Cisco SCOR / CCNP Security Core 350-701 (350-701) — Questions 376–450

Cisco SecureX integrates with CyberArk to provide PAM capabilities, including just-in-time access, session recording, and password vaulting. SecureX is the Cisco platform for threat response and security analytics.

In SaaS, the customer is responsible for managing data and access, while the provider handles the underlying infrastructure, application, and OS.

A CASB provides visibility, DLP, and threat detection for SaaS applications, helping control shadow IT and protect data.

Cisco WSA allows administrators to define decryption policies that selectively decrypt HTTPS traffic based on URL categories (e.g., Social Networking, Finance, Health). This granular control enables organizations to balance security inspection with privacy compliance, decrypting only high-risk categories while bypassing sensitive ones like banking or healthcare.

When using Cisco Firepower for traffic inspection in AWS, the Firepower instance must process all traffic traversing the virtual appliance. If the instance type (e.g., m5.large) is undersized relative to the throughput demands (e.g., exceeding 1 Gbps), packet processing will queue, causing increased latency. This is a common scaling issue in cloud migrations where on-premises traffic patterns are replicated without adjusting instance sizing.

The MPF configuration applies a protocol violation action to HTTP traffic; when a violation is detected, the ASA sends a TCP reset.

IMPERSONATION PROTECTION (BEC) and DMARC verification help detect spoofed executive emails. Outbreak filters and anti-spam may not catch targeted attacks.

Active reconnaissance involves direct interaction with the target, such as port scanning, to gather information.

Zero Trust is based on 'never trust, always verify' and least privilege access.

Cisco ESA uses Advanced Malware Protection (AMP) for Email, which performs SHA-256 cloud lookups to detect known malware.

The man-in-the-middle attack succeeded due to a forged certificate issued by a trusted CA, which directly implies that the CA's private key was compromised. The CA's private key is the root of trust in a PKI; if it is stolen, an attacker can sign fraudulent certificates that will be trusted by all clients that trust the CA. Without the private key, the attacker could not have created a valid forged certificate.

The authenticator (typically a switch or wireless LAN controller) acts as an intermediary, forwarding EAP messages between the supplicant and the authentication server (ISE).

Cisco Umbrella's Intelligent Proxy can selectively proxy traffic (including SSL inspection) based on categories, URL groups, or other policies. The roaming client enables off-network protection but does not handle selective SSL inspection. SIG includes firewall and proxy but selective inspection is via Intelligent Proxy.

CyberArk is a leading PAM solution that provides just-in-time access, session recording, and password vaulting. Cisco SecureX can integrate with CyberArk for unified visibility.

The recommended action to prevent a known false positive from being flagged again is to add the file's SHA-256 hash to the custom detection list with an 'Allow' or 'Uncategorized' disposition. This overrides the local or cloud-based verdict for that specific file, ensuring AMP for Endpoints treats it as clean without affecting global detection policies.

The 'authentication event no-response action authorize vlan 100' command configures the switch port to place the endpoint into a restricted VLAN (e.g., VLAN 100) when the supplicant fails to respond to 802.1X authentication requests. This is a valid method for handling authentication failures, specifically a 'no-response' scenario, by authorizing the port with a limited-access VLAN instead of denying all traffic.

DMARC reject policy handles spoofed domains; impersonation protection can catch display name spoofing; and anti-phishing filters with machine learning detect advanced phishing attempts.

C is correct because Cloud Connector in Cisco Secure Workload (formerly Tetration) integrates with AWS and Azure APIs to retrieve instance metadata, such as VPC ID, subnet, and instance ID. This metadata allows Secure Workload to uniquely identify workloads even when they have overlapping IP addresses across different VPCs, enabling accurate traffic classification and policy enforcement.

Intelligent Proxy selectively decrypts SSL traffic for high-risk categories or domains, based on policy, to inspect content while preserving user privacy for safe sites.

Cisco ISE enforces SGT-based access control using Security Group ACLs (SGACLs) that are evaluated in priority order. Even if a permit SGACL exists for SGT 10 to SGT 20, a deny SGACL with a higher priority (lower sequence number) that matches the same traffic will take precedence and cause the traffic to be dropped. The engineer must check the full SGACL list and their sequence numbers on the switch to identify conflicting rules.

Cisco WSA's URL filtering policies include a predefined content category called 'Executable Files' that specifically targets file extensions like .exe, .dll, and .msi. By setting the action to 'Block' for this category, the administrator can prevent HTTP downloads of executable files without affecting other traffic. This is the most direct and effective method as it operates at the application layer, inspecting the URL path for file extensions.

The 'test aaa group radius user password' command is specifically designed to simulate an authentication attempt against a RADIUS server, allowing the administrator to verify whether the RADIUS server is properly processing credentials. Since the RADIUS server is reachable via ping but users still fail, this command isolates whether the issue lies in the AAA authentication process itself, such as incorrect shared secret, user credentials, or RADIUS attribute mismatches.

Cisco AMP for Endpoints provides endpoint protection with advanced malware analysis.

Decrypt - Known Key is used when the firewall has the server's private key, typically for inbound connections to an internal server.

This is a Business Email Compromise (BEC) attack, which often involves spoofing, impersonation of executives, and social engineering to request financial transfers.

Change of Authorization (CoA) allows ISE to dynamically change the authorization state (e.g., VLAN or ACL) on the network device after the initial authentication. This is used to enforce posture policies without requiring the endpoint to reauthenticate.

Transparent user identification (TUI) on the WSA uses technologies like NTLM authentication or LDAP to identify users without explicit proxy configuration. It can leverage Active Directory and transparently capture user credentials via HTTP authentication or other means.

The 'alert' action generates an alert but does not drop; 'drop' drops and alerts; 'reject' drops and sends TCP RST; 'pass' ignores the packet.

Cisco TrustSec uses Security Group Tags (SGTs) to enforce microsegmentation by classifying traffic based on user, device, or role rather than IP addresses. This allows granular policy enforcement at the access layer, reducing lateral movement within the network. Microsegmentation is a core security objective of TrustSec, enabling dynamic, identity-based access control.

URL filtering blocks categories by time, application control enforces policies per app, and TLS server identity discovery detects unknown destinations in encrypted traffic.

Zero trust assumes no implicit trust and requires identity verification for every access request, using identity as the primary perimeter.

When Cisco ESA is configured with 'Deliver then alert' for malware detected by AMP, the email is delivered to the user before the AMP file reputation analysis completes. The ESA sends the file to AMP for analysis, but if the policy is set to deliver first and alert later, the user receives the attachment even if AMP later determines it is malicious. This explains why the administrator sees the block in both AMP and ESA logs, yet the user claims delivery.

IKE policy defines Phase 1 parameters, then pre-shared key is set, interesting traffic is defined via ACL, crypto map binds Phase 2 parameters, and it is applied to the interface.

DTLS provides UDP-based transport for VPN traffic, reducing latency and improving performance for real-time applications compared to TCP-based TLS.

A digital signature provides authentication, integrity, and non-repudiation.

The 'show asp drop' command displays packet drop statistics from the Accelerated Security Path (ASP) on a Cisco ASA. It provides a detailed breakdown of why packets are dropped, including drops due to ACLs, inspection policies, or other security checks. This makes it the correct tool to differentiate between ACL and inspection policy drops.

AMP for Email uses SHA-256 cloud lookup for known malware and file sandboxing for unknown files to detect malicious behavior.

Cisco AnyConnect VPN authentication can be performed using RADIUS, which is a widely supported AAA protocol. RADIUS enables centralized authentication, authorization, and accounting for VPN users, and it is natively integrated with Cisco ASA and Firepower Threat Defense (FTD) appliances for remote access VPNs.

Just-in-time (JIT) access grants temporary privileges that expire after the task is completed, reducing standing privileges.

Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) is the correct answer because it provides multi-cloud security posture management by ingesting flow logs, API telemetry, and configuration data from AWS, Azure, and GCP to detect misconfigurations, anomalous behavior, and compliance violations. It uses machine learning to establish baselines and alert on deviations, enabling consistent policy enforcement across heterogeneous cloud environments without requiring agents or changes to existing infrastructure.

VXLAN Group Policy Option (GPO) is the correct mechanism because it embeds the SGT directly into the VXLAN header (in the Group Policy ID field, bits 24-31 of the VXLAN Network Identifier). This allows the spine switches, which are also VTEPs, to receive and forward the SGT information without needing a separate control plane protocol. The border leaf encodes the SGT in the VXLAN encapsulation, and the spine decodes it from the header, ensuring end-to-end SGT propagation across the fabric.

Geolocation filtering is configured under access control rules; a rule with block action for the country should be placed before any allow rules.

Firepower NGFW uses application control to identify and block specific applications. By creating a rule that blocks the 'Social Networking' category but then allows 'LinkedIn' specifically (or blocks Facebook and Twitter by application), the administrator can achieve granular control.

In Snort-based IPS, you can create a rule suppression or use a pass rule with a higher priority to skip inspection for that traffic. Alternatively, you can modify the rule to add a 'pcre' condition or use 'tag', but the simplest is to create a suppression or use a rule override to disable the specific signature for that source/destination.

SPF, DKIM, and DMARC results indicate authentication status and potential spoofing.

Defense in depth is a security architecture strategy that layers independent defensive mechanisms (e.g., firewalls, IDS/IPS, endpoint protection, encryption) so that if one layer is compromised, subsequent layers continue to protect the asset. This concept is fundamental to the 350-701 exam as it underpins Cisco's SecureX and integrated security fabric approach, where multiple controls (like ASA, Firepower, and Umbrella) work together to provide resilience against breaches.

Cisco ESA uses IronPort SenderBase reputation to assign a score (-10 to +10) to senders to determine spam likelihood.

DNS cache poisoning injects false DNS records, causing users to be redirected to malicious sites when they attempt to access legitimate domains.

Cisco Duo integrates with ISE and AnyConnect to provide multi-factor authentication for VPN access.

Access control rules are processed top-down; a trust rule bypasses further inspection but still allows traffic; a permit rule allows traffic with inspection. The scenario requires allowing HTTP only, so a permit rule for HTTP with a default deny rule after is correct.

When a file's disposition changes from clean to malicious in the AMP cloud, the 'Remediate Now' policy setting controls whether AMP automatically triggers remediation actions (such as quarantine or deletion) on endpoints that have already executed the file. Even with retrospective security enabled, the administrator must ensure that the policy assigned to the endpoints has this option enabled; otherwise, the cloud will send the updated disposition but the endpoint will not automatically act on it.

AES is a symmetric block cipher with a fixed block size of 128 bits and key sizes of 128, 192, or 256 bits.

A next-generation firewall (NGFW) with IPS and application visibility is best suited to inspect application-layer traffic and protect against exploits like SQL injection because it combines deep packet inspection (DPI), signature-based IPS, and application-level awareness. Unlike simpler firewalls, an NGFW can decode HTTP/HTTPS payloads, match patterns against SQL injection signatures (e.g., ' OR 1=1 --), and block malicious traffic at Layer 7 while maintaining stateful inspection.

Firepower NGFW application control can block specific application categories such as social media.

Duo Push sends a push notification to the user's enrolled mobile device, which they can approve or deny. This is the most common method for VPN MFA with AnyConnect.

Exploit Prevention in Cisco AMP focuses on detecting and blocking memory injection attacks, such as buffer overflows and code injection, by monitoring process behavior.

EAP-TLS requires a client certificate on the supplicant for mutual authentication.

The service-policy command applies the policy-map globally.

The Web Reputation action configured in the WSA policy overrides the URL category-based allow rule. Even though the 'Education' category is set to 'Allow', the Web Reputation threshold is set to -5.0, and the blocked sites have a reputation score of -4.5 (which is below the threshold, meaning worse reputation). The WSA applies the most restrictive action: if Web Reputation is set to 'Block' for scores below 0, it will block traffic regardless of the category allow action, resulting in the block page showing 'Web Reputation: Low Reputation'.

Cisco Tetration is the correct recommendation because it provides a multi-cloud workload protection platform that enforces consistent security policies across AWS, Azure, and on-premises environments using a software-based agent and a centralized policy engine. It leverages micro-segmentation and behavioral analytics to automatically generate and enforce whitelist-based policies based on actual traffic flows, ensuring uniform security regardless of the underlying cloud provider.

AWS Direct Connect provides a dedicated private connection from an on-premises data center to AWS, bypassing the public internet. Site-to-Site VPN uses the internet, PrivateLink is for accessing services privately across VPCs and on-premises, and NAT Gateway is for outbound internet access.

B is correct because the URL filtering and analysis settings control how the Cisco ESA rewrites and subsequently analyzes malicious URLs. When a phishing email contains a malicious URL, the ESA can rewrite the URL to point to its own proxy for real-time analysis. If this feature is not properly configured or if the analysis settings (such as reputation scoring or time-of-click verification) are disabled, the rewritten URLs may not be inspected, allowing the threat to bypass detection.

Cisco AMP for Endpoints policies have three primary actions: 'Detect', 'Block', and 'Quarantine'. When a policy is set to 'Detect', the endpoint will alert on malicious files but will not prevent execution. Since the ransomware was allowed to run, the most likely cause is that the policy was configured to 'Detect' only, rather than a more restrictive action like 'Block' or 'Quarantine'.

The workload sensor (agent or agentless) is a core component of Cisco Cloud Workload Protection (CWP) because it provides visibility into workload activity, including process execution, network connections, and file integrity. This sensor collects telemetry data from workloads running in AWS and forwards it to the centralized analysis engine for threat detection and policy enforcement.

DMARC can detect and block spoofed emails from the CEO's domain by verifying SPF and DKIM alignment.

IKEv2 requires an IKEv2 proposal (or policy) defining encryption and authentication for phase 1, and a transform set for IPsec phase 2. Also, a crypto map binds the configuration to an interface. ISAKMP policy is for IKEv1.

Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on identity and enforce access control policies. SGTs are 16-bit values assigned to users or devices, and they are carried in the packet header (e.g., via Cisco Metadata or inline tagging) to allow policy enforcement at the network layer.