978 questions total · 14pages · All types, answers revealed
A security analyst is reviewing logs and identifies numerous ICMP echo requests from an external IP address to multiple internal hosts. Which type of reconnaissance activity is this?
Active scanning involves sending probes (e.g., ICMP echo requests) to discover hosts and services.
Why this answer
ICMP echo requests (ping sweeps) are used in active scanning to identify live hosts.
Intelligent Proxy performs selective SSL inspection.
Why this answer
The Intelligent Proxy in Cisco Umbrella allows selective SSL decryption based on rules, enabling inspection of traffic to risky categories while bypassing trusted applications.
What is the primary difference between signature-based and anomaly-based intrusion detection?
Correct.
Why this answer
Signature-based detection compares traffic against known attack patterns; anomaly-based detection establishes a baseline and flags deviations.
A security engineer deploys Cisco Advanced Malware Protection (AMP) for Endpoints with cloud-based detection. After installation, a sample malware is executed on a test endpoint, but the AMP console shows no detection or trajectory data. The endpoint shows a 'Connected' status. What is the most likely reason for the lack of detection?
If the cloud connection is unstable, the connector may use local analysis which might not detect the malware.
Why this answer
When the AMP for Endpoints connector detects intermittent connectivity to the AMP cloud, it falls back to local file evaluation using only the local signature cache. Since cloud-based detection relies on sending file hashes and behavioral telemetry for advanced analysis, a disrupted connection prevents the cloud from performing deep analysis, resulting in no detection or trajectory data despite the endpoint showing a 'Connected' status.
Exam trap
Cisco often tests the misconception that a 'Connected' status guarantees full cloud functionality, when in reality intermittent connectivity can cause the endpoint to operate in a local-only mode without alerting the administrator.
How to eliminate wrong answers
Option A is wrong because if the AMP cloud subscription had expired, the endpoint would typically show a 'Disconnected' or 'Unregistered' status, not 'Connected', and the console would display a license warning. Option C is wrong because an outdated connector version might miss certain detections, but the core issue here is the lack of cloud communication; the connector would still attempt to send files for analysis and would show some error or queuing status. Option D is wrong because packed malware is handled by AMP's cloud-based machine learning and behavioral analysis, not solely by signature updates; the lack of detection is due to the cloud not receiving the file for analysis, not because of missing signatures.
The client ensures DNS filtering anywhere.
Why this answer
The Cisco Umbrella Roaming Security client is the correct deployment method for filtering DNS requests from remote VPN users because it installs a local DNS forwarder on the endpoint that intercepts all DNS traffic and sends it directly to Umbrella's cloud resolvers, even when the user is off the corporate network. This ensures that DNS queries are filtered regardless of the VPN tunnel state, as the client operates independently of the VPN connection.
Exam trap
Cisco often tests the distinction between DNS-layer security and proxy-based web security, and the trap here is that candidates may assume a PAC file or corporate DNS forwarding is sufficient for remote users, overlooking that the Roaming client is specifically designed for off-network enforcement.
How to eliminate wrong answers
Option A is wrong because a PAC file redirects HTTP/HTTPS web traffic via a proxy, not DNS requests, and Umbrella filters at the DNS layer, not the HTTP layer. Option B is wrong because configuring corporate DNS servers to forward to Umbrella only filters DNS queries that reach those servers, which does not cover remote users whose DNS requests may bypass the corporate network entirely. Option D is wrong because deploying a virtual appliance as a DNS forwarder at the branch office would only filter DNS traffic from users within that branch, not from remote VPN users who are not connected through that branch.
Which THREE considerations must be taken when deploying SSL decryption on a Cisco WSA in explicit proxy mode?
Policy defines what to decrypt based on URL categories or users.
Why this answer
An explicit HTTPS decryption policy is required to define which traffic should be intercepted and decrypted. Without this policy, the WSA will not decrypt any HTTPS traffic, even if the CA certificate is installed. The policy specifies criteria such as source IP, destination URL category, or user identity to selectively decrypt traffic.
Exam trap
Cisco often tests the distinction between explicit and transparent proxy modes; the trap here is that candidates mistakenly think the WSA must listen on privileged ports (below 1024) for explicit proxy, when that requirement only applies to transparent proxy deployments.
A company wants to protect against DNS-based attacks by filtering malicious domains and providing secure DNS resolution. Which Cisco product should be deployed?
Umbrella provides DNS-layer security and threat intelligence.
During a security audit, a penetration tester discovers that a Cisco ASA firewall is configured with a rule that permits traffic from the inside interface with a source IP address in the RFC 1918 range to the outside interface. The rule uses the 'inspect' command for HTTP and FTP. Which potential vulnerability does this configuration introduce?
Permitting RFC 1918 addresses from the inside without antispoofing checks can allow an attacker to spoof internal IP addresses.
Why this answer
The configuration permits traffic from RFC 1918 private IP addresses on the inside interface to the outside interface without any explicit antispoofing or Unicast Reverse Path Forwarding (uRPF) check. This allows an attacker on the inside network to spoof source IP addresses that appear to come from the inside subnet, bypassing the firewall's intended security boundary. Without antispoofing, the ASA will not verify that the source IP actually belongs to the inside network, enabling IP spoofing attacks.
Exam trap
Cisco often tests the misconception that 'inspect' commands automatically provide full security, when in reality they only perform stateful inspection and protocol compliance, not antispoofing or anti-spoofing protections like uRPF.
How to eliminate wrong answers
Option A is wrong because FTP inspection on a Cisco ASA does not inherently permit anonymous login commands; it only inspects FTP control channel commands and dynamic data ports, but does not allow or block specific authentication methods like anonymous logins. Option B is wrong because the question does not mention any NAT configuration, and the absence of NAT is not a vulnerability—it is a design choice; the vulnerability is the lack of antispoofing, not the lack of NAT. Option C is wrong because HTTP inspection on the ASA is designed to enforce protocol compliance and can filter certain application-layer attacks, but it does not specifically prevent SQL injection; SQL injection is a web application vulnerability that occurs at the application layer, not a firewall inspection bypass.
Refer to the exhibit. An engineer has configured IP Source Guard and DHCP Snooping. A host with MAC 00:11:22:33:44:55 on Gi0/0 is assigned IP 192.168.1.10 via DHCP. However, the host cannot ping its default gateway 192.168.1.1. What is the most likely cause?
Gi0/1 is not configured as trust, so DHCP replies from the server are dropped, and the host may not have a valid lease. However, the static binding exists, but dynamic bindings fail.
Why this answer
The host cannot ping its default gateway because DHCP Snooping marks interface Gi0/1 as untrusted by default. Since the DHCP server is connected to Gi0/1, the switch drops DHCP replies from that interface, preventing the DHCP snooping binding database from being updated with the host's IP address. Without a valid binding, IP Source Guard on Gi0/0 drops all IP traffic from the host, including pings to the gateway.
Exam trap
Cisco often tests the misconception that IP Source Guard works independently of DHCP Snooping, when in fact it relies entirely on the DHCP snooping binding database, and a missing trust configuration on the DHCP server-facing port is a common root cause.
How to eliminate wrong answers
Option B is wrong because the question states the host is assigned IP 192.168.1.10 via DHCP, and there is no mention of static bindings or VLAN mismatch; the issue is with DHCP snooping trust, not static binding configuration. Option C is wrong because Dynamic ARP Inspection (DAI) is not enabled by default and is not required for basic IP Source Guard operation; the problem is that IP Source Guard drops traffic due to missing DHCP snooping bindings, not ARP replies. Option D is wrong because the 'ip verify source' command does not require a 'port-security' keyword; the correct syntax is 'ip verify source' alone or with 'vlan dhcp-snooping', and port-security is a separate feature.
Refer to the exhibit. This JSON policy is part of a Cisco Cloudlock DLP configuration. What will happen when a user attempts to upload a file containing the word 'secret' to a cloud storage service?
Condition checks for 'contains' and action is 'block'.
Why this answer
The JSON policy shown in the exhibit is a Cisco Cloudlock DLP policy that uses a data pattern to match the word 'secret' in file content. The action specified is 'block', which means when a user attempts to upload a file containing 'secret' to a cloud storage service, the upload is blocked and an alert is generated. Option B correctly identifies that the file upload is blocked if the content contains the word 'secret', aligning with the policy's enforcement action.
Exam trap
The trap here is that candidates often confuse the 'alert' and 'block' actions in DLP policies, assuming that a content match only generates an alert without enforcement, but the exhibit explicitly shows the action is 'block', which means the upload is prevented.
How to eliminate wrong answers
Option A is wrong because the policy action is 'block', not just 'alert'; an alert is generated but the file is also blocked, not merely flagged. Option C is wrong because the policy matches content (body) for the word 'secret', not the file title or metadata; the pattern is applied to the file's data, not its name. Option D is wrong because the policy is content-specific, targeting files containing 'secret', not all files; only files matching the pattern are blocked, not every upload.
Refer to the exhibit. An ASA is configured with the above access-list and NAT rule. A web server is reachable from the internet via the public IP 203.0.113.10. However, internal users from the inside network cannot access the web server using its public IP address. What is the most likely cause?
Without a static NAT, internal users cannot access the server via the public IP due to lack of hairpinning.
Why this answer
The NAT rule shown is a static NAT for the web server, but it is missing the 'static' keyword or the bidirectional mapping required for internal users to reach the server using its public IP. Without a proper static NAT (e.g., 'nat (inside,outside) static 192.168.1.10 service tcp www www'), the ASA does not translate the source IP of internal traffic destined to 203.0.113.10 back to the server's private IP, causing the traffic to be dropped or misrouted.
Exam trap
The trap here is that candidates assume a single static NAT rule automatically handles all traffic directions, but Cisco tests the nuance that internal-to-internal traffic via the public IP requires explicit NAT configuration (often called 'NAT reflection' or 'hairpinning'), which is not implied by a basic static NAT.
How to eliminate wrong answers
Option B is wrong because the access-list shown permits traffic from inside to outside for the web server's public IP (203.0.113.10) on port 80, so the ACL is not the issue. Option C is wrong because the exhibit does not show an interface ACL applied inbound on the inside interface; the ACL shown is likely a global or NAT-related ACL, and an inbound ACL on the inside would block traffic from inside to outside if it denied the traffic, but no such ACL is indicated. Option D is wrong because a missing default route would affect all outbound traffic, not specifically the ability to reach the web server via its public IP from inside; the server is reachable from the internet, so routing to the public IP is functional.
A financial institution with a flat Layer 2 network has experienced a ransomware incident where an infected workstation in the accounting department propagated laterally to a server in the finance department. The network spans 10 switches connected in a star topology with a collapsed core. The IT team wants to implement segmentation to contain such threats in the future, without requiring major hardware upgrades and with minimal change to IP addressing. The network currently uses a single VLAN with /16 subnet. Which of the following approaches would BEST achieve the segmentation goal, considering the constraints?
An NGFW provides stateful, application-aware segmentation that can enforce micro-segmentation without IP changes and leverage existing VLAN trunking.
Why this answer
Implementing internal firewall zones with a next-generation firewall (NGFW) provides granular, stateful inspection and application-level segmentation. It can filter traffic between departments without changing IP addressing and leverages existing switch infrastructure. VLANs with ACLs on the core router are stateless and can be bypassed; also they require reconfiguring IP addressing if VLANs are separate subnets, and ACLs on a core router do not provide the depth of inspection needed.
Deploying a VPN for all internal traffic is not scalable and adds latency. Using STP and PVLANs on switches can provide some isolation but does not prevent lateral movement at higher layers and is complex to manage across multiple switches without a fabric. Option C is the most effective given the constraints.
An organization is migrating to AWS and wants to ensure that all internet-bound traffic from VPCs is inspected by a central security appliance. Which AWS service should be used to redirect this traffic?
Transit Gateway can route traffic through a security VPC for inspection.
Why this answer
Transit Gateway is correct because it acts as a central hub that can route traffic between VPCs and on-premises networks, and it supports route tables that can direct all internet-bound traffic to a central security appliance (such as a firewall or IDS/IPS) via a VPC attachment or a Network Virtual Appliance. This enables traffic inspection and policy enforcement without requiring individual VPCs to manage their own internet gateways or NAT devices.
Exam trap
Cisco often tests the misconception that VPC Peering can be used for transitive routing or central traffic inspection, but VPC Peering is non-transitive and cannot route traffic through a central hub without additional components like a Transit Gateway.
How to eliminate wrong answers
Option A is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a service for redirecting internet-bound traffic within VPCs. Option B is wrong because VPC Peering provides direct one-to-one connectivity between two VPCs but does not support transitive routing or central inspection of internet-bound traffic. Option C is wrong because an Internet Gateway is a VPC component that allows outbound internet traffic but does not redirect that traffic to a central security appliance; it simply provides a path to the internet.
An administrator configures Cisco Email Security Appliance (ESA) to add a disclaimer to all outgoing emails using a content filter. The filter is enabled and matches all outgoing mail. However, some users report that the disclaimer is missing from their sent emails. Which action should the administrator take to troubleshoot?
Message filters are processed before content filters and could be silently discarding or modifying messages before the disclaimer is added.
Why this answer
Content filters on Cisco ESA are evaluated after message filters. If a message filter (e.g., one that strips headers or drops attachments) is applied in the same or a higher-priority mail policy, it can prevent the content filter from processing the message, causing the disclaimer to be missing. The administrator should review the message filters in the 'Incoming' or 'Outgoing' mail policies to identify any that might be taking precedence and interfering with the content filter's action.
Exam trap
Cisco often tests the concept that content filters are not the only filtering mechanism; message filters have higher priority and can preempt content filter execution, leading candidates to overlook the need to check message filter precedence.
How to eliminate wrong answers
Option A is wrong because increasing memory allocated to the content filter engine would not resolve a missing disclaimer issue; memory allocation affects performance under load, not the logical execution order of filters. Option C is wrong because the mail flow policy for outgoing mail must already be set to 'Accept' for the ESA to deliver messages; if it were set to 'Reject' or 'Bounce', the emails would not be sent at all, not just missing a disclaimer. Option D is wrong because the scenario states the filter is enabled and matches all outgoing mail, so checking if it is disabled or has an invalid condition is redundant; the issue lies in filter precedence, not the filter's configuration.
A university is using Cisco ISE to provide secure wireless access for students and faculty. The wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. Recently, some faculty members reported that they cannot connect to the wireless network from their personal laptops, while student devices connect without issues. The faculty members are using the same SSID and entering their credentials correctly. The ISE logs show that the authentication attempts from faculty devices are failing with 'RADIUS Access-Reject' due to incorrect credentials. However, the faculty members are certain they are using the correct password. The IT department has verified that the user accounts in Active Directory are active and not locked. What is the most likely cause of the issue?
If the identity store sequence does not include AD, authentication fails.
Why this answer
The most likely cause is that the ISE authentication policy is not configured to query Active Directory for faculty users. Since student devices connect successfully, the policy likely matches students to an AD identity source but fails for faculty because their accounts are in a different AD group or domain not included in the policy. The 'RADIUS Access-Reject' with 'incorrect credentials' error in ISE logs indicates the authentication policy is not finding the user in the configured identity stores, even though the password is correct.
Exam trap
Cisco often tests the misconception that 'incorrect credentials' always means a wrong password, when in fact it can indicate a missing or misconfigured identity source in the authentication policy, especially when some users succeed and others fail.
How to eliminate wrong answers
Option B is wrong because PEAP-MSCHAPv2 does not require client certificates; only the server side presents a certificate for the TLS tunnel, so missing client certificates would not cause authentication failures. Option C is wrong because the IT department has verified that the faculty accounts are active and not locked, so account lockout is not the issue. Option D is wrong because if the RADIUS shared secret were incorrect, the wireless controller would not even forward authentication requests to ISE, and the logs would show a different error (e.g., 'RADIUS Request dropped' or 'Invalid Shared Secret'), not an Access-Reject due to incorrect credentials.
A Cisco ASA is configured with a modular policy framework to inspect HTTP traffic. The class-map matches HTTP traffic, and the policy-map applies inspection. Which command correctly applies the policy to an interface?
Correct. This applies the named policy-map to the inside interface.
Why this answer
The service-policy command applies a policy-map to an interface or globally. The syntax is: service-policy policy-map-name {global | interface interface-name}.
A company uses Cisco Umbrella to protect its remote users. The security team notices that some users are able to bypass Umbrella by using a different DNS resolver. Which deployment method ensures that all DNS traffic is forced through Umbrella?
The roaming client enforces DNS policy even if users change DNS settings.
Why this answer
The Cisco Umbrella roaming client (C) is the correct deployment method because it installs a local agent on each endpoint that intercepts all DNS queries at the operating system level, regardless of the DNS resolver configured in the network settings. This ensures that all DNS traffic is forced through Umbrella's cloud-based security platform, preventing users from bypassing protection by manually changing their DNS resolver to a non-Umbrella server.
Exam trap
Cisco often tests the misconception that network-level solutions (like a virtual appliance or BGP) can protect remote users, but the trap here is that remote endpoints require an agent-based approach (the roaming client) to enforce DNS policy locally, because network-level controls cannot intercept traffic that does not traverse the corporate network.
How to eliminate wrong answers
Option A is wrong because deploying the Umbrella virtual appliance in the data center only protects DNS traffic that passes through the corporate network; remote users' DNS queries are not routed through the data center, so they can still bypass Umbrella by using a different DNS resolver. Option B is wrong because BGP (Border Gateway Protocol) is used for routing IP traffic between autonomous systems, not for redirecting individual DNS queries from remote endpoints; it would require complex network-level redirection and does not enforce DNS policy on endpoints outside the corporate network. Option D is wrong because Active Directory integration with Umbrella provides identity-based policy enforcement and logging, but it does not force DNS traffic through Umbrella; users can still change their DNS resolver locally and bypass protection.
Refer to the exhibit. A switch port is configured for 802.1X with MAB. The switch has reached its maximum number of authentication sessions (platform limit). When a new device attempts to connect, what happens?
If the platform limit is reached, the switch cannot create new sessions, so the port remains unauthorized for the new device.
Why this answer
When the switch reaches its platform-specific limit for authentication sessions (e.g., 256 sessions on a Catalyst 3850), no new 802.1X or MAB sessions can be initiated. The new device remains in an unauthorized state (typically in the 'critical' or 'auth-fail' VLAN, or simply blocked) because the switch cannot allocate a new session context. There is no automatic fallback or CoA action to free a session; the port stays in the unauthorized state until an existing session expires or is manually cleared.
Exam trap
Cisco often tests the misconception that MAB or 802.1X fallback mechanisms will automatically handle session exhaustion, when in reality the session limit is a hard resource constraint that blocks all new authentications until an existing session is released.
How to eliminate wrong answers
Option B is wrong because MAB fallback (from 802.1X to MAB) is a per-host authentication method, not a mechanism to bypass session limits; once the session limit is reached, no new authentication attempts are processed regardless of method. Option C is wrong because a Change of Authorization (CoA) is initiated by the RADIUS server (ISE) to modify an existing session, not by the switch to free up a session; the switch cannot send a CoA to ISE for this purpose. Option D is wrong because the switch does not automatically shut down the port when the session limit is reached; it simply denies new authentication attempts while existing sessions remain active.
An organization uses Cisco ISE for network access control. After a user authenticates via 802.1X, a posture assessment determines that the user's antivirus definitions are outdated. What ISE feature can be used to dynamically restrict the user's network access until the issue is resolved?
CoA enables dynamic changes to VLAN or ACL after a session is established, based on posture or other conditions.
Which TWO benefits does the Cisco ESA provide for email security? (Choose two.)
ESA offers encryption and DLP.
Why this answer
The Cisco Email Security Appliance (ESA) includes integrated email encryption capabilities via Cisco Registered Envelope Service (CRES) or PGP/SMIME, and it provides Data Loss Prevention (DLP) through pre-defined or custom DLP policies that scan outbound emails for sensitive data patterns such as credit card numbers or PII. These features are core to the ESA's content security functionality.
Exam trap
Cisco often tests the distinction between the ESA's email-specific security features (encryption, DLP, anti-malware) and features belonging to other Cisco security products like Umbrella (DNS-layer security) or WSA (web filtering), so candidates mistakenly attribute cross-product capabilities to the ESA.
Which TWO are best practices for securing Cisco ASA remote access VPN? (Choose two.)
MFA adds security layer beyond passwords.
Why this answer
Enforcing multi-factor authentication (MFA) for VPN users adds an additional layer of security beyond just a password, significantly reducing the risk of credential theft and unauthorized access. Cisco ASA supports MFA integration with RADIUS servers (e.g., Cisco ISE, Duo Security) that can require a one-time password (OTP) or push notification, aligning with the principle of defense-in-depth for remote access VPNs.
A security administrator is configuring Cisco ISE for guest access. Which TWO components are required to allow guests to self-register and obtain network access? (Choose two.)
A guest VLAN provides network access for guest devices after registration.
An organization wants to use Cisco Umbrella SIG to enforce security policy for remote users. Which deployment method allows Umbrella to inspect traffic for all ports and protocols, not just DNS?
Correct. The roaming client forwards all traffic to the SIG for full inspection.
Why this answer
Umbrella SIG (Security Internet Gateway) can be deployed as a cloud proxy or with the Umbrella roaming client. The roaming client forwards all traffic to the cloud proxy for full inspection.
A financial institution uses Cisco Firepower Threat Defense (FTD) for intrusion prevention and SSL decryption. The security team recently enabled SSL decryption on the FTD to inspect encrypted traffic. After the change, some internal applications that use client certificates for authentication stopped working. The FMC shows that SSL decryption is configured to inspect traffic to specific destination IPs. The applications are using a custom port (TCP 8443) for HTTPS. The administrator has already added the custom port to the SSL decryption policy. What is the most likely reason the applications are failing?
SSL decryption terminates the original SSL session, so client certificates are lost and cannot be passed to the server.
Why this answer
When FTD performs SSL decryption, it acts as a man-in-the-middle: it terminates the client's SSL connection, inspects the plaintext, and then initiates a new SSL connection to the server. If the client application presents a client certificate for authentication, the FTD cannot re-encrypt the new connection with that same client certificate because it does not have access to the client's private key. The server then rejects the re-encrypted connection, causing the application to fail.
Exam trap
Cisco often tests the misconception that adding the custom port to the SSL decryption policy is sufficient, when the real issue is the FTD's inability to re-encrypt with the original client certificate during mutual TLS authentication.
How to eliminate wrong answers
Option B is wrong because IPsec operates at Layer 3 and is not inspected by SSL decryption policies; the question explicitly states the applications use HTTPS on TCP 8443, which is SSL/TLS-based. Option C is wrong because the internal CA certificate not being trusted by the FTD would cause certificate validation errors for the server certificate, not specifically break client certificate authentication; the FTD can still forward client certificates if it has the private key, but the core issue is the inability to re-encrypt with the original client certificate. Option D is wrong because the administrator has already added the custom port (TCP 8443) to the SSL decryption policy, so the FTD is configured to inspect traffic on that port.
A Cisco ASA has three interfaces: inside (100), outside (0), and DMZ (50). A static NAT rule is configured to map the DMZ server 10.1.1.10 to outside address 200.1.1.10. An ACL on the outside interface permits traffic to 200.1.1.10. A host on the internet sends a packet to 200.1.1.10. What happens when the packet hits the outside interface?
Correct. Static NAT translates the destination to the DMZ IP and forwards the packet.
Why this answer
The ASA translates the destination address to the DMZ IP using the static NAT rule, then routes the packet to the DMZ interface. Security levels do not block because NAT is performed before routing.
A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?
Authorization policy defines what access is granted after authentication.
Why this answer
Authorization policies in Cisco ISE define the access permissions granted to authenticated users, such as allowing or denying network access. In this scenario, after a user authenticates via Active Directory (handled by the authentication policy), the authorization policy evaluates conditions (e.g., AD group membership) to enforce the required access control for the corporate wireless network.
Exam trap
The trap here is confusing authentication (verifying identity) with authorization (granting permissions), leading candidates to select authentication policy when the question explicitly asks about enforcing access control after authentication.
How to eliminate wrong answers
Option A is wrong because profiling policies are used to identify and classify endpoints based on attributes like MAC address or DHCP fingerprints, not to enforce access control based on user authentication. Option B is wrong because authentication policies only verify user credentials (e.g., against Active Directory) and determine the identity store to use, but they do not grant or deny network access; that is the role of authorization. Option D is wrong because a policy set is a container that groups authentication, authorization, and profiling policies together; it is not a specific policy that enforces access control based on user authentication.
A Cisco ESA administrator notices that a large number of emails with malicious attachments are being delivered to users. Which feature should be configured to inspect attachments in a sandbox environment before delivery?
ESA can leverage AMP to sandbox attachments.
Why this answer
Cisco ESA can integrate with AMP (Advanced Malware Protection) to sandbox and analyze attachments.
An organization wants to implement multi-factor authentication (MFA) for administrative access to network devices. Which two methods can be used with Cisco Duo to provide MFA for admin access? (Choose two.)
Duo Mobile push is a common MFA method for admin access.
Why this answer
Push notification is correct because Cisco Duo can send a push notification to the Duo Mobile app on the administrator's smartphone. The admin approves or denies the login attempt directly from the app, providing a seamless and secure second factor for authentication to network devices.
Exam trap
Cisco often tests the distinction between Duo-supported MFA methods (push, TOTP, phone callback) and methods that are either deprecated (SMS) or not directly supported (biometrics, bypass codes) for administrative access to network devices.
An organization uses ISE for wireless LAN authentication via 802.1X with PEAP-MSCHAPv2. Users authenticate against Active Directory. Recently, some users report that after changing their domain password, they cannot connect to the wireless network for about 30 minutes. What is the most likely cause?
ISE caches credentials to improve performance; after a password change, the cached old password is still used until the cache refreshes, causing a delay of about 30 minutes.
Why this answer
ISE caches user credentials for efficiency, including the password used during 802.1X authentication. When a user changes their domain password, ISE may still have the old password cached and will attempt to authenticate with it until the cache expires (typically up to 30 minutes). Option A is incorrect because DNS updates are not related to cached passwords; stale DNS records would affect all users, not just those with recent password changes.
Option C is incorrect because wireless controllers do not cache passwords for 802.1X; they forward credentials to the RADIUS server (ISE). Option D is incorrect because the RADIUS server (ISE) is the one caching credentials, not the wireless controller.
Which THREE of the following are valid methods to deploy Cisco AMP for Endpoints Connector on Windows endpoints?
Valid method via AD GPO.
Why this answer
Group Policy Software Installation (MSI) is a valid deployment method for Cisco AMP for Endpoints Connector on Windows endpoints because it allows administrators to distribute the AMP connector MSI package via Active Directory Group Policy Objects (GPOs). This method leverages Windows Installer technology for silent, automated installation across domain-joined machines, ensuring consistent deployment without user interaction.
Exam trap
Cisco often tests the distinction between network management tools (Prime Infrastructure, DNA Center) and endpoint deployment tools (Group Policy, SCCM, manual installation), expecting candidates to recognize that AMP for Endpoints is an endpoint security product deployed via standard Windows software distribution methods, not via Cisco's network infrastructure platforms.
A company uses Cisco Web Security Appliance (WSA) to filter web traffic. The security team wants to block access to a specific category of websites (e.g., 'Social Networking') for all users except the HR department. Which WSA feature should be used to achieve this policy?
Identity-based policies can apply different rules to different user groups based on authentication.
Why this answer
Identity-based policies in Cisco WSA allow you to apply different access rules based on the user or group identity, typically authenticated via Active Directory or LDAP. By creating an identity-based policy that exempts the HR department (e.g., via an AD group) and blocks the 'Social Networking' category for all other users, you achieve the required granular control without affecting the entire organization.
Exam trap
Cisco often tests the distinction between identity-based policies and global access policies, trapping candidates who think a global policy can be applied with exceptions, when in fact identity-based policies are required for user-specific exemptions.
How to eliminate wrong answers
Option A is wrong because routing policy controls how traffic is forwarded (e.g., next-hop or proxy chaining), not the per-user or per-group web access rules. Option B is wrong because decryption policy manages SSL/TLS interception and certificate handling, not category-based blocking based on user identity. Option D is wrong because global access policy applies uniformly to all traffic without user or group differentiation, so it cannot selectively exempt the HR department.
A company wants to implement a Zero Trust architecture. Which THREE principles should be included? (Choose three.)
Users and devices get only necessary permissions.
Why this answer
Zero Trust core principles: never trust, always verify; least privilege; microsegmentation. Defense in depth is a separate concept.
Correct. Duo provides MFA for AnyConnect VPN.
Why this answer
Cisco Duo is the correct answer because it is the Cisco product specifically designed to integrate with AnyConnect for multi-factor authentication (MFA). Duo provides push notifications, one-time passwords (OTP), and other MFA methods by acting as an authentication proxy that validates secondary factors via RADIUS or SAML before allowing VPN access.
How to eliminate wrong answers
Option A is wrong because Cisco ISE is a policy and access control platform that can enforce MFA but does not natively provide push notifications or OTP generation; it typically integrates with an external MFA provider like Duo for those capabilities. Option B is wrong because Cisco SecureX is a cloud-native security platform that provides visibility and orchestration across security products, not a dedicated MFA solution for AnyConnect VPN. Option D is wrong because Cisco AMP for Endpoints is an endpoint protection platform focused on malware detection and threat prevention, not authentication or MFA.
An organization is using Cisco ESA and wants to ensure that outgoing emails containing credit card numbers are blocked before leaving the network. Which feature should be configured?
DLP inspects content for sensitive data patterns.
Why this answer
Cisco ESA uses Data Loss Prevention (DLP) policies to inspect outgoing email content for sensitive data such as credit card numbers. DLP can identify patterns (e.g., 16-digit card numbers) using predefined or custom dictionaries and enforce actions like blocking, quarantining, or encrypting the message before it leaves the network. Anti-Spam, Encryption, and Anti-Virus policies do not perform content-based pattern matching for sensitive data.
Exam trap
Cisco often tests the distinction between DLP (content inspection for sensitive data) and encryption (protecting data in transit), leading candidates to mistakenly choose Encryption policies when the goal is to block or prevent data exfiltration, not just secure the channel.
How to eliminate wrong answers
Option A is wrong because Anti-Spam policies are designed to filter inbound unwanted bulk email using reputation filters and content analysis, not to detect sensitive data patterns in outbound messages. Option C is wrong because Encryption policies control whether a message is encrypted during transit (e.g., via TLS or S/MIME), but they do not inspect the message body for credit card numbers or enforce blocking based on content. Option D is wrong because Anti-Virus scanning detects malware attachments and malicious code, not structured data like credit card numbers.
A network administrator is configuring Cisco ISE for guest access. The company requires a solution where guests can create their own accounts and receive network access after a sponsor approves. Which two components must be configured? (Choose two.)
Correct. Allows guests to create their own accounts.
Why this answer
To allow guests to self-register and have a sponsor approve, ISE needs a self-registration portal and a sponsor portal.
Which Cisco technology uses SHA-256 file hashes to determine if a file is malicious by querying a cloud database?
AMP for Email sends file SHA-256 to the cloud for analysis.
Why this answer
AMP for Email uses SHA-256 cloud lookup to compare file hashes against known threats.
A network administrator needs to configure Cisco WSA to decrypt HTTPS traffic for inspection. What is the first step that must be completed?
This allows the WSA to act as a trusted man-in-the-middle.
Why this answer
The first step in configuring Cisco WSA for HTTPS decryption is to install a Certificate Authority (CA) certificate on the WSA and distribute it to client devices. This establishes trust because the WSA acts as a man-in-the-middle, generating a new certificate for each HTTPS session signed by this CA; without the CA certificate in the clients' trusted root store, browsers will display certificate warnings and block the connection.
Exam trap
Cisco often tests the misconception that you first need to configure an ACL or bypass list before installing the CA certificate, but the fundamental prerequisite is establishing trust through certificate installation, otherwise decryption cannot function at all.
How to eliminate wrong answers
Option A is wrong because creating a bypass list for internal sites is an optional step to exclude certain traffic from decryption, not the prerequisite for enabling HTTPS decryption itself. Option B is wrong because an Access Control List (ACL) is used for traffic filtering or redirection, not for authorizing decryption; decryption is controlled by policies on the WSA, not by ACLs. Option D is wrong because user authentication is a separate feature for identity-based policies and is not required to perform HTTPS decryption; decryption can function without any authentication configured.
A company uses FMC to manage FTD devices. After deploying a new intrusion policy, the analyst sees that no events are generated for a known vulnerability, even though the policy includes a rule for it. The analyst checks and the rule is enabled and the policy is applied. What is the most likely cause?
If an access control rule denies or fast-paths traffic, it never reaches the intrusion policy for inspection.
Why this answer
In a Cisco Firepower deployment, the access control policy (ACP) is evaluated before the intrusion policy. If the ACP is configured to block traffic matching the vulnerability's characteristics, the traffic never reaches the intrusion policy for inspection, so no intrusion events are generated even if the intrusion rule is enabled and applied.
Exam trap
The trap here is that candidates assume an enabled intrusion rule guarantees event generation, forgetting that the access control policy acts as a gatekeeper that can block traffic before it reaches the intrusion engine.
How to eliminate wrong answers
Option A is wrong because inline tap mode allows traffic to pass through without being dropped, but it still generates events; 'Drop and Generate Events' in inline tap mode would still generate events, not suppress them. Option B is wrong because FTD devices do not require a reboot after policy deployment; changes are applied via the Snort process restart or policy reload, not a full device reboot. Option D is wrong because false-positive suppression would suppress events for a rule that is generating alerts, but the scenario states no events are generated at all, indicating the traffic never reaches the intrusion rule, not that events are suppressed after generation.
An administrator notices that some users receive spam messages even though the ESA policy is set to 'Quarantine' for suspected spam. The messages are not found in the user's spam quarantine. What is the most likely cause?
A listener with anti-spam disabled will deliver without scanning.
Why this answer
If incoming mail is received on a mail policy (listener) that does not have the anti-spam engine enabled, the ESA will not apply any spam filtering to those messages. Even though the global or default policy may be set to 'Quarantine', the listener configuration determines which security services are invoked. Without the anti-spam engine on that listener, messages bypass spam detection entirely and are delivered directly to the user's inbox, never appearing in the spam quarantine.
Exam trap
Cisco often tests the distinction between global policy settings and per-listener service enablement, trapping candidates who assume that configuring a quarantine action in the mail policy automatically applies to all incoming mail paths.
How to eliminate wrong answers
Option A is wrong because an allow list entry would bypass spam filtering and deliver the message to the inbox, but the question states the messages are spam and not found in quarantine; an allow list would explain delivery but not the absence from quarantine, and the administrator would typically see the allow list entry. Option B is wrong because setting the spam threshold too low (i.e., a lower score required to classify as spam) would actually cause more messages to be flagged as spam and sent to quarantine, not fewer. Option C is wrong because outdated anti-spam engine signatures would likely result in false negatives (spam not detected), but the messages are still processed by the anti-spam engine; they would either be quarantined or delivered based on the policy, not bypass quarantine entirely.
A company uses Cisco Umbrella to protect remote users. They want to ensure that SSL-encrypted traffic to malicious websites is inspected, but without breaking compliance with privacy regulations. Which Umbrella feature should they enable?
Intelligent Proxy selectively intercepts and inspects SSL traffic based on policy.
Why this answer
Intelligent Proxy allows selective SSL inspection based on policy, balancing security and privacy.
During 802.1X authentication, which component acts as the intermediary that forwards authentication requests between the client and the authentication server?
The authenticator is the network device that enforces access control and relays EAP frames.
Why this answer
In the 802.1X architecture, the authenticator (typically a switch or wireless LAN controller) is the network device that relays EAP messages between the supplicant and the authentication server (e.g., ISE).
A company is implementing a Zero Trust architecture. Which THREE principles are core to the Zero Trust model? (Choose three.)
This is the fundamental principle of Zero Trust.
Why this answer
Zero Trust is built on the principles of never trust, always verify; least privilege; and microsegmentation to enforce granular access controls.
An organization wants to implement a security model where no user or device is trusted by default, regardless of whether they are inside or outside the network perimeter. Which concept does this describe?
Zero Trust enforces 'never trust, always verify'.
Why this answer
Zero Trust assumes no implicit trust and verifies every access request.
A company wants to implement two-factor authentication for remote VPN access using Cisco AnyConnect. They need a solution that supports push notifications to a mobile app. Which Cisco product meets this requirement?
Duo provides MFA including push notifications, TOTP, and hardware tokens, and integrates with AnyConnect.
Why this answer
Cisco Duo provides multi-factor authentication with push notifications, TOTP, and other methods, and integrates with AnyConnect VPN.
Which THREE are valid components of an IKEv2 exchange? (Choose three.)
First pair of messages to negotiate cryptographic parameters and exchange nonces.
Why this answer
IKEv2 simplifies the Internet Key Exchange process by using only two exchanges to establish an IPsec security association: the IKE_SA_INIT exchange (for negotiating cryptographic parameters and exchanging Diffie-Hellman public values) and the IKE_AUTH exchange (for authenticating the peers and establishing the first child SA). These are the mandatory exchanges defined in RFC 7296, making options C and D correct. The INFORMATIONAL exchange is also a valid component of IKEv2, used for error reporting and deleting SAs, which is why option E is correct.
Exam trap
Cisco often tests the distinction between IKEv1 and IKEv2 phases, and the trap here is that candidates familiar with IKEv1 mistakenly select Main Mode or Aggressive Mode as valid IKEv2 components, not realizing IKEv2 uses entirely different exchange names.
A company uses Cisco Secure Workload to enforce microsegmentation across multiple AWS accounts. After enabling enforcement, they find that the policies are only applied to workloads in the primary account. What is the most likely reason?
Without a cloud connector for each account, Secure Workload cannot discover or enforce policies on those workloads.
Why this answer
Cisco Secure Workload (formerly Tetration) uses cloud connectors to integrate with AWS accounts and discover workloads. When enforcement is enabled, the policies are applied only to workloads in the primary account because the cloud connector has not been configured for the secondary AWS accounts. Without the connector, the platform cannot manage or enforce policies on workloads outside the primary account.
Exam trap
Cisco often tests the misconception that agent registration alone is sufficient for enforcement across accounts, but the cloud connector is the critical component for multi-account discovery and policy application.
How to eliminate wrong answers
Option A is wrong because policy labels are propagated automatically once the cloud connector is configured and agents are registered; labels not propagating would affect policy matching, not enforcement scope. Option B is wrong because agents in secondary accounts can be registered independently, but without a cloud connector, the platform cannot discover or manage those accounts to enforce policies. Option C is wrong because the enforcement scope is not limited to a single VPC; Cisco Secure Workload can enforce across multiple VPCs and accounts if the cloud connector is properly configured.
An engineer is configuring a Cisco ASA for site-to-site IKEv2 VPN with a VTI. Which two statements about VTI are true? (Choose two.)
Correct; VTI uses an IPsec profile for IKEv2.
An engineer is configuring Cisco ISE for guest access. The requirement is that guests must accept an acceptable use policy (AUP) before being granted network access. Which portal type should be used?
Allows guests to register and accept AUP.
Why this answer
The self-registration guest portal is the correct choice because it allows guests to create their own credentials and, crucially, includes a configurable step where the user must accept an Acceptable Use Policy (AUP) before being granted network access. This portal type is specifically designed for scenarios where guests self-onboard and must acknowledge a policy, which is a core requirement for compliance in many guest access deployments.
Exam trap
The trap here is that candidates often confuse the 'hotspot guest portal' (which also shows a splash page) with the self-registration portal, but the hotspot portal does not require the user to create credentials or formally accept an AUP as a registration step—it only provides a simple click-through without identity creation.
How to eliminate wrong answers
Option A is wrong because a sponsored guest portal requires an existing employee (sponsor) to create the guest account, and while it can include an AUP, the primary mechanism for guest self-service with mandatory AUP acceptance is the self-registration portal, not the sponsored flow. Option B is wrong because a hotspot guest portal provides open, unauthenticated access (often with a simple click-through splash page) and does not require user registration or credential creation, so it lacks the self-registration step where an AUP is typically enforced. Option C is wrong because a BYOD portal is used for onboarding personal devices into the corporate network with certificate provisioning or posture assessment, not for guest access scenarios where an AUP must be accepted before network access is granted.
Refer to the exhibit. What is the effect of this NAT rule on the Cisco FTD device deployed in the cloud?
The 'static' keyword with same IP on both sides indicates identity NAT.
Why this answer
The NAT rule shown in the exhibit is a static identity NAT (also known as NAT exempt or no-translation NAT) that translates the source IP address of traffic from the 192.168.1.0/24 network to the same IP address when going to the 10.0.0.0/24 network. This is achieved by specifying the source address as both the original and translated address, effectively bypassing any address translation while still being processed by the NAT engine. Since no port translation is configured, it performs identity NAT without PAT, which is why option A is correct.
How to eliminate wrong answers
Option B is wrong because identity NAT translates the source IP when traffic goes from inside to outside (not outside to inside), and the rule specifically applies to traffic originating from the 192.168.1.0/24 network. Option C is wrong because identity NAT explicitly disables Port Address Translation (PAT) by mapping the source address to itself, so no port translation occurs. Option D is wrong because the rule translates the source IP (not destination IP) from 192.168.1.0 to itself, and the destination network 10.0.0.0/24 remains untranslated.
A security engineer is configuring Cisco Web Security Appliance (WSA) to block access to social media sites during business hours. The company wants to allow access to LinkedIn for the HR department. Which policy configuration approach should the engineer use?
Time-based policies restrict access during specific hours, and identity policies can exempt HR.
Why this answer
Cisco WSA uses a hierarchical policy model where time-based access policies control when traffic is allowed or blocked, and identity-based policies (using authentication or IP ranges) provide granular exceptions for specific user groups like HR. By combining a time-based policy to block social media during business hours and an identity-based policy to allow LinkedIn for HR, the engineer achieves the requirement without over-permitting access. This approach leverages WSA's ability to evaluate multiple policy types in order, ensuring the HR exception takes precedence for LinkedIn traffic.
Exam trap
Cisco often tests the distinction between global exceptions (which apply to all users) and identity-based exceptions (which apply to specific groups), leading candidates to incorrectly choose a global exception when a group-specific exception is required.
How to eliminate wrong answers
Option B is wrong because HTTPS decryption is not required to block social media based on URL categories; WSA can block social media using URL filtering without decrypting traffic, and enabling decryption unnecessarily adds complexity and privacy concerns. Option C is wrong because creating a global URL filtering policy to block social media and adding an exception for LinkedIn would allow LinkedIn for all users, not just HR, violating the requirement for HR-only access. Option D is wrong because Data Loss Prevention (DLP) is designed to prevent sensitive data exfiltration, not to block access to entire websites or categories like social media; DLP policies inspect content within allowed traffic, not enforce URL-based access controls.
An engineer is configuring Cisco Secure Endpoint (AMP) connectors. Which deployment is supported for the macOS platform?
macOS is one of the supported platforms for Cisco Secure Endpoint.
Why this answer
Cisco Secure Endpoint connectors are available for Windows, Mac, Linux, Android, and iOS. macOS is supported.
To protect against phishing attacks that use fraudulent emails to trick users into revealing credentials, which email authentication technology verifies the sending domain's DNS records for a digital signature?
DKIM adds a digital signature to the email header, verified via DNS.
Why this answer
DKIM (DomainKeys Identified Mail) uses a digital signature to verify that an email originated from the claimed domain. SPF (Sender Policy Framework) verifies the sending IP address against authorized IP lists but does not use a digital signature. DMARC builds on both SPF and DKIM.
Therefore, the correct answer is D.
An organization wants to deploy endpoint hardening by allowing only approved applications to run. Which technology should be implemented to achieve this?
Application whitelisting ensures only approved applications can run.
Why this answer
Application whitelisting is the correct technology because it enforces endpoint hardening by explicitly allowing only approved applications to execute, blocking all others by default. This is a fundamental principle of least privilege and is often implemented using tools like Windows AppLocker or Cisco AMP's application control, which maintain a hash-based or path-based allow list.
Exam trap
Cisco often tests the misconception that endpoint hardening is achieved by detection-based tools like EDR or antivirus, when the question specifically asks for a preventive control that blocks unapproved applications from running at all.
How to eliminate wrong answers
Option A is wrong because EDR (Endpoint Detection and Response) focuses on monitoring, detecting, and responding to threats after execution, not on preventing unapproved applications from running. Option B is wrong because Host-based IPS (Intrusion Prevention System) analyzes network traffic and system calls for malicious patterns but does not control which applications are allowed to execute. Option C is wrong because Antivirus software relies on signature-based or heuristic detection to block known malware, but it does not prevent the execution of unapproved but non-malicious applications.
In a Cisco ISE deployment, a network administrator needs to dynamically change the VLAN assignment for an endpoint after a posture assessment determines that the endpoint is non-compliant. Which ISE feature enables this dynamic change without re-authentication?
Correct. CoA enables real-time policy changes after posture assessment.
A DevOps team is deploying containers in Kubernetes and needs to enforce network security policies between pods. Which Cisco solution is designed for this?
Tetration provides micro-segmentation and policy enforcement for containers.
Why this answer
Cisco Secure Workload (formerly Tetration) is the correct answer because it provides micro-segmentation and network policy enforcement for containerized environments like Kubernetes. It uses agent-based and agentless sensors to map all inter-pod traffic flows and enforce whitelist-based policies at the kernel level via eBPF or iptables, ensuring zero-trust between pods without requiring changes to the underlying network fabric.
How to eliminate wrong answers
Option A is wrong because Cisco Cloudlock is a cloud access security broker (CASB) focused on securing SaaS applications and user access, not on enforcing network policies between Kubernetes pods. Option B is wrong because Cisco Umbrella is a DNS-layer cloud security solution that provides internet threat protection and web filtering, not micro-segmentation or pod-to-pod policy enforcement. Option D is wrong because Cisco Firepower NGFW is a physical or virtual firewall designed for perimeter and data center network segmentation, not for granular, workload-level policy enforcement within a Kubernetes cluster's overlay network.
Which of the following is a characteristic of a 'false negative' in intrusion detection?
Correct. False negative means missing an attack.
A company has deployed Cisco AMP for Endpoints and wants to receive immediate notification when a file is detected as malicious by the cloud sandbox analysis. Which policy setting should be enabled?
This setting triggers alerts when a file is determined malicious by cloud sandbox.
Why this answer
The 'Send alerts for malicious files' setting in the AMP for Endpoints policy directly controls whether the connector sends a real-time alert to the management console when a file is determined to be malicious by the cloud sandbox (e.g., Threat Grid). This ensures immediate notification without relying on periodic polling or batch reporting.
Exam trap
Cisco often tests the distinction between 'Analyze' mode (which enables file submission to the cloud) and the separate alerting toggle, leading candidates to mistakenly think that enabling analysis automatically generates alerts for malicious verdicts.
How to eliminate wrong answers
Option B is wrong because Syslog forwarding sends all event logs to an external server, but it does not provide immediate notification within the AMP console; it is a logging mechanism, not an alerting trigger for sandbox verdicts. Option C is wrong because 'Exploit Prevention' in block mode is a protection feature that blocks exploit techniques at runtime, not a notification setting for cloud sandbox analysis results. Option D is wrong because setting the connector to 'Analyze' mode causes it to send files to the cloud for analysis but does not automatically enable immediate alerts for malicious verdicts; alerting is a separate policy toggle.
During a security incident, it is observed that a server behind a Cisco ASA is being accessed repeatedly with different source IPs in a short time. The firewall logs show many dropped packets to the server's IP on port 443. What is the most effective mitigation to reduce the impact while maintaining legitimate access?
TCP Intercept mitigates SYN floods by intercepting and verifying connections.
Why this answer
TCP Intercept with a low threshold is the most effective mitigation because it protects the server from a SYN flood attack by intercepting TCP SYN packets and completing the three-way handshake on behalf of the server. This allows legitimate traffic to proceed while dropping excessive SYN requests from rapidly changing source IPs, which is exactly the behavior described in the scenario. Unlike other options, TCP Intercept dynamically manages connection attempts without blocking all unknown sources or disrupting legitimate access.
Exam trap
Cisco often tests the distinction between reactive mitigation (TCP Intercept) and static or blocking measures, leading candidates to choose access-lists or null routes that completely deny access instead of dynamically protecting the server.
How to eliminate wrong answers
Option A is wrong because increasing the connection timeout would only keep stale connections open longer, potentially exhausting resources and worsening the impact of the attack. Option B is wrong because implementing an access-list to allow only known source IPs is impractical for a public-facing server on port 443 (HTTPS), as it would block legitimate clients with unknown IPs and break normal web access. Option C is wrong because configuring a static route to null0 for the server's IP would drop all traffic to that server, including legitimate traffic, effectively taking the server offline rather than mitigating the attack while maintaining access.
An administrator is configuring DLP on the Cisco ESA to block social security numbers (SSNs) in outgoing email. The policy is set to 'Drop' for SSN matches, but some emails containing SSNs are still being delivered. What step should the administrator take to troubleshoot?
If not assigned, DLP rules won't apply.
Why this answer
The most likely reason SSNs are still being delivered is that the DLP policy is not actually applied to the outgoing mail policy. Even if the DLP policy is configured to 'Drop' for SSN matches, it will have no effect unless it is enabled and explicitly assigned to the mail policy that governs outbound messages. Without this assignment, the ESA will not inspect messages against the DLP dictionary, allowing SSNs to pass through.
Exam trap
Cisco often tests the distinction between configuring a feature (e.g., creating a DLP policy) and actually applying it to a mail policy, leading candidates to overlook the assignment step and focus on unrelated settings like message size or encryption.
How to eliminate wrong answers
Option A is wrong because increasing the message size limit in the mail flow policy would not prevent DLP from scanning or dropping messages; it only affects whether large messages are accepted or rejected before DLP processing. Option C is wrong because TLS is a transport encryption protocol and has no bearing on DLP content inspection or the enforcement of a 'Drop' action. Option D is wrong because the default SSN patterns in the DLP dictionary are already comprehensive; adding more patterns would not resolve the issue if the policy itself is not enabled or assigned to the outgoing mail policy.
A DevOps team is deploying containerized applications on Kubernetes and needs to ensure that only authorized images are run. Which solution should they integrate with Kubernetes to enforce image trust and scanning?
CWP provides image scanning and admission control for containers.
Why this answer
Cisco Cloud Workload Protection (CWP) is the correct solution because it provides integrated image scanning, vulnerability assessment, and trust enforcement for containerized workloads in Kubernetes. CWP uses a policy-based admission controller to block deployments of unauthorized or vulnerable images before they run, directly addressing the requirement to ensure only authorized images are executed.
Exam trap
Cisco often tests the distinction between network security tools (Stealthwatch, Firepower, Umbrella) and workload-specific security solutions (CWP), leading candidates to pick a familiar name like Firepower or Umbrella instead of the correct container-focused product.
How to eliminate wrong answers
Option A is wrong because Cisco Stealthwatch Cloud is a network traffic analysis and anomaly detection tool for cloud environments, not an image trust or scanning solution for Kubernetes. Option C is wrong because Cisco Firepower Next-Generation Firewall is a network security appliance focused on perimeter traffic inspection and intrusion prevention, not container image authorization. Option D is wrong because Cisco Umbrella is a cloud-delivered DNS-layer security and web gateway service, not a container image trust enforcement mechanism.
During an email security audit, it is discovered that encrypted emails sent between two partners are being silently dropped by the Cisco ESA. The ESA uses a policy that decrypts incoming S/MIME messages for scanning. What is the most likely cause of the dropped messages?
S/MIME decryption requires trusting the sender's certificate; otherwise, it may drop.
Why this answer
The Cisco ESA decrypts incoming S/MIME messages to perform content scanning. If the sender's certificate is not trusted by the ESA (i.e., not in the ESA's trusted certificate store or the certificate chain cannot be validated), the ESA cannot decrypt the message. This causes the message to be silently dropped because the policy requires decryption for scanning, and failure to decrypt results in the message being discarded rather than delivered.
Exam trap
The trap here is confusing transport-layer encryption (TLS) with message-level encryption (S/MIME), leading candidates to incorrectly select Option D, when the core issue is the ESA's inability to decrypt the S/MIME message due to an untrusted sender certificate.
How to eliminate wrong answers
Option A is wrong because re-encryption of outbound messages occurs after scanning and does not cause inbound messages to be dropped; it is a separate policy action. Option C is wrong because encrypted attachments exceeding size limits would trigger a different policy action (e.g., bounce or quarantine), not silent dropping, and the question states the entire email is dropped, not just the attachment. Option D is wrong because TLS is used for transport encryption between MTAs, not for S/MIME message decryption; an untrusted TLS certificate would cause a connection failure, not silent dropping of already-received S/MIME messages.
A security analyst sees multiple AMP events for 'Trojan.Generic.37283212' on several endpoints. After updating the AMP signatures, the detection still occurs. What is the best next step to reduce false positives?
Whitelisting the specific file hash prevents future false positives while retaining protection.
Why this answer
Adding the file SHA256 hash to the Custom Whitelist in the AMP policy explicitly tells the AMP cloud to ignore that specific file, preventing false positives without disabling broader protections. Since the detection persists after signature updates, the file is likely a legitimate application that is being incorrectly flagged by the generic heuristic signature 'Trojan.Generic.37283212'. Whitelisting the exact hash ensures that only this file is exempted, maintaining security for other threats.
Exam trap
Cisco often tests the distinction between disabling a broad signature (which is too aggressive) and using a precise hash-based whitelist (which is the correct, surgical approach to handle false positives).
How to eliminate wrong answers
Option A is wrong because waiting for a future signature update is passive and does not address the immediate false positive; the detection may not be removed if the file is still considered suspicious by the heuristic engine. Option C is wrong because disabling the entire 'Trojan.Generic' signature would remove detection for all files matching that broad category, potentially allowing real trojans to go undetected. Option D is wrong because reinstalling the AMP connector does not change the detection logic or the signature database; the false positive would still occur after reinstallation.
Which THREE of the following are features of Cisco Identity Services Engine (ISE) that can be used to enforce network access control?
ISE can profile endpoints to identify device type and OS.
Why this answer
Profiling is a core ISE feature that uses passive and active fingerprinting techniques (e.g., DHCP, HTTP, SNMP, NetFlow) to identify endpoint attributes such as operating system, device type, and MAC vendor. This identity context allows ISE to enforce granular access policies based on the device class, such as blocking IoT sensors from reaching critical servers.
Exam trap
Cisco often tests the distinction between ISE's identity-based enforcement features (profiling, posture, guest) and network-layer monitoring tools (NetFlow, application visibility) that belong to other products like Stealthwatch or Firepower.
A security engineer is configuring a cloud access security broker (CASB) to protect a SaaS application used by employees. The primary concern is to prevent sensitive data from being uploaded to the application. Which deployment mode should the engineer choose?
API mode allows data inspection at rest and can block uploads via API calls.
Why this answer
API-based mode connects directly to the SaaS application's APIs, allowing the CASB to scan data at rest and in transit using the application's native APIs (e.g., REST or Graph APIs). This mode can block uploads by enforcing data loss prevention (DLP) policies directly within the SaaS application, without requiring traffic redirection or proxy configuration. It is the most effective deployment mode for preventing sensitive data from being uploaded, as it can inspect and block data at the point of storage.
Exam trap
Cisco often tests the misconception that forward proxy mode is the best for all data protection scenarios, but the trap here is that API-based mode is specifically designed for deep integration with SaaS applications to prevent data uploads, while forward proxy mode is limited to inline traffic inspection and cannot block data already submitted via API calls.
How to eliminate wrong answers
Option A is wrong because forward proxy mode intercepts user traffic before it reaches the SaaS application, but it requires client-side configuration (e.g., PAC files or browser proxy settings) and cannot inspect data already encrypted by the SaaS application's API calls; it is better suited for shadow IT discovery and inline traffic inspection, not for blocking uploads via API-level controls. Option C is wrong because reverse proxy mode sits in front of the SaaS application and inspects incoming traffic from users, but it does not have direct access to the SaaS application's internal APIs and cannot block data uploads at the storage layer; it is typically used for access control and threat protection. Option D is wrong because Web application firewall (WAF) mode filters HTTP traffic to the application at the network layer, focusing on web-based attacks (e.g., SQL injection, XSS) rather than data loss prevention; it cannot inspect or block sensitive data within API payloads or file uploads.
A company with 500 employees uses Cisco Web Security Appliance (WSA) as a proxy. They have a policy to block access to social media sites during working hours (9 AM - 5 PM) for all users except the marketing team. The marketing team must have unrestricted access at all times. The WSA is configured with a time-based access policy that blocks the 'Social Networking' category from 9 AM to 5 PM, and an identity policy that identifies the marketing team by Active Directory group. However, marketing users report that they are blocked from social media during working hours. What is the most likely cause?
If the identity policy uses 'Use Global Policy', the time-based block from the global policy applies, blocking marketing users.
Why this answer
When an identity policy is set to 'Use Global Policy' for a specific category, it defers to the global access policy, which in this case includes the time-based block for social networking. Since the marketing team's identity policy does not explicitly override the global policy with an 'Allow' or 'Monitor' action for the 'Social Networking' category, the time-based block applies to them as well.
Exam trap
The trap here is that candidates often confuse identity policies with access policies, thinking that identifying a user group automatically grants them different access, when in fact the identity policy must be paired with a separate access policy that explicitly overrides the global policy.
How to eliminate wrong answers
Option A is wrong because the issue is not that the identity policy lacks an explicit 'Monitor' or 'Allow' action; rather, the identity policy is set to 'Use Global Policy', which causes the global time-based block to apply. Option B is wrong because the WSA does require authentication for identity-based policies, but the marketing users are likely authenticating successfully (otherwise they would not be identified as marketing users at all); the problem is the policy action, not authentication failure. Option D is wrong because if the Active Directory group were not recognized, the marketing users would not be identified by the identity policy at all, and they would likely fall into a default policy that also blocks social media; however, the question states they are identified as marketing users but still blocked, indicating the group is recognized.
A security team deploys Cisco AMP for Endpoints and wants to detect and block memory injection attacks. Which AMP feature should be enabled to achieve this?
Exploit Prevention specifically blocks memory injection and exploit techniques.
Why this answer
Exploit Prevention in Cisco AMP protects against memory injection and other exploit techniques.
An engineer is configuring a Cisco ASA and needs to ensure that traffic from the outside interface to a web server on the DMZ is allowed. The inside interface is security level 100 and the DMZ is level 50. The outside interface is level 0. Which statement about the default traffic flow is true?
Correct. ASA defaults deny traffic from lower to higher security levels.
Why this answer
By default, the ASA permits traffic from higher security levels to lower security levels without an ACL. However, traffic from lower to higher levels is implicitly denied. Since outside (0) is lower than DMZ (50), an ACL is required.
A network engineer is troubleshooting an issue where users on a specific VLAN cannot access the internet through a Cisco ASA firewall. The ASA has a default route pointing to the ISP router. The security policy includes an ACL that permits all traffic from the inside interface to the outside interface. What is the most likely cause of the problem?
Without NAT, private IP addresses cannot reach the internet because they are not routable.
Why this answer
The most likely cause is that NAT is not configured. Even though the ACL permits all traffic from inside to outside, the Cisco ASA requires NAT (or a NAT exemption rule) to translate private IP addresses to a routable public IP address when traffic traverses from a higher-security interface (inside) to a lower-security interface (outside). Without NAT, the ASA will drop the packets because it cannot determine how to route the private source addresses on the public internet, and the return traffic would have no way to reach the internal hosts.
How to eliminate wrong answers
Option A is wrong because the default route is correctly pointing to the ISP router, and the issue is not about routing to the next hop but about address translation. Option B is wrong because DNS resolution is a separate function; even if DNS fails, users could still access the internet via IP addresses, and the problem states they cannot access the internet at all. Option D is wrong because the ACL explicitly permits all traffic from inside to outside, so it is not blocking the traffic.
HTTPS traffic typically uses port 443. If the decryption policy does not include port 443, it will not be decrypted.
Why this answer
In transparent proxy mode, SSL decryption requires that the WSA is positioned in the traffic path (e.g., via WCCP). If decryption is not happening, the WSA may not be intercepting the traffic correctly, often due to the destination port not being included in the decryption policy or the traffic being non-HTTP.
A large enterprise with over 2,000 employees recently experienced a security breach. An attacker gained initial access through a phishing email and then moved laterally across the network to reach a critical database server. The network currently has a flat Layer 2 topology with all devices in a single large VLAN. The company wants to prevent lateral movement in the future while maintaining operational simplicity. They have a Cisco ISE deployment already but it is only used for wireless guest access. The security team is evaluating options. Option A: Deploy 802.1X with dynamic VLAN assignment across all wired ports. This would authenticate users and assign them to different VLANs based on identity. Option B: Implement micro-segmentation using Cisco TrustSec with Security Group Tags (SGTs) on the existing switches and enforce SGT-based policies on the firewalls. This would allow traffic control between groups regardless of IP. Option C: Install a next-generation firewall at the internet edge and enable IPS to block known attack signatures. Option D: Upgrade all access switches to support Private VLANs (PVLANs) and configure promiscuous ports for servers. Which solution BEST addresses the lateral movement problem while leveraging existing infrastructure?
SGTs allow traffic control based on group identity, preventing lateral movement even within the same subnet, and leverages existing ISE.
Why this answer
Cisco TrustSec with Security Group Tags (SGTs) enables micro-segmentation at Layer 2, allowing traffic control between user groups and servers based on identity rather than IP address. This directly prevents lateral movement by enforcing policies that restrict which endpoints can communicate, even within the same VLAN, and it leverages the existing Cisco ISE deployment for policy management without requiring major topology changes.
Exam trap
Cisco often tests the distinction between network segmentation (VLANs/802.1X) and micro-segmentation (TrustSec/SGTs), where the trap is that candidates assume VLAN-based isolation is sufficient to prevent lateral movement, but it fails when an attacker compromises a device within the same VLAN or when VLAN hopping is possible.
How to eliminate wrong answers
Option A is wrong because installing a next-generation firewall at the internet edge with IPS only inspects traffic entering or leaving the network; it does not control lateral movement within the internal flat Layer 2 network, so an attacker who has already gained access can still move freely between devices. Option B is wrong because Private VLANs (PVLANs) isolate ports within a VLAN but require promiscuous ports for servers, which creates a single point of compromise; they also do not provide identity-based policy enforcement and would require significant reconfiguration of all access switches, increasing complexity. Option C is wrong because 802.1X with dynamic VLAN assignment authenticates users and places them into different VLANs, but within a single VLAN, lateral movement is still possible; it does not provide granular per-flow or per-group segmentation like SGTs, and it relies on VLAN boundaries that can be bypassed by an attacker who compromises a device in a trusted VLAN.
A network engineer is troubleshooting an issue where an endpoint is failing to authenticate via 802.1X on a Cisco switch. The switch port is in unauthorized state. Which step should the engineer take first to identify the root cause?
ISE logs provide detailed failure reasons, often indicating the exact step where authentication fails. This is the best first step.
Why this answer
The correct first step is to check the ISE authentication logs for failure reasons because the switch port is already in an unauthorized state, meaning the 802.1X authentication process has failed. ISE (the RADIUS server) logs provide the most granular failure reason, such as invalid credentials, unknown client, or EAP method mismatch, which directly pinpoints the root cause. Checking the switch's RADIUS reachability or endpoint configuration would be premature without first understanding why authentication was denied.
Exam trap
Cisco often tests the principle of 'start at the most specific source of truth'—the trap here is that candidates jump to checking network connectivity (Option A) or client configuration (Option C) without first consulting the authentication server logs, which contain the definitive failure reason.
How to eliminate wrong answers
Option A is wrong because checking RADIUS server reachability from the switch is a lower-layer connectivity check that would not explain why authentication failed if the server is reachable; the switch port being unauthorized indicates the RADIUS server likely received and rejected the request. Option C is wrong because checking the endpoint's supplicant configuration is a valid step but should come after reviewing the authentication logs to confirm whether the failure is client-side or server-side. Option D is wrong because checking the CA server for certificate issues is only relevant if EAP-TLS or a certificate-based method is used, and it is not the first step without knowing the failure reason from ISE logs.
An organization wants to provide guest wireless access with a captive portal. Which Cisco ISE portal type should be used?
This portal allows guests to register themselves and create credentials.
Why this answer
(Self-Registered Guest Portal). This portal enables guests to self-register via a captive portal, creating their own credentials without needing a sponsor. Option A (Sponsored Guest Portal) requires an existing user to sponsor the guest.
Option B (Central Web Authentication Portal) is typically used for BYOD or device onboarding, not guest self-registration. Option C (Hotspot Guest Portal) provides simple internet access without any registration or authentication.
Which THREE components are part of a Cisco Cloud Web Security (CWS) deployment with on-premises connectors? (Choose three.)
The Connector sends traffic to the cloud scanning center.
Why this answer
The On-premises Connector appliance (option B) is a core component of a Cisco CWS deployment with on-premises connectors. It acts as a local proxy that forwards web traffic from users to the Cisco Cloud Scanning Center for threat inspection, while also caching content locally to reduce latency. This appliance integrates with existing network infrastructure to enable cloud-based web security without requiring full traffic redirection to the cloud.
Exam trap
Cisco often tests the distinction between the On-premises Connector appliance and the Cisco Web Security Appliance (WSA), as candidates may confuse the cloud-based CWS connector with the fully on-premises WSA solution.
An organization wants to restrict administrative access to Cisco network devices based on the time of day and source IP address. Which technology should be used?
TACACS+ allows granular control over administrative access, including time and source IP.
Why this answer
TACACS+ is the correct choice because it supports per-command authorization, which allows an administrator to define granular access policies based on attributes such as time of day and source IP address. This is achieved through the TACACS+ authorization process, where the AAA server evaluates the user's request against configured authorization rules before granting access to specific commands or sessions.
Exam trap
Cisco often tests the distinction between TACACS+ and RADIUS, where candidates mistakenly choose RADIUS-based options (like 802.1X) for device administration, not realizing that TACACS+ is the only protocol that supports per-command authorization and time-based access control for CLI access.
How to eliminate wrong answers
Option B is wrong because SNMPv3 with ACLs provides authentication and encryption for network management traffic but does not support per-command authorization or time-based access control for administrative CLI access. Option C is wrong because 802.1X with EAP-TLS is a port-based network access control method used for endpoint authentication at Layer 2, not for authorizing administrative commands on network devices. Option D is wrong because IPsec VPN with extended authentication secures remote connectivity and authenticates users, but it does not provide per-command authorization or time-of-day restrictions for device administration.
A security analyst wants to detect misconfigurations in cloud storage buckets using Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud). What must be configured first?
API integration retrieves metadata and configuration for misconfiguration detection.
Why this answer
Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) relies on API integration with the cloud provider (AWS, Azure, GCP) to pull metadata about cloud resources, including storage bucket configurations. By connecting to the cloud provider's API, the platform can continuously monitor for misconfigurations such as public read/write access, unencrypted buckets, or improper logging settings. Without this API connection, the platform cannot access the cloud provider's resource inventory or configuration state, making bucket misconfiguration detection impossible.
Exam trap
Cisco often tests the distinction between telemetry collection (flow logs, sensors) and cloud control plane integration (API), leading candidates to mistakenly choose a network-based option when the question specifically asks about configuration detection.
How to eliminate wrong answers
Option A is wrong because flow log export (e.g., VPC Flow Logs to S3) provides network traffic metadata, not storage bucket configuration data; Cisco Secure Cloud Analytics uses flow logs for traffic analysis, not for detecting bucket misconfigurations. Option B is wrong because installing a sensor in the cloud VPC captures network flows and host telemetry, but it does not have visibility into cloud control plane APIs or storage bucket settings; sensors are for traffic monitoring, not configuration auditing. Option C is wrong because a syslog collector ingests log messages from network devices or servers, but it does not interface with cloud provider APIs to retrieve bucket configurations; syslog is for event logging, not cloud resource metadata.
Practice 350-701 by domain
Target a specific domain to shore up weak areas.