensuring seamless failover if the active unit fails.

Why this answer

Failover is essential for high availability in Cisco ASA remote access VPN solutions. It allows a standby ASA to take over seamlessly if the primary unit fails, maintaining VPN sessions and ensuring uninterrupted remote access. This is achieved through stateful or stateless failover, where configuration and connection state are synchronized between the paired units.

Exam trap

Cisco often tests the distinction between features that provide redundancy (failover, clustering, object tracking) versus features that improve user experience or configuration convenience (split tunneling, AnyConnect profiles), leading candidates to mistakenly select the latter.

Full explanation →

214

MCQmedium

An organization uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which cloud security solution should be deployed?

A.Cloud Access Security Broker (CASB)

B.Web Application Firewall (WAF)

C.Cloud Security Posture Management (CSPM)

D.Cloud Workload Protection Platform (CWPP)

AnswerA

CASBs are designed to apply security policies including DLP across SaaS applications.

Why this answer

A CASB provides visibility and control over SaaS applications, including DLP policies to detect and block unauthorized sharing of sensitive data. CSPM focuses on cloud infrastructure posture, CWPP on workloads, and WAF on web application attacks.

Full explanation →

215

MCQeasy

An organization is using Cisco Firepower Threat Defense (FTD) with URL filtering to block access to social media sites during work hours. After implementation, users can still access Facebook and Twitter. The access control policy is configured correctly with a URL category condition. What should the administrator verify first?

A.Ensure that SSL decryption is enabled for the relevant traffic.

B.Confirm that the FTD is configured with a DNS policy to perform DNS snooping for URL filtering.

C.Check that the URL filtering rule is above any other permit rules.

D.Verify that the FTD has an updated URL filtering database.

AnswerB

Without DNS snooping, the FTD cannot categorize URLs for HTTPS traffic and relies on IP reputation, which may not be effective.

Why this answer

Cisco FTD uses DNS snooping to map domain names to IP addresses for URL filtering when SSL decryption is not enabled. Without DNS snooping, the FTD cannot reliably associate traffic with the requested URL category if the traffic is encrypted, leading to bypasses like users accessing Facebook and Twitter despite a blocking rule.

Exam trap

Cisco often tests the misconception that SSL decryption is required for URL filtering on encrypted traffic, but the correct first step is to verify DNS snooping, which provides a lightweight alternative for domain-based filtering without decryption.

How to eliminate wrong answers

Option A is wrong because SSL decryption is not a prerequisite for URL filtering; DNS snooping allows URL filtering to work on encrypted traffic without decrypting it, and enabling SSL decryption is a separate, more resource-intensive step. Option C is wrong because while rule order matters in access control policies, the question states the policy is configured correctly with a URL category condition, so the issue is not rule placement but the FTD's inability to identify the traffic as social media. Option D is wrong because an outdated URL database would cause incorrect categorization (e.g., blocking a site that is not social media), not a complete bypass of the rule; the database update is a secondary check after verifying DNS snooping.

Full explanation →

216

MCQmedium

An organization wants to deploy 802.1X for network access control. Which component is responsible for forwarding authentication requests from the endpoint to the authentication server?

A.Authenticator

B.Authentication server

C.Supplicant

D.RADIUS proxy

AnswerA

The authenticator (switch/WLC) forwards authentication traffic.

Why this answer

In 802.1X, the authenticator (switch or wireless LAN controller) acts as the middleman, relaying EAP messages between the supplicant and the authentication server.

Full explanation →

217

Multi-Selectmedium

A security team is implementing a DevSecOps pipeline for containerized applications. Which TWO of the following practices should be included to ensure container security?

Select 2 answers

A.Secrets management (avoiding hardcoded secrets in images)

B.DAST (Dynamic Application Security Testing)

C.Container image scanning for vulnerabilities

D.IaC security scanning

E.Manual code review

AnswersA, C

Secrets management prevents exposure of credentials inside containers.

Why this answer

Container image scanning checks for vulnerabilities in images, and secrets management prevents exposure of sensitive data in code.

Full explanation →

218

Matchingmedium

Match each protocol to its default port number.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

443

22

53

25

161

Why these pairings

These are well-known port numbers for common protocols.

Full explanation →

219

MCQmedium

A company is deploying a new ASA firewall in a DMZ design. They need to allow web traffic from the internet to a web server in the DMZ, while also permitting outbound traffic from the DMZ to the internet for software updates. Which access control approach best meets these requirements with minimal risk?

A.Create an ACL that permits all inbound and outbound traffic between DMZ and internet.

B.Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection.

C.Create an ACL that permits inbound web traffic to the DMZ server and permits all outbound traffic from DMZ with no inspection.

D.Create an ACL that permits inbound web traffic to the DMZ server and denies all outbound traffic from DMZ.

AnswerB

Balances security and functionality by inspecting traffic and limiting outbound to necessary services.

Why this answer

It uses the 'established' keyword to allow return traffic for inbound web connections while explicitly permitting outbound HTTP/HTTPS with application inspection. This minimizes risk by not blindly allowing all outbound traffic, and inspection ensures protocol compliance and stateful tracking.

Exam trap

Cisco often tests the misconception that simply allowing 'established' connections is sufficient for outbound traffic, but the trap here is that the question explicitly requires outbound HTTP/HTTPS for updates, which must be explicitly permitted and inspected, not just allowed as return traffic.

How to eliminate wrong answers

Option A is wrong because permitting all inbound and outbound traffic between DMZ and internet violates the principle of least privilege and creates a massive security risk. Option C is wrong because permitting all outbound traffic from DMZ with no inspection bypasses security controls, allowing potential malware exfiltration or unauthorized protocols. Option D is wrong because denying all outbound traffic from DMZ would prevent the required software updates, failing to meet the requirement.

Full explanation →

220

MCQmedium

A security team wants to enforce data loss prevention (DLP) policies across multiple sanctioned cloud applications used by employees. Which cloud security solution is best suited for this task?

A.CASB (Cloud Access Security Broker)

B.CWPP (Cloud Workload Protection Platform)

C.Cisco Umbrella SIG

D.CSPM (Cloud Security Posture Management)

AnswerA

CASB provides DLP, visibility, and threat detection for cloud applications.

Why this answer

A Cloud Access Security Broker (CASB) provides visibility into SaaS usage and can enforce DLP policies across cloud applications.

Full explanation →

221

MCQhard

An organization uses AWS with a VPC and wants to inspect all traffic between instances in the same subnet using Cisco Firepower. What must be implemented?

A.Configure VPC Endpoints to route traffic through Firepower

B.AWS Traffic Mirroring to send traffic to a Firepower appliance

C.Use AWS Security Groups and log to Firepower

D.Deploy Firepower as a transparent bridge in the subnet

AnswerB

Traffic Mirroring copies packets to Firepower for east-west inspection.

Why this answer

AWS Traffic Mirroring captures and forwards network traffic from Elastic Network Interfaces (ENIs) to a security appliance, such as a Cisco Firepower instance, for inspection. This allows the organization to monitor all traffic between instances within the same subnet without requiring changes to the routing table or placing the Firepower inline, which is not possible in a VPC without a gateway appliance. Option B is correct because Traffic Mirroring is the native AWS feature designed for out-of-band traffic inspection.

Exam trap

Cisco often tests the misconception that you can deploy a transparent bridge or inline firewall within a VPC subnet, but AWS does not support Layer 2 bridging; Traffic Mirroring is the only way to achieve out-of-band inspection for intra-subnet traffic.

How to eliminate wrong answers

Option A is wrong because VPC Endpoints are used to privately connect a VPC to supported AWS services (e.g., S3, DynamoDB) via AWS PrivateLink, not to route inter-instance traffic through a security appliance. Option C is wrong because AWS Security Groups are stateful firewalls that control traffic at the instance level but cannot log traffic to an external appliance like Firepower; they only provide flow logs at the VPC level, not per-packet inspection. Option D is wrong because a transparent bridge deployment requires Layer 2 adjacency and is not supported in an AWS VPC, which is a Layer 3 overlay network; you cannot bridge instances in the same subnet through an external appliance without breaking the VPC's routing architecture.

Full explanation →

222

MCQmedium

An employee receives an email that appears to be from the company's IT department requesting their login credentials. This is an example of which type of attack?

A.Spear phishing

B.Phishing

C.Vishing

D.Whaling

AnswerB

Correct answer. Phishing is a social engineering attack using deceptive emails.

Why this answer

Social engineering attacks manipulate individuals into divulging confidential information. Phishing is a common form.

Full explanation →

223

Multi-Selectmedium

Which TWO actions can be configured in a Cisco ESA DLP policy to respond to a violation involving outbound credit card numbers? (Choose two.)

Select 2 answers

A.Deliver the message with a CC to the compliance team

B.Encrypt the message using a secure policy

C.Quarantine the message for review

D.Add a disclaimer that the message is confidential

E.Bounce the message back to the sender

AnswersB, C

Encryption ensures the data is protected even if sent.

Why this answer

Cisco ESA DLP policies can automatically encrypt outbound messages containing sensitive data like credit card numbers. This ensures that even if the message is intercepted, the content remains protected, which is a common compliance requirement for PCI DSS.

Exam trap

Cisco often tests the distinction between 'notification-only' actions (like CC or disclaimer) and 'enforcement' actions (like encrypt or quarantine), leading candidates to mistakenly select passive options that do not actually prevent data exfiltration.

Full explanation →

224

MCQhard

A cloud operations team reports that after enabling Cisco Secure Cloud Analytics (CSCA) for an AWS account, some legitimate traffic is being flagged as suspicious. The team has fine-tuned the ML models but false positives persist. Which additional step should they take?

A.Disable ML-based detection

B.Increase the severity threshold

C.Customize alert rules based on known good behavior

D.Deploy additional sensors in VPC subnets

AnswerC

Whitelists known good traffic to reduce false positives.

Why this answer

C is correct because Cisco Secure Cloud Analytics (CSCA) uses machine learning to establish a baseline of normal traffic behavior. When false positives persist despite fine-tuning ML models, the next logical step is to customize alert rules to explicitly whitelist known good behavior, such as trusted IP ranges or specific application flows. This reduces noise without disabling detection or lowering sensitivity, and it directly addresses the root cause: legitimate traffic that deviates from the baseline but is actually benign.

Exam trap

The trap here is that candidates often confuse 'fine-tuning ML models' with 'adjusting alert thresholds' or 'adding more sensors,' when the correct approach is to use explicit whitelisting via custom alert rules to suppress false positives without compromising detection fidelity.

How to eliminate wrong answers

Option A is wrong because disabling ML-based detection would remove the core anomaly detection capability of CSCA, leaving the environment blind to real threats and defeating the purpose of the deployment. Option B is wrong because increasing the severity threshold would only change the alerting level, not reduce false positives; it might even cause high-severity alerts to be missed for actual attacks. Option D is wrong because deploying additional sensors in VPC subnets would increase visibility into network traffic but does not address the false positive issue; false positives are a tuning problem, not a coverage problem.

Full explanation →

225

MCQmedium

An organization requires that all endpoint traffic be verified against a security policy before being forwarded. Which Cisco umbrella solution provides this capability?

A.Cisco AnyConnect

B.Cisco Stealthwatch

C.Cisco Umbrella

D.Cisco Firepower NGFW

AnswerC

Cloud-delivered security for traffic enforcement.

Why this answer

Cisco Umbrella is a cloud-delivered security service that enforces security policy by intercepting all DNS and IP-layer requests from endpoints and checking them against the organization's security policy before allowing traffic to proceed. This ensures that every connection attempt is verified at the DNS or IP layer, blocking threats before a TCP handshake is completed.

Exam trap

Cisco often tests the distinction between enforcement at the DNS layer (Umbrella) versus enforcement at the network layer (Firepower NGFW), and the trap here is that candidates may choose Firepower NGFW because it is a firewall, but the question specifically asks for a Cisco umbrella solution, which is cloud-based and operates before the traffic is forwarded.

How to eliminate wrong answers

Option A is wrong because Cisco AnyConnect is a VPN and secure connectivity client that provides remote access and posture assessment, but it does not perform inline security policy verification of all endpoint traffic before forwarding. Option B is wrong because Cisco Stealthwatch is a network visibility and analytics tool that uses NetFlow/IPFIX data to detect anomalies and threats after traffic has already been forwarded, not to enforce policy in real-time before forwarding. Option D is wrong because Cisco Firepower NGFW is a next-generation firewall that can enforce policy on traffic that passes through it, but it is a physical or virtual appliance that requires traffic to be routed through it, whereas the question specifies a Cisco umbrella solution that provides this capability at the cloud level.

Full explanation →

Page 3 of 14

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14

Practice 350-701 by domain

Target a specific domain to shore up weak areas.

Security Concepts Network Security Cloud Security Content Security Endpoint Protection and Detection Secure Network Access, Visibility and Enforcement

See all domains with question counts →