Cisco SCOR / CCNP Security Core 350-701 (350-701) — Questions 226–300

The 'capture' command with the 'trace' option on Cisco FTD provides a detailed, packet-level analysis of how traffic is processed through the firewall pipeline. It shows each step (e.g., ingress, routing, access control, NAT, egress) and explicitly states the drop reason, such as 'action-drop' due to intrusion prevention, URL filtering, or security intelligence, even when the access control policy appears to allow the traffic. This is the only option that directly identifies the specific cause of a drop in the data path.

Cisco Duo integrates directly with AnyConnect via the Duo Authentication Proxy or the native Duo AnyConnect client module to provide multi-factor authentication. It supports push notifications to the Duo Mobile app, one-time passwords (OTP) generated by the app or hardware tokens, and phone callback, making it the correct choice for MFA enforcement on VPN access.

Something you know (password) and something you have (mobile app one-time code).

Cisco ISE can use a NetFlow Probe to collect NetFlow records from network devices, which provide metadata about traffic flows (e.g., IP addresses, ports, protocols) that ISE analyzes to profile endpoints. This passive collection method helps identify endpoint attributes without requiring active agent deployment.

In Cisco Firepower Threat Defense (FTD), an access control rule with action 'Allow' permits traffic without sending it to the Snort intrusion inspection engine. To enable IPS, the rule action must be 'Allow with Intrusion Prevention', which explicitly invokes the intrusion policy. Since the rule was set to 'Allow', the malicious traffic bypassed Snort inspection entirely, so no alerts were generated.

The Cisco Umbrella Roaming Client is specifically designed to enforce DNS security on endpoints regardless of their network location. It installs a local DNS forwarder that intercepts all DNS queries and sends them to Umbrella's cloud resolvers, ensuring protection even when users are off the corporate network. This method does not rely on network-level configurations that are ineffective for remote users.

Tuning to reduce false positives includes adjusting thresholds, disabling specific signatures, using rule filtering by source/destination, and customizing rules. Monitoring without dropping (monitor mode) also helps evaluate impact.

Cisco WSA integrates with Active Directory for identity-based policies.

WCCP (Web Cache Communication Protocol) is used to transparently redirect web traffic from routers or switches to the WSA.

The ACL shown in the exhibit (which is not provided but implied by the question) blocks RFC 1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Cloud VPCs commonly use these private IP ranges for their instances. If the cloud VPC CIDR falls within an RFC 1918 range, the ACL will deny traffic to those cloud instances, preventing on-premises users from accessing them.

DLP policies on Cisco ESA scan outbound email for sensitive data patterns like SSNs.

Modifying the rule's threshold to require a higher number of matches or using a suppression filter for the web server IP can reduce false positives.

Inline mode in Cisco Firepower NGIPS allows the system to actively drop malicious packets based on signature matches and anomaly detection. Unlike passive monitoring, inline interfaces sit directly in the traffic path, enabling the IPS engine to enforce blocking actions in real time.

Cisco Umbrella operates at the DNS layer to block requests to malicious domains.

A spike in UDP traffic to a single target is a classic indicator of a UDP flood attack, a common network-layer DDoS. Attackers send a high volume of UDP packets, often to random ports, overwhelming the target's ability to process them and consuming bandwidth. This is a direct Layer 3/4 attack that does not require a completed handshake, making it easy to generate and hard to mitigate without proper filtering.

MAC Authentication Bypass (MAB) uses the device's MAC address for authentication, allowing non-supplicant devices to gain network access.

Cisco Firepower NGFW is the inline security enforcement point in this Azure deployment, and it can inspect and log all outbound traffic. Creating a Firepower Access Control policy rule to block the specific threat IP and log it directly enforces the security policy at the firewall layer, which is the only device capable of deep packet inspection and logging as required by company policy. NSGs operate at Layer 3/4 and cannot inspect application-layer traffic or integrate with threat feeds for granular IP blocking without affecting other traffic.

Cisco AMP for Endpoints is available for iOS and Android via the respective app stores (MDM is also possible, but the question implies direct deployment).

On Cisco ASA, when an ACL is applied inbound on the higher security interface (inside), traffic is evaluated before the stateful inspection. Since traffic from higher to lower security is implicitly allowed by default (based on security levels), the ACL does not need to explicitly permit it; however, applying an ACL inbound on the higher interface can restrict traffic. The ACL as described permits HTTP, so the traffic will be allowed.

WCCP allows routers to redirect web traffic to the WSA transparently without client configuration.

Dynamic Access Policy (DAP) allows granular access control based on endpoint attributes such as antivirus status, OS, registry keys, etc. Group policies provide basic settings but not dynamic evaluation.

Cisco TrustSec uses SGTs to enforce role-based access control. To propagate SGT information across the network, Cisco developed a proprietary extension to IEEE 802.1Q that embeds the SGT into the Ethernet frame header, specifically using the CMD (Cisco MetaData) field. This allows switches and routers to enforce security policies based on the SGT without requiring additional encapsulation overhead.

Explicit proxy mode requires clients to be manually configured to send web traffic directly to the WSA's IP address and port (typically 3128 or 8080). This gives the administrator granular control over which devices use the proxy and allows for authentication at the proxy layer, making it a valid deployment method for the Cisco Web Security Appliance.

Cisco AMP for Endpoints includes Exploit Prevention, which uses vulnerability-based rules to detect and block exploit attempts targeting specific software vulnerabilities. These rules are tailored to the exploit technique rather than the malware file itself, allowing protection against zero-day exploits that leverage known vulnerabilities.

In IaaS, the cloud provider manages the physical infrastructure, while the customer manages the OS, applications, and data.

DNS-layer security is a core component of Cisco Umbrella's multi-layered approach. It blocks requests to malicious domains at the earliest stage of the connection, before any IP address resolution occurs, by inspecting DNS queries against threat intelligence feeds. This prevents users from reaching known phishing, malware, or command-and-control (C2) domains.

Cisco WSA allows administrators to create custom URL categories for sites not covered by predefined categories. By adding the URL to a custom category and applying a block action in the access policy, the engineer ensures the site is blocked for all users, as access policies evaluate custom categories before predefined ones.

Cisco AMP for Endpoints provides endpoint isolation and remote shell capabilities, allowing analysts to isolate a compromised endpoint from the network and perform forensic investigation remotely.

ISAKMP (Internet Security Association and Key Management Protocol) policy is required to define the parameters for Phase 1 of an IPsec VPN, including encryption, authentication, Diffie-Hellman group, and lifetime. Without an ISAKMP policy, the router cannot establish the secure management tunnel needed to negotiate IPsec Security Associations (SAs).

Security Group Tag Exchange Protocol (SXP) is a Cisco TrustSec feature that propagates Security Group Tag (SGT) bindings between network devices without requiring inline tagging on every packet. It allows devices that do not natively support SGT in hardware to participate in TrustSec by exchanging IP-to-SGT mappings over TCP, enabling consistent policy enforcement across heterogeneous environments.

AWS WAF allows creating rules based on geographic location (geo match) to allow or block requests from specific countries.

Man-in-the-middle (MITM) attacks, such as ARP spoofing, allow interception and modification of traffic between two parties.

AMP uses SHA-256 cloud lookup and sandboxing. If the file is new and unknown (zero-day), the cloud may not have a disposition, and if sandboxing is not enabled or the file type is not analyzed, it could be allowed.

Cisco Duo is a multi-factor authentication solution that offers various methods including push notifications, time-based one-time passwords (TOTP), and hardware tokens.

DNS-layer security blocks requests to malicious domains at the DNS level, preventing the connection from being established.

Secrets management tools like HashiCorp Vault securely store and manage secrets, avoiding hardcoding in code.

The exhibit shows that the Marketing-Policy has the Social Networking category set to Block. Since twitter.com is classified under Social Networking, this action explicitly denies access for users assigned to that policy, overriding any other settings.

In Cisco ISE, when a posture policy is configured with a 'continue' action for non-compliant status, the session does not terminate; instead, it proceeds to the authorization policy. This means the endpoint is evaluated by authorization rules, which may grant full network access if no quarantine rule is matched. The logs show the posture assessment passed because the 'continue' action treats non-compliance as a passing state for policy flow, not a failure.

When the Umbrella roaming client fails to authenticate, the user's DNS requests fall back to the default policy, which may block categories like 'Productivity' that are allowed under the authenticated user's policy. This explains why the user cannot access the application while other users outside the office can, as they are likely authenticated and subject to a permissive policy.

Integrity ensures that data remains accurate and unaltered during storage or transmission, preventing unauthorized modifications.

B is correct because Cisco Tetration (Secure Workload) relies on sensors installed on each workload to collect granular telemetry, including process, network, and flow data. Without sensors, the platform cannot discover workload dependencies or enforce micro-segmentation policies, as sensors are the primary data source for the agent-based architecture.

Cisco FTD uses a stateful firewall engine that tracks the state of outbound connections. When a stateful access rule permits outbound web traffic, the firewall automatically creates a dynamic pinhole for the return traffic, eliminating the need for explicit inbound rules. This is the correct policy type because it maintains session state and allows only related return packets, aligning with the requirement to block all other inbound traffic.

Traffic from lower to higher security level is blocked by default; an ACL must be applied to the lower security interface (DMZ) to permit traffic to the inside (higher).

Inline mode allows the FTD to actively inspect and block traffic. Passive mode only monitors. The requirement to inspect implies inline for enforcement.

CyberArk is a leading PAM solution that integrates with Cisco SecureX to provide just-in-time access, session recording, and password vaulting.

Firewall filters traffic based on rules; IDS/IPS monitors for threats; VPN provides secure tunnels; NAC enforces compliance. Common mistakes include confusing IDS/IPS with firewall and NAC with VPN.

Cisco AMP for Email uses SHA-256 hashing to compare file hashes against a cloud database of known malware. If a match is found, the email is blocked or quarantined.

Cisco AMP for Endpoints uses a combination of signature-based and behavioral analysis to detect malicious files. When a file is determined to be malicious, the administrator can choose to block execution of the file, which prevents the process from running on the endpoint. Additionally, the file can be quarantined into a safe location, isolating it from the system to prevent further harm while retaining the file for analysis.

Ransomware encrypts data and demands ransom.

The DHCP probe captures DHCP request options to identify the device type.

Geolocation filtering allows blocking or allowing traffic based on source or destination country. It is configured as a condition in access control rules.

Cisco Cloudlock is the correct answer because it is a cloud access security broker (CASB) that provides granular data loss prevention (DLP) for SaaS applications like Google Drive and Salesforce. It uses API-based inspection to scan data at rest and in motion, applying policies to prevent unauthorized sharing or leakage of sensitive information.

B is correct because Cisco ESA includes a sophisticated anti-spam filtering engine that uses multiple techniques such as SenderBase reputation, contextual analysis, and signature-based detection to identify and block unwanted email messages. This is a core content security capability of the ESA, operating at the email gateway to filter inbound and outbound traffic.

Class-maps identify traffic based on match criteria (e.g., ACL, protocol).

To block access to a specific URL category while allowing all others, the Access Policy must set the action for that category to 'Block'. The Cisco WSA evaluates URL categories in order of precedence, and a 'Block' action explicitly denies HTTP/HTTPS requests matching that category, while all other categories default to 'Allow' unless otherwise configured.

BEC attacks often involve spoofed email addresses (domain lookalikes) and urgent requests for wire transfers or sensitive data.

DTLS (Datagram Transport Layer Security) is used by AnyConnect to provide a UDP-based SSL VPN, reducing latency compared to TCP.

Multi-cloud environments span multiple jurisdictions with differing data protection laws (e.g., GDPR, CCPA, LGPD). Meeting compliance requirements becomes a challenge as each cloud provider may have different compliance certifications and data residency controls, requiring careful mapping of data flows and contractual agreements to avoid legal penalties.

C is correct because the Guest Portal in Cisco ISE is specifically designed to provide a self-service registration page where guests can create their own accounts, receive temporary credentials, and gain network access. This portal handles the entire guest lifecycle, including sponsor approval if required, and can deliver the username/password via SMS, email, or on-screen display.

Device Trajectory is the correct feature because it provides a timeline view of a file's activity across endpoints, including its origin, propagation, and subsequent actions. When Cisco AMP for Endpoints reclassifies a file from 'unknown' to 'malicious', Device Trajectory allows the analyst to trace the file's spread and interactions on each affected endpoint, enabling a thorough investigation of the infection chain.

Cisco AMP for Endpoints uses file reputation analysis based on cryptographic hashes, including MD5, to identify known malicious files. When an endpoint attempts to execute or download a file, AMP computes its MD5 hash and compares it against a cloud-based threat intelligence database; a match indicates a known malware sample and is a clear indicator of compromise.

The 'authentication order dot1x mab' command explicitly defines the sequence in which authentication methods are attempted on a switch port. When 802.1X times out (e.g., because the printer does not respond to EAPOL frames), the switch then falls back to MAB. This command ensures MAB is attempted only after 802.1X fails, which matches the requirement.

Cisco AnyConnect VPN with posture assessment is correct because it provides both device authentication (ensuring only company-owned devices connect) and security posture checks (e.g., OS patch level, antivirus status, firewall enabled) via the Cisco Secure Client (formerly AnyConnect) and ISE (Identity Services Engine). This combination enforces compliance before granting network access, meeting the requirement for teleworker remote access.

When AMP for Endpoints successfully blocks a ransomware file, the 'Block' policy action is applied. This action prevents the file from executing on the endpoint by terminating the process and quarantining the file in the local quarantine, ensuring the threat is neutralized immediately. The 'Block' action is the most restrictive and is designed to stop known malware, including ransomware, from causing harm.

A man-in-the-middle (MITM) attack involves interception and potential modification of communications.

Identity-based policies allow user identification via AD, and bandwidth controls can limit traffic per user or group.