Cisco SCOR / CCNP Security Core 350-701 (350-701) — Questions 451–525

Remote shell investigation allows analysts to perform live forensics on endpoints via a secure shell.

AES (Advanced Encryption Standard) is a widely used symmetric block cipher with key sizes of 128, 192, or 256 bits.

Cisco Umbrella SIG (Security Internet Gateway) is a cloud-delivered security solution that provides DNS-layer security by intercepting and analyzing DNS queries. When a user attempts to resolve a domain, Umbrella checks the request against its threat intelligence database and blocks the resolution if the domain is known to be malicious, preventing the connection before it is established.

Cisco ThousandEyes is correct because it provides end-to-end visibility into the performance of SaaS applications like Microsoft 365 by using cloud-based agents and enterprise agents to monitor network paths, application latency, and packet loss. It specifically measures the user experience for SaaS services through synthetic testing and real-user monitoring, identifying issues such as ISP throttling or routing problems that affect Microsoft 365 performance.

Cisco Secure Workload (formerly Tetration) is the correct choice because it provides workload protection for Azure VMs with automatic policy adjustment based on workload changes. It uses agent-based and agentless sensors to collect telemetry, builds a dependency map, and enforces micro-segmentation policies that dynamically adapt as workloads scale, migrate, or change, meeting the requirement for automated security policy adjustment.

Password vaulting (B) is a core PAM capability because it securely stores privileged credentials in an encrypted repository, enforcing policies for checkout, rotation, and access control. CyberArk's Vault, for example, uses AES-256 encryption and integrates with Cisco SecureX to provide centralized credential management, ensuring that passwords are never exposed in plaintext.

Adjusting threshold levels per sender group allows administrators to fine-tune the sensitivity of anti-spam filters based on the trustworthiness of the sender, reducing false positives for legitimate email while maintaining high detection for spam. Using a combination of Cisco Anti-Spam and a third-party anti-spam engine provides defense-in-depth, leveraging different detection algorithms and signature databases to catch a wider range of spam variants.

DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers how to handle emails that fail SPF/DKIM (e.g., reject or quarantine).

Zero trust assumes no implicit trust; every request must be verified regardless of source.

SYN flood is a protocol-based DDoS attack that exploits the TCP handshake.

DAP can use endpoint attributes like antivirus status, registry entries, or connection attributes like group policy. Certificate issuer is not a standard DAP attribute.

Device Trajectory in Cisco AMP for Endpoints provides a timeline of file activity, showing where a file originated and how it spread, which is critical for retrospective security analysis.

Cisco Cloudlock is a cloud access security broker (CASB) that provides visibility into cloud application usage. Option A is correct because Cloudlock's Shadow IT discovery feature identifies unauthorized cloud applications being used by employees, allowing administrators to assess risk and enforce policies. This is a core CASB function that discovers and categorizes cloud apps based on user traffic patterns.

The Dynamic Vectoring and Scoring (DVS) engine in Cisco WSA provides advanced malware detection by analyzing file attachments in real time, including webmail uploads. It uses multiple scanning techniques, such as reputation analysis and file-type identification, to block malware before it reaches the user. This directly addresses the requirement to prevent malware-laden attachments in webmail traffic.

In SaaS, the provider manages the application, runtime, OS, and infrastructure. The customer is responsible for data and access management.

Cisco Umbrella's DNS-layer security operates by intercepting DNS queries and comparing them against policy-defined lists. A block list containing known malicious domains is the correct approach because Umbrella will block DNS resolution for those domains while allowing all other traffic to pass through normally. This aligns with the requirement to block only malicious destinations without affecting access to legitimate sites.

The ASA firewall requires static NAT to translate the public IP address (typically the ASA's outside interface IP or a dedicated public IP) to the private IP address of the web server (10.1.1.100). Without static NAT, the ASA will not perform the necessary destination address translation for inbound HTTPS traffic, and the web server's private IP is not routable on the internet.

Cisco Umbrella enforces security policies based on content categories, not just individual domains. Even if a domain is not explicitly blocked, it may belong to a content category (e.g., 'Newly Seen Domains', 'Pornography', 'Hacking') that has been set to 'Block' in the Umbrella policy. This is a common cause of legitimate sites being blocked, as Umbrella evaluates the domain against all applicable categories before allowing access.

Secure Internet Gateway (SIG) functionality in Cisco Umbrella includes cloud-delivered firewall and web proxy. DNS-layer security is a separate core Umbrella feature, not part of SIG.

IPsec requires both IKE Phase 1 (ISAKMP) and Phase 2 to be configured. The crypto map references a transform-set and an access list, but without an ISAKMP policy defining authentication (pre-shared key or certificate) and encryption/hash parameters, IKE cannot establish a secure control channel. Option D is correct because the ISAKMP policy is mandatory for IKE Phase 1 negotiation before IPsec SAs can be created.

In PaaS, the customer manages applications and data, while the provider manages the runtime, infrastructure, and OS.

The transform set specifies the IPsec SA parameters (encryption, authentication, etc.). IKEv2 uses proposals and transforms within the transform set.

CSPM tools continuously monitor cloud infrastructure for compliance with security best practices and benchmarks (e.g., CIS). They identify misconfigurations but do not typically enforce DLP, block threats, or protect workloads directly.

It allows the administrator to apply a graduated response: messages with threat scores between 70 and 80 are analyzed (e.g., delivered with a warning or delayed) rather than quarantined, reducing false positives while still providing security. The outbreak filter in Cisco ESA supports multiple actions per score range, enabling a tiered policy that avoids an all-or-nothing approach. This maintains protection against truly high-risk messages (score >80) while sparing borderline legitimate traffic.

Transparent mode (Layer 2 mode) is correct because the requirement specifies inspecting traffic between two internal VLANs without routing. In transparent mode, the FTD acts as a bridge, forwarding frames based on MAC addresses while enforcing access control policies based on source and destination zones. This allows the firewall to inspect inter-VLAN traffic without requiring IP address changes or acting as a default gateway.

File quarantine, process isolation, and remote shell investigation are EDR actions. Application whitelisting is a hardening technique, and MFA is authentication.

'Assume breach' is a core Zero Trust tenet that minimizes the blast radius by segmenting access and continuously monitoring for threats, even within the cloud environment. This principle assumes that an attacker may already be present, so it enforces micro-segmentation and real-time analytics to limit lateral movement, aligning with NIST SP 800-207 Zero Trust Architecture guidelines.

MFA ensures strong authentication, PIM manages privileged access, and conditional access policies enforce context-based controls.

RA Guard protection is applied per interface based on trust configuration. The exhibit shows the device with MAC aaaa.bbbb.cccc is reachable via Gi0/1/1, but if that interface is not explicitly configured as trusted for RA Guard (e.g., using `ipv6 nd raguard trust`), the switch will not apply RA Guard filtering to RAs received on that port. This allows rogue RA messages from that device to bypass protection, making A the correct answer.

Cisco Umbrella SIG provides cloud-based security including DNS-layer filtering and a cloud proxy. It can enforce URL filtering and blocks threats before connection. It does not require on-premises hardware and can be used with any internet connection.

Passive reconnaissance involves gathering information without directly interacting with the target, such as through public sources.

For NAT to translate traffic, the firewall must know which traffic to translate. An ACL is used to match the source IP addresses (or networks) that should be translated. Without an ACL applied to the NAT rule, the firewall has no criteria to identify traffic from VLAN 10 for translation, so packets are forwarded without NAT, causing internet access to fail while internal routing works.

Cisco WSA URL filtering uses categories (e.g., social media) to allow or block access based on policy.

In WSA, you can configure bypass rules for specific URL categories or destinations to exclude them from HTTPS inspection while still inspecting other traffic.

Cisco ASAv (Adaptive Security Virtual Appliance) is a virtualized version of the Cisco ASA firewall that can be deployed in public cloud environments such as AWS, Azure, and GCP. It provides stateful firewall, VPN, and threat defense capabilities natively within the cloud infrastructure. Option A is correct because ASAv is explicitly designed for virtual firewall functions in public clouds.

Cisco Stealthwatch uses NetFlow and behavioral analytics to detect network threats and anomalies.

Cisco Orbital is a cloud-based endpoint query and response tool that uses the osquery framework to allow security teams to run live SQL-like queries across all endpoints in real time. It also supports scheduled forensic data collection tasks, enabling continuous monitoring and historical analysis of endpoint state without requiring persistent agents or heavy infrastructure.

The Cisco Umbrella Roaming Client provides DNS-layer security for endpoints regardless of their network location, including off-network protection.

The posture agent (Cisco AnyConnect Posture Module or ISE Posture Agent) runs on the endpoint and performs checks for required software, updates, and configurations, then reports back to ISE.

Cisco Threat Response (CTR) provides integrated threat hunting and automated blocking across Cisco security products, including Umbrella, WSA, and ESA. This enables the security team to correlate indicators of compromise (IoCs) from phishing emails and newly registered domains, then automatically block them across all layers, addressing the dynamic nature of the threat (fast-flux hosting and newly registered domains) that signature-based and static blocklists cannot handle.

For traffic to external sites with public certificates, the FTD can use 'decrypt-resign' where it re-encrypts the traffic with a custom CA certificate installed on the client. 'Decrypt-known-key' is for traffic where the private key is known (e.g., internal servers).

MD5 has known collision attacks and should not be used. SHA-256 and SHA-3 are secure. SHA-1 is also deprecated but not an option.

Cisco Umbrella SIG uses DNS security to block requests to malicious domains.

Cisco ASA is a firewall/VPN solution, Firepower is NGFW/IPS, and ISE handles network access control. Common confusions involve mixing ASA with ISE or Firepower with Umbrella.

Explicit proxy requires manual browser configuration; transparent proxy uses WCCP or PBR.

The Policy Service Node (PSN) is responsible for policy decision and enforcement, and Active Directory integration is a key component for identity mapping. NAD (Network Access Device) is an external device that ISE controls, not a component of ISE itself. EAP-TLS is an authentication protocol, and Firepower is a separate security product.

MACsec is defined by the IEEE 802.1AE standard, which specifies a security protocol for providing data confidentiality, integrity, and origin authenticity at Layer 2. It operates directly on Ethernet frames, encrypting the payload while preserving the frame header for transparent forwarding. This makes option B correct because the standard is the foundational reference for MACsec.

FDM (Firepower Device Manager) is the on-box management solution for FTD, running directly on the device.

Cisco Duo is a key component of Cisco's Cloud Security architecture because it provides multi-factor authentication (MFA) as a cloud-delivered service, enforcing zero-trust access policies for users connecting to cloud applications and resources. It integrates with various identity providers and applications via SAML, RADIUS, and OAuth, ensuring that only authenticated and authorized users gain access, which is fundamental to securing cloud environments.

Guest access in ISE requires a sponsor portal (for approval) or self-registration portal, and integration with the network devices (switches/WLCs) for guest VLAN assignment.

BEC attacks often involve spoofed or compromised accounts. DMARC helps prevent domain spoofing, and DLP can detect sensitive data being sent to unauthorized recipients. FTL (Forged Email Detection) is also relevant, but DMARC and DLP are standard ESA features for BEC.

Zero trust relies on identity verification (MFA) and granular access policies (conditional access) rather than network location.

Cisco Duo is the correct solution because it is a cloud-based MFA platform that integrates directly with the Cisco ASAv via the AnyConnect VPN client or the ASA's authentication proxy. Duo acts as a RADIUS or LDAP proxy, intercepting authentication requests and prompting users for a second factor (e.g., push notification, OTP) after primary credentials are validated. This provides the required multi-factor authentication for remote access VPN users without requiring additional on-premises infrastructure.

Cisco Umbrella allows administrators to create per-domain policy overrides that bypass the category-based block for a specific domain while keeping the broader category (e.g., 'Social Networking') blocked for all other domains. This approach restores access to the legitimate business tool without weakening the overall security posture by disabling the entire category or removing the user from policy enforcement.

PAT (Port Address Translation) or NAT overload allows multiple internal hosts to share a single public IP by using unique port numbers.

Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets in a network. It relies on a DHCP snooping binding database to map IP addresses to MAC addresses, and it drops ARP packets that have invalid IP-to-MAC bindings, thereby preventing ARP spoofing attacks on a switched network.

Self-registration with sponsor approval allows guests to create accounts, but access is only granted after a sponsor approves the request. This is a common guest access scenario in ISE.

False negatives occur when the IPS fails to detect an actual attack. Common causes include outdated signatures, encrypted traffic that cannot be inspected, and evasion techniques like fragmentation or encoding that the IPS cannot reassemble. Also, if the sensor is in passive mode and misses traffic due to asymmetric routing, it can cause false negatives.

For shadow IT discovery, Cloudlock uses an API-based deployment mode to connect directly to cloud service providers (e.g., AWS, Office 365) via their APIs. This allows Cloudlock to pull metadata, user activity logs, and application usage data without requiring traffic redirection, enabling identification of unsanctioned cloud applications. Proxy-based modes are not used for shadow IT discovery because they require traffic to be routed through the proxy, which is not feasible for cloud-to-cloud traffic.

Azure WAF can be deployed with Application Gateway (WAF_v2 SKU) or Front Door. The WAF_v2 SKU of Application Gateway provides integrated WAF capabilities.

DNS security blocks malicious domains at the DNS lookup stage, and cloud proxy can inspect HTTP/HTTPS traffic to block malicious content even if DNS is bypassed.

Rule order matters (first match wins) and if an earlier rule blocks the traffic, the allow rule never applies. Also, intrusion policy could block if set to drop.

A transform set specifies the encryption (e.g., AES) and authentication (e.g., SHA) algorithms for IPsec. ISAKMP policy is for IKE phase 1, and crypto map binds the policy to an interface.

The correct matches are: Cut-Through Proxy (user authentication), Failover (high availability), ASDM (web GUI), and Packet Tracer (traffic simulation). Common confusions include mistaking Cut-Through Proxy for application inspection and Failover for multiple contexts.

The AMP for Endpoints connector must establish an outbound HTTPS (TCP/443) connection to the AMP cloud backend servers to communicate telemetry, receive policy updates, and perform health checks. Without this outbound access, the connector cannot register or maintain its connection to the cloud.

Orbital Advanced Search is the correct feature because it provides deep forensic visibility into endpoint activity, allowing the analyst to perform advanced queries across files, processes, registry keys, and network connections. This enables tracing the chain of events—such as a malicious email attachment, exploit, or drive-by download—that led to the ransomware infection, by correlating timestamps and process parent-child relationships.

Deploying the AMP connector to all endpoints, including servers and desktops, ensures comprehensive visibility and protection across the entire enterprise attack surface. Cisco AMP for Endpoints relies on a connector installed on each device to perform file analysis, retrospective detection, and telemetry collection; leaving any endpoint unmonitored creates a blind spot that attackers can exploit. This is a foundational best practice for large-scale deployments to achieve consistent security coverage.