How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the 350-701 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-701 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco SCOR / CCNP Security Core 350-701 questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Cisco SCOR / CCNP Security Core 350-701 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

350-701

exam code

Cisco

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related 350-701 topic practice pages

Security Concepts practice questions

Network Security practice questions

Cloud Security practice questions

Content Security practice questions

Endpoint Protection and Detection practice questions

Secure Network Access, Visibility and Enforcement practice questions

350-701 fundamentals practice questions

350-701 scenario practice questions

350-701 troubleshooting practice questions

Practice scenarios

A security analyst detects a DDoS attack targeting the company's web server. Which three attack types are classified as application layer attacks? (Choose three.)

An organization is adopting a cloud-first strategy and wants to ensure least-privilege access for cloud resources. Which THREE measures should be implemented as part of a cloud IAM strategy? (Select three.)

Which THREE of the following are key principles of the Cisco Zero Trust security model?

Which THREE of the following are valid methods to deploy Cisco AMP for Endpoints Connector on Windows endpoints?

Which TWO actions can be configured in a Cisco ESA DLP policy to respond to a violation involving outbound credit card numbers? (Choose two.)

Which THREE are valid components of an IKEv2 exchange? (Choose three.)

Which two actions are valid actions in a Cisco Firepower access control rule? (Choose two.)

Which THREE are characteristics of Cisco ISE profiler service?

Which TWO of the following are valid methods for Cisco ISE to collect endpoint attributes for profiling? (Choose TWO)

An organization wants to deploy endpoint hardening measures. Which three of the following are considered endpoint hardening techniques? (Choose three.)

A company wants to implement a Zero Trust architecture. Which THREE principles should be included? (Choose three.)

A company is planning to deploy a Zero Trust architecture. Which two principles are fundamental to Zero Trust?

Which THREE of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Which THREE of the following are features of Cisco Identity Services Engine (ISE) that can be used to enforce network access control?

A company is designing a network segmentation strategy using firewalls. Which THREE considerations are important for a defense-in-depth approach?

An organization is planning to deploy Cisco FTD in a high-availability pair. Which two statements about active/active failover are true? (Choose two.)

Which THREE of the following are common indicators of a DDoS attack at the network layer?

A security analyst is investigating a Business Email Compromise (BEC) attack. Which two indicators are commonly associated with BEC attacks? (Choose two.)

A company is using Cisco WSA with transparent proxy via WCCP. The security team wants to identify which users are accessing banned websites and also enforce bandwidth limits for video streaming. Which TWO features should be configured on the WSA?

An organization wants to block access to malicious websites using Cisco Umbrella. Which two protection layers are available with the Umbrella SIG? (Choose two.)