How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 11 Refer to the Exhibit Practice Questions scenario questions for the 350-701 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-701 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco SCOR / CCNP Security Core 350-701 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Cisco SCOR / CCNP Security Core 350-701 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

350-701

exam code

Cisco

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1easymultiple choice

Read the full NAT/PAT explanation →

Refer to the exhibit. What is the effect of this NAT rule on the Cisco FTD device deployed in the cloud?

Exhibit

Refer to the exhibit.

ciscoftd(config)# show running-config | section nat
nat (inside,outside) source static 10.0.1.0 10.0.1.0 destination static 192.168.1.0 192.168.1.0 no-proxy-arp route-lookup

A
Performs identity NAT between the two networks without port translation
The 'static' keyword with same IP on both sides indicates identity NAT.
B
Translates source IP when traffic goes from outside to inside
Why wrong: The rule is applied on the 'inside' interface; source translation is static for inside to outside traffic.
C
Enables Port Address Translation (PAT)
Why wrong: There is no 'pat' keyword; this is identity NAT.
D
Translates destination IP from 192.168.1.0 to a public IP
Why wrong: Destination is also static with same IP, so no translation.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. An administrator in us-west-2 tries to launch an instance. The policy allows only us-east-1. What should the administrator do to successfully launch the instance?

Exhibit

{
  "Effect": "Allow",
  "Action": "ec2:RunInstances",
  "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
  "Condition": {
    "StringEquals": {
      "aws:RequestedRegion": "us-east-1"
    }
  }
}

A
Launch the instance in us-east-1
Complies with the policy condition.
B
Modify the resource ARN to include us-west-2
Why wrong: The condition still requires us-east-1.
C
Change the policy to allow all regions
Why wrong: Not the best course; violates the condition intent.
D
Remove the condition from the policy
Why wrong: Would change policy but may be against security requirements.

Full breakdown with real-world context →

Question 3hardmultiple choice

Open the full VLAN trunking answer →

A large enterprise with over 2,000 employees recently experienced a security breach. An attacker gained initial access through a phishing email and then moved laterally across the network to reach a critical database server. The network currently has a flat Layer 2 topology with all devices in a single large VLAN. The company wants to prevent lateral movement in the future while maintaining operational simplicity. They have a Cisco ISE deployment already but it is only used for wireless guest access. The security team is evaluating options. Option A: Deploy 802.1X with dynamic VLAN assignment across all wired ports. This would authenticate users and assign them to different VLANs based on identity. Option B: Implement micro-segmentation using Cisco TrustSec with Security Group Tags (SGTs) on the existing switches and enforce SGT-based policies on the firewalls. This would allow traffic control between groups regardless of IP. Option C: Install a next-generation firewall at the internet edge and enable IPS to block known attack signatures. Option D: Upgrade all access switches to support Private VLANs (PVLANs) and configure promiscuous ports for servers. Which solution BEST addresses the lateral movement problem while leveraging existing infrastructure?

A
Install a next-generation firewall at the internet edge and enable IPS.
Why wrong: This protects inbound threats but does not prevent an attacker already inside from moving laterally.
B
Upgrade all access switches to support Private VLANs (PVLANs).
Why wrong: PVLANs can isolate ports, but they add administrative overhead and do not provide identity-based policy control like TrustSec.
C
Deploy 802.1X with dynamic VLAN assignment across all wired ports.
Why wrong: While it segments users into VLANs, intra-VLAN traffic is still allowed, enabling lateral movement within the same VLAN.
D
Implement micro-segmentation using Cisco TrustSec with SGTs and enforce policies on firewalls.
SGTs allow traffic control based on group identity, preventing lateral movement even within the same subnet, and leverages existing ISE.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

A user connected to port Gi1/0/1 cannot access the network. Based on the output, what is the most likely cause?

Exhibit

Refer to the exhibit.

Switch# show authentication sessions interface GigabitEthernet1/0/1 detail

Interface: GigabitEthernet1/0/1
  MAC Address: 0011.2233.4455
  IP Address: 192.168.1.15
  User-Name: hostA
  Status: Unauthorized
  Domain: DATA
  Oper host mode: single-host
  Authorized By: N/A
  Vlan Policy: N/A
  Session timeout: N/A
  Idle timeout: N/A
  Common Session ID: 0A0B0C0D0E0F0001
  Acct Session ID: 0x00000001
  Handle: 0x81000001

  Runnable method list: dot1x
  Last Authentication: Failed
  Reason: EAP-timeout

A
The RADIUS server is unreachable
Why wrong: Would show 'Critical' or 'No server' state.
B
The client does not support 802.1X
EAP-timeout indicates client not responding to EAP.
C
The switch has a misconfigured AAA command
Why wrong: Would cause configuration errors, not EAP-timeout.
D
The port is in errdisable state
Why wrong: Port state would be errdisable, not unauthorized.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A security analyst notices unusual outbound traffic from an internal host to a known malicious IP address on TCP port 4444. The host is also exhibiting high CPU usage and running an unknown process. Which type of malware is most likely present?

A
Ransomware
Why wrong: Ransomware typically encrypts files and demands payment, but does not usually establish a persistent C2 channel on port 4444 with outbound traffic.
B
Botnet C2 client
Why wrong: A botnet C2 client could use port 4444, but the term is broader; however, a RAT is a specific type of malware that provides remote control.
C
Remote Access Trojan (RAT)
RATs commonly use ports like 4444 for C2 communication, allowing remote control and data exfiltration.
D
Keylogger
Why wrong: Keyloggers capture keystrokes and may exfiltrate data, but they do not typically cause high CPU usage or use port 4444 for C2.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full NAT/PAT explanation →

Refer to the exhibit. An ASA is configured with the above access-list and NAT rule. A web server is reachable from the internet via the public IP 203.0.113.10. However, internal users from the inside network cannot access the web server using its public IP address. What is the most likely cause?

Exhibit

configure terminal
access-list OUTSIDE extended permit tcp any host 203.0.113.10 eq www
access-list OUTSIDE extended permit udp any host 203.0.113.10 eq domain
nat (inside,outside) source dynamic any interface

A
The NAT rule is missing a static NAT for the server.
Without a static NAT, internal users cannot access the server via the public IP due to lack of hairpinning.
B
The access-list does not permit traffic from inside to outside for that destination.
Why wrong: The ACL is applied on the outside interface, so it does not filter inside-to-outside traffic.
C
The interface ACL is applied inbound on the inside interface.
Why wrong: The ACL is applied to the outside interface, not inside.
D
The default route is missing.
Why wrong: A missing default route would affect traffic to the internet, but not specifically internal access to a public IP.

Full breakdown with real-world context →

Question 7easymultiple choice

Full question →

Refer to the exhibit. The tunnel is established but no traffic is encrypted. What is the most likely issue?

Exhibit

crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac
 mode tunnel
crypto map CMAP 10 ipsec-isakmp
 set peer 10.0.0.2
 set transform-set ESP-AES256-SHA
 match address 100
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

A
The transform set uses wrong encryption
Why wrong: AES-256 is a strong encryption algorithm and compatible.
B
The crypto map is not applied to the external interface
The crypto map must be attached to an interface to enable encryption.
C
The access-list is too permissive
Why wrong: The ACL correctly defines interesting traffic between the two subnets.
D
The peer address is wrong
Why wrong: If the peer address were wrong, the tunnel would not be established.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

Based on the exhibit, what is the root cause of the AMP connector's inability to connect to the cloud?

Exhibit

Refer to the exhibit.

```
2024-01-15 11:00:00 ERROR: Failed to connect to AMP cloud: Connection timed out
2024-01-15 11:01:00 WARNING: Retrying connection in 60 seconds
2024-01-15 11:02:00 INFO: Proxy configured: proxy.company.com:3128
2024-01-15 11:03:00 ERROR: Proxy authentication failed: 407 Proxy Authentication Required
```

A
The AMP cloud servers are blocking the connector's IP address.
Why wrong: There is no evidence of cloud blocking; the error is at the proxy level.
B
The proxy server address is incorrect in the connector configuration.
Why wrong: The log shows the proxy is configured and the connector is attempting to use it (407 error).
C
The proxy requires authentication, and the AMP connector has no credentials configured.
The 407 error explicitly indicates proxy authentication failure.
D
The connector has no network connectivity to the internet.
Why wrong: The initial timeout could be due to proxy, but later logs show the proxy is reachable.

Full breakdown with real-world context →

Question 9hardmultiple choice

Open the full VLAN trunking answer →

Refer to the exhibit. A network administrator is troubleshooting device tracking on a Cisco switch. The output shows two devices in VLAN 100. The switch is configured with IPv6 first-hop security features. The administrator notices that the device with MAC address aaaa.bbbb.cccc is not receiving RA guard protection. What is the most likely reason?

Exhibit

Router# show device-tracking database
 Device-tracking database for Vlan 100:
  Device ID     MAC Address      Interface      VLAN     Last seen
  *             0050.7966.6800   Gi0/1/0        100      00:00:12
  *             aaaa.bbbb.cccc   Gi0/1/1        100      00:00:05

A
The interface Gi0/1/1 is not configured as a trusted interface for RA guard.
RA guard only applies to trusted interfaces.
B
The device is not in the same VLAN as the RA guard policy.
Why wrong: Both devices are in VLAN 100.
C
The device tracking entry for aaaa.bbbb.cccc is invalid.
Why wrong: The asterisk indicates a valid binding.
D
The device tracking table has reached its limit.
Why wrong: The table shows only two entries.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

A user in the Engineering group reports that they cannot access a banking website (https://www.examplebank.com). The website is categorized as 'Financial' by the WSA. Based on the exhibit, what is the most likely cause?

Exhibit

Refer to the exhibit.

ciscowsa# show accesspolicy detail PolicyName: Engineering
  Policy: Engineering
  Identification Profiles: Engineering_IP
  User Identification: Transparent
  
  Web Reputation:
    Action: Block
    Threshold: -6.0
  
  URL Filtering:
    Category: Malware
      Action: Block
    Category: Phishing
      Action: Block
    Category: Social Networking
      Action: Monitor
  
  Malware Scanning:
    Action: Scan
    File Types: exe, dll, zip, jar
  
  HTTPS Decryption:
    Action: Decrypt
    Bypass Categories: Financial, Health

A
The Malware Scanning action is set to 'Scan' but blocks the site
Why wrong: Scan action does not block; it scans and then allows.
B
The user identification is not configured correctly
Why wrong: Identification is set to Transparent, which should work.
C
The Web Reputation threshold of -6.0 is blocking the site due to a low reputation score
If the site's reputation is below -6.0, it will be blocked regardless of URL filtering.
D
The Social Networking category is set to 'Monitor' and is blocking the site
Why wrong: Monitor does not block.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full VPN explanation →

Refer to the exhibit. The crypto map is applied to an interface. Which additional configuration is necessary for IPsec to function correctly?

Exhibit

Refer to the exhibit.
```
ipsec proposal MY_PROPOSAL
 esp encryption aes-256
 esp integrity sha256
!
crypto map MY_MAP 10 ipsec-isakmp
 set peer 203.0.113.1
 set transform-set MY_SET
 match address 100
!
access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
```

A
Define an extended access list for interesting traffic
Why wrong: Access-list 100 already defines interesting traffic.
B
Create a tunnel interface and apply the crypto map to it
Why wrong: Crypto maps can be applied to physical interfaces; a tunnel interface is not required.
C
Create a transform-set with the same parameters as the proposal
Why wrong: A transform-set is referenced (MY_SET) but not defined; however, the more fundamental missing piece is IKE policy.
D
Configure an ISAKMP policy (IKE phase 1) with pre-shared key or certificate
IKE phase 1 must be configured to establish a secure channel before IPsec can work.

Full breakdown with real-world context →

These 350-701 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-701 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related 350-701 topic practice pages

Security Concepts practice questions

Network Security practice questions

Cloud Security practice questions

Content Security practice questions

Endpoint Protection and Detection practice questions

Secure Network Access, Visibility and Enforcement practice questions

350-701 fundamentals practice questions

350-701 scenario practice questions

350-701 troubleshooting practice questions

Practice scenarios

Refer to the exhibit. What is the effect of this NAT rule on the Cisco FTD device deployed in the cloud?

Exhibit

Refer to the exhibit. An administrator in us-west-2 tries to launch an instance. The policy allows only us-east-1. What should the administrator do to successfully launch the instance?

Exhibit

A user connected to port Gi1/0/1 cannot access the network. Based on the output, what is the most likely cause?

Exhibit

A security analyst notices unusual outbound traffic from an internal host to a known malicious IP address on TCP port 4444. The host is also exhibiting high CPU usage and running an unknown process. Which type of malware is most likely present?

Refer to the exhibit. An ASA is configured with the above access-list and NAT rule. A web server is reachable from the internet via the public IP 203.0.113.10. However, internal users from the inside network cannot access the web server using its public IP address. What is the most likely cause?

Exhibit

Refer to the exhibit. The tunnel is established but no traffic is encrypted. What is the most likely issue?

Exhibit

Based on the exhibit, what is the root cause of the AMP connector's inability to connect to the cloud?

Exhibit

Exhibit

A user in the Engineering group reports that they cannot access a banking website (https://www.examplebank.com). The website is categorized as 'Financial' by the WSA. Based on the exhibit, what is the most likely cause?

Exhibit

Refer to the exhibit. The crypto map is applied to an interface. Which additional configuration is necessary for IPsec to function correctly?

Exhibit