How many Troubleshooting Scenario Questions questions are on this page?

This page has 15 Troubleshooting Scenario Questions scenario questions for the 350-701 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-701 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco SCOR / CCNP Security Core 350-701 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Cisco SCOR / CCNP Security Core 350-701 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

350-701

exam code

Cisco

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediumdrag order

Read the full VPN explanation →

Drag and drop the steps to troubleshoot an IPsec VPN failure where Phase 1 is not completing into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

A
1. Check IP reachability between peers. 2. Verify UDP port 500 is open. 3. Compare IKE proposals. 4. Verify pre-shared keys. 5. Use debug commands.
This is the correct order because you start with basic connectivity, then verify the transport (UDP 500), then IKE parameters, then authentication, and finally use debug for detailed troubleshooting.
B
1. Verify pre-shared keys. 2. Check IP reachability. 3. Compare IKE proposals. 4. Verify UDP port 500 is open. 5. Use debug commands.
Why wrong: This is incorrect because checking pre-shared keys before reachability and IKE parameters is premature; IKE SA negotiation must succeed before authentication can occur.
C
1. Use debug commands immediately. 2. Verify UDP port 500 is open. 3. Check IP reachability. 4. Compare IKE proposals. 5. Verify pre-shared keys.
Why wrong: This is incorrect because starting with debug is inefficient and can produce excessive output; basic connectivity and firewall checks should be performed first.
D
1. Check IP reachability. 2. Compare IKE proposals. 3. Verify UDP port 500 is open. 4. Use debug commands. 5. Verify pre-shared keys.
Why wrong: This is incorrect because UDP port 500 must be verified before comparing IKE proposals; if the port is blocked, IKE cannot even start, making proposal comparison irrelevant.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related 350-701 topic practice pages

Security Concepts practice questions

Network Security practice questions

Cloud Security practice questions

Content Security practice questions

Endpoint Protection and Detection practice questions

Secure Network Access, Visibility and Enforcement practice questions

350-701 fundamentals practice questions

350-701 scenario practice questions

350-701 troubleshooting practice questions

Practice scenarios

Drag and drop the steps to troubleshoot an IPsec VPN failure where Phase 1 is not completing into the correct order.

You are troubleshooting a Cisco ISE deployment where some endpoints are stuck in the 'Not Compliant' posture after a posture scan. ISE logs show 'Conditional NAC Agent result: Not Compliant due to missing required application.' The application is installed on the endpoint. What should you check?

An engineer is troubleshooting a Cisco ISE deployment where some endpoints are not being profiled correctly. The administrator notices that the endpoints are not sending DHCP requests. Which profiling probe should be primarily used to identify these endpoints?

An administrator is configuring DLP on the Cisco ESA to block social security numbers (SSNs) in outgoing email. The policy is set to 'Drop' for SSN matches, but some emails containing SSNs are still being delivered. What step should the administrator take to troubleshoot?

A network engineer is troubleshooting an issue where an endpoint is failing to authenticate via 802.1X on a Cisco switch. The switch port is in unauthorized state. Which step should the engineer take first to identify the root cause?

A security engineer is troubleshooting an issue where users can bypass the Cisco WSA by using HTTPS. What must be enabled on the WSA to inspect encrypted traffic?

A security analyst wants to investigate a remote endpoint that is suspected of being compromised. Using Cisco AMP for Endpoints, which capability allows the analyst to run commands on the endpoint and perform live analysis?

An administrator is troubleshooting authentication failures for VPN users. The RADIUS server is reachable via ping, but users receive 'AAA authentication failed'. Which command should be used to test communication with the RADIUS server?

A company has a site-to-site VPN between two ASA firewalls using IKEv2. The tunnel was working but after an upgrade, it fails. The engineer verifies that the pre-shared keys match, IKE proposals are compatible, and the crypto ACL is correctly defined. What is the next likely cause to investigate?

Which THREE steps should the administrator take to troubleshoot slow web browsing when using Cisco WSA? (Choose three.)

An engineer is troubleshooting a Cisco ASA firewall and notices that traffic from a specific subnet is being dropped. The engineer wants to verify if the drop is due to an access control list (ACL) or an inspection policy. Which command should be used to see the reason for packet drops?

Exhibit