How should I use these Network Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Network Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Network Security domain.

350-701 · topic practice

Network Security practice questions

Use this page to practise Network Security questions for this certification. Focus on how the exam tests network security in scenario format — understanding the why behind each answer builds more durable knowledge than memorising options.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Network Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Network Security

Network Security questions on this certification test your ability to deploy and manage network security concepts in scenario-based situations.

Core Network Security concepts and how they apply in real-world cloud scenarios.

How to deploy network security correctly and verify the outcome.

Troubleshooting network security issues by interpreting error output and system state.

Cloud best practices and Network Security design trade-offs tested by this certification.

Watch out for

Common Network Security exam traps

▸Selecting the most expensive service when a simpler managed option meets the requirement.
▸Forgetting that cloud resources must be explicitly secured — defaults are rarely secure.
▸Choosing a global service fix when the issue is region-specific.
▸Overlooking cost implications of cross-region data transfer in architecture questions.

Practice set

Network Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is troubleshooting an issue where users on VLAN 10 cannot access the internet, but they can reach internal resources. The firewall is configured with a default route pointing to the ISP router. The engineer notices that NAT is configured but traffic is not being translated. Which configuration is most likely missing?

Trap 1: A NAT pool with available public IP addresses

A NAT pool is needed for dynamic NAT, but the immediate issue is the missing ACL to match traffic.

Trap 2: Port Address Translation (PAT) configuration

PAT is a type of NAT, but the missing element is the ACL to identify traffic for translation.

Trap 3: A route map to apply NAT based on destination

Route maps are optional for policy-based NAT; standard NAT requires an ACL first.

Study all Network Security common traps →

A
An ACL to match the traffic to be translated
The ACL defines interesting traffic for NAT; without it, no packets are matched for translation.
B
A NAT pool with available public IP addresses
Why wrong: A NAT pool is needed for dynamic NAT, but the immediate issue is the missing ACL to match traffic.
C
Port Address Translation (PAT) configuration
Why wrong: PAT is a type of NAT, but the missing element is the ACL to identify traffic for translation.
D
A route map to apply NAT based on destination
Why wrong: Route maps are optional for policy-based NAT; standard NAT requires an ACL first.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Network Security explanation →

A security engineer is implementing Cisco Identity Services Engine (ISE) for 802.1X authentication. The requirement is to allow full network access for corporate devices that pass posture assessment, while providing limited access for guest devices. The engineer configures an authorization policy with conditions based on identity group and posture status. However, guest devices are still getting full access. What is the most likely cause?

Trap 1: The guest devices are not passing the certificate validation

Certificate validation affects authentication, not the order of authorization policies.

Trap 2: MAC Authentication Bypass (MAB) is not enabled for the guest devices

MAB is an authentication method, not directly related to authorization policy order.

Trap 3: The RADIUS attributes for dACL are not being sent correctly

dACL issues would affect enforcement, not policy matching order.

Study all Network Security common traps →

A
The guest devices are not passing the certificate validation
Why wrong: Certificate validation affects authentication, not the order of authorization policies.
B
The authorization rule for corporate devices is placed above the guest rule, and guest devices are matching the corporate rule first
ISE uses first-match; if guest devices match an earlier rule, they get the associated permissions.
C
MAC Authentication Bypass (MAB) is not enabled for the guest devices
Why wrong: MAB is an authentication method, not directly related to authorization policy order.
D
The RADIUS attributes for dACL are not being sent correctly
Why wrong: dACL issues would affect enforcement, not policy matching order.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full VPN explanation →

A company wants to deploy a site-to-site VPN between two branch offices using Cisco IOS routers. The security policy requires that all traffic between the sites must be encrypted and authenticated using strong encryption. The engineer chooses IPsec with IKEv2. Which IPsec transform set configuration provides the strongest encryption and authentication?

Trap 1: transform-set ESP-AES128 ESP-SHA-HMAC

AES-128 is strong, but SHA-1 is weak; the strongest would use AES-256 and SHA-256.

Trap 2: transform-set ESP-DES ESP-MD5-HMAC

DES and MD5 are considered weak and deprecated.

Trap 3: transform-set ESP-3DES ESP-SHA-HMAC

3DES is being phased out, and SHA-1 is weak.

Study all Network Security common traps →

A
transform-set ESP-AES128 ESP-SHA-HMAC
Why wrong: AES-128 is strong, but SHA-1 is weak; the strongest would use AES-256 and SHA-256.
B
transform-set ESP-AES256 ESP-SHA256-HMAC
AES-256 and SHA-256 provide strong encryption and authentication.
C
transform-set ESP-DES ESP-MD5-HMAC
Why wrong: DES and MD5 are considered weak and deprecated.
D
transform-set ESP-3DES ESP-SHA-HMAC
Why wrong: 3DES is being phased out, and SHA-1 is weak.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Network Security explanation →

An engineer is configuring Cisco Firepower Threat Defense (FTD) with a pre-filter policy to block traffic from known malicious IP addresses before it reaches the access control policy. The pre-filter rules are configured to block traffic from the malicious IPs. However, the engineer notices that some traffic from those IPs is still being allowed. What is the most likely reason?

Trap 1: The pre-filter rules are configured with the wrong source interface

Interface misconfiguration could cause the rule not to match, but the engineer specified source IPs, so interface is not the primary issue.

Trap 2: The access control policy is overriding the pre-filter policy

Pre-filter rules are evaluated before access control, so they take precedence.

Trap 3: The default action for the pre-filter policy is set to 'Allow'

Default action of 'Allow' would allow traffic that doesn't match any rule, but the traffic matches a rule that blocks, so that shouldn't happen.

Study all Network Security common traps →

A
A pre-filter rule with a lower priority (higher number) is matching the traffic first and allowing it
Pre-filter rules are evaluated in order; if a rule with a lower priority (higher number) matches first, it could allow traffic that should be blocked.
B
The pre-filter rules are configured with the wrong source interface
Why wrong: Interface misconfiguration could cause the rule not to match, but the engineer specified source IPs, so interface is not the primary issue.
C
The access control policy is overriding the pre-filter policy
Why wrong: Pre-filter rules are evaluated before access control, so they take precedence.
D
The default action for the pre-filter policy is set to 'Allow'
Why wrong: Default action of 'Allow' would allow traffic that doesn't match any rule, but the traffic matches a rule that blocks, so that shouldn't happen.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Network Security explanation →

A network administrator is configuring Cisco ASA with FirePOWER services. The administrator wants to inspect SSL traffic but is concerned about certificate pinning in modern applications. Which action should the administrator take to ensure that SSL inspection does not break applications that use certificate pinning?

Trap 1: Configure SSL inspection to bypass all traffic to avoid any issues

This would defeat the purpose of SSL inspection.

Trap 2: Install a custom root CA on all clients and configure the ASA to…

This is a general requirement for SSL inspection, but it does not address certificate pinning issues.

Trap 3: Use a decryption policy that decrypts the traffic but does not…

SSL inspection inherently requires re-encryption; you cannot leave traffic decrypted.

Study all Network Security common traps →

A
Configure SSL inspection to bypass all traffic to avoid any issues
Why wrong: This would defeat the purpose of SSL inspection.
B
Install a custom root CA on all clients and configure the ASA to use that CA
Why wrong: This is a general requirement for SSL inspection, but it does not address certificate pinning issues.
C
Create an SSL decryption rule to exclude traffic from applications known to use certificate pinning
Excluding pinned applications prevents the ASA from interfering with certificate validation.
D
Use a decryption policy that decrypts the traffic but does not re-encrypt
Why wrong: SSL inspection inherently requires re-encryption; you cannot leave traffic decrypted.

Full breakdown with real-world context →

Question 6mediummultiple choice

Study the full ACL explanation →

An engineer applies the ACL shown in the exhibit to the inbound direction of interface GigabitEthernet0/0. The goal is to block all traffic from host 10.1.1.100 to the 192.168.0.0/16 network. However, traffic from 10.1.1.100 to 192.168.1.1 is still being permitted. What is the most likely reason?

Exhibit

Refer to the exhibit.

ip access-list extended BLOCK_TRAFFIC
 deny ip host 10.1.1.100 192.168.0.0 0.0.255.255
 permit ip any any
!
interface GigabitEthernet0/0
 ip access-group BLOCK_TRAFFIC in

Trap 1: The deny entry should be placed after the permit entry

ACLs are processed top-down; the deny entry is first, so it should match before the permit.

Trap 2: The ACL should be applied outbound instead of inbound

Inbound ACL filters traffic coming into the interface; if the traffic arrives on that interface, inbound is correct.

Trap 3: The ACL is applied to the wrong direction; it should be 'out'

For blocking inbound traffic, the 'in' direction is correct.

Study all Network Security common traps →

A
The deny entry should be placed after the permit entry
Why wrong: ACLs are processed top-down; the deny entry is first, so it should match before the permit.
B
The ACL should be applied outbound instead of inbound
Why wrong: Inbound ACL filters traffic coming into the interface; if the traffic arrives on that interface, inbound is correct.
C
The ACL is applied to the wrong direction; it should be 'out'
Why wrong: For blocking inbound traffic, the 'in' direction is correct.
D
The traffic from 10.1.1.100 is entering through a different interface
If the traffic does not enter via GigabitEthernet0/0, the ACL will not be applied to it.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Network Security explanation →

Which TWO are valid methods for implementing Network Admission Control (NAC) in a Cisco environment?

Trap 1: Dynamic ARP Inspection (DAI)

DAI prevents ARP spoofing, not NAC.

Trap 2: IP source guard

IP source guard prevents IP spoofing, not NAC.

Trap 3: DHCP snooping

DHCP snooping is a security feature for DHCP, not NAC.

Study all Network Security common traps →

A
802.1X authentication
802.1X is a standard for network access control.
B
Dynamic ARP Inspection (DAI)
Why wrong: DAI prevents ARP spoofing, not NAC.
C
IP source guard
Why wrong: IP source guard prevents IP spoofing, not NAC.
D
DHCP snooping
Why wrong: DHCP snooping is a security feature for DHCP, not NAC.
E
MAC Authentication Bypass (MAB)
MAB is used for devices that cannot perform 802.1X.

Full breakdown with real-world context →

Question 8hardmulti select

Read the full Network Security explanation →

Which THREE are characteristics of Cisco Stealthwatch?

Trap 1: Acts as a next-generation firewall

Stealthwatch is not a firewall; it's a traffic analysis tool.

Trap 2: Functions as an intrusion prevention system (IPS)

It does not perform inline prevention; it is a detection and analysis tool.

Study all Network Security common traps →

A
Can integrate with Cisco ISE for automated threat response
Integration allows ISE to enforce policies based on Stealthwatch alerts.
B
Provides behavioral analysis to detect threats
It uses machine learning to establish baselines and detect anomalies.
C
Acts as a next-generation firewall
Why wrong: Stealthwatch is not a firewall; it's a traffic analysis tool.
D
Uses NetFlow and IPFIX for network traffic visibility
Stealthwatch collects flow data from network devices.
E
Functions as an intrusion prevention system (IPS)
Why wrong: It does not perform inline prevention; it is a detection and analysis tool.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full wireless explanation →

A multinational company has deployed a Cisco Firepower 4100 series device as the perimeter firewall. The network consists of multiple internal segments: a corporate LAN (192.168.1.0/24), a data center (10.10.0.0/16), and a guest wireless network (172.16.0.0/16). The firewall is configured with the following access control policy rules:

1. Allow from any to any (for testing, but currently enabled) 2. Allow from corporate LAN to data center (destination ports TCP/443, TCP/8443) 3. Block from guest wireless to data center 4. Allow from any to internet (destination any)

Recently, the security team discovered that a host in the guest network (172.16.5.50) is communicating with a server in the data center (10.10.10.100) on TCP port 443. The security team wants to immediately block this traffic without affecting other legitimate communications. Which action should be taken first?

Trap 1: Modify rule 2 to include a deny for the guest subnet

Rule 2 is for corporate LAN to data center; modifying it would not affect guest traffic.

Trap 2: Change rule 4 to block all traffic from guest network

This would block all guest internet access, which is not desired.

Trap 3: Add a new rule after rule 4 to block the specific traffic

A new rule after rule 4 would still be after the allow rule (rule 1), so it would not match because the traffic is already allowed by rule 1.

Study all Network Security common traps →

A
Move rule 3 (block guest to data center) above rule 1 (allow all)
This ensures the block rule is evaluated before the allow rule, stopping the traffic.
B
Modify rule 2 to include a deny for the guest subnet
Why wrong: Rule 2 is for corporate LAN to data center; modifying it would not affect guest traffic.
C
Change rule 4 to block all traffic from guest network
Why wrong: This would block all guest internet access, which is not desired.
D
Add a new rule after rule 4 to block the specific traffic
Why wrong: A new rule after rule 4 would still be after the allow rule (rule 1), so it would not match because the traffic is already allowed by rule 1.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Network Security explanation →

A security engineer is configuring Cisco TrustSec on a network. Which TWO actions are required to enable TrustSec on a Cisco switch?

Trap 1: Enable MACsec encryption on all trunk links.

MACsec is for link-layer encryption, not required for TrustSec.

Trap 2: Deploy Cisco ISE as the only policy server.

Cisco ISE is common but not required; local SGT assignment is possible.

Trap 3: Apply IP access-lists on interfaces to filter traffic based on…

TrustSec uses SGTs and SGACLs, not traditional IP ACLs.

Study all Network Security common traps →

A
Enable MACsec encryption on all trunk links.
Why wrong: MACsec is for link-layer encryption, not required for TrustSec.
B
Define Security Group Tags (SGTs) on the switch using the 'cts role-based sgt' command or via RADIUS.
SGTs must be defined to tag traffic.
C
Deploy Cisco ISE as the only policy server.
Why wrong: Cisco ISE is common but not required; local SGT assignment is possible.
D
Apply IP access-lists on interfaces to filter traffic based on source IP.
Why wrong: TrustSec uses SGTs and SGACLs, not traditional IP ACLs.
E
Configure 802.1X or MAC Authentication Bypass (MAB) on the switch ports.
802.1X/MAB is used to authenticate endpoints and assign an SGT.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Network Security explanation →

Refer to the exhibit. An engineer configured 802.1X on two switch ports. On Gi1/0/1, a VoIP phone and a PC are connected via a hub. On Gi1/0/2, only a single PC is connected. Which port will successfully authenticate both devices, and what is the issue with the other port?

Exhibit

Refer to the exhibit.

interface GigabitEthernet1/0/1
 switchport access vlan 10
 switchport mode access
 authentication host-mode multi-auth
 authentication port-control auto
 dot1x pae authenticator
 dot1x timeout tx-period 3
 spanning-tree portfast

interface GigabitEthernet1/0/2
 switchport access vlan 20
 switchport mode access
 authentication host-mode single-host
 authentication port-control auto
 dot1x pae authenticator
 dot1x timeout tx-period 30
 spanning-tree portfast

Trap 1: Both ports will authenticate all connected devices because 802.1X…

Single-host mode restricts to one device.

Trap 2: Gi1/0/2 will authenticate the PC; Gi1/0/1 will fail because…

Multi-auth is supported on access ports.

Trap 3: Gi1/0/1 will authenticate both devices; Gi1/0/2 will fail because…

The tx-period does not cause failure; it only delays retransmission.

Study all Network Security common traps →

A
Both ports will authenticate all connected devices because 802.1X supports multiple hosts by default.
Why wrong: Single-host mode restricts to one device.
B
Gi1/0/2 will authenticate the PC; Gi1/0/1 will fail because multi-auth is not supported on access ports.
Why wrong: Multi-auth is supported on access ports.
C
Gi1/0/1 will authenticate both devices; Gi1/0/2 will fail because the tx-period is too long.
Why wrong: The tx-period does not cause failure; it only delays retransmission.
D
Gi1/0/1 will authenticate both devices; Gi1/0/2 will only authenticate the PC, and any additional device will be denied.
Multi-auth allows multiple devices; single-host allows only one.

Full breakdown with real-world context →

Question 12easymultiple choice

Read the full Network Security explanation →

A large enterprise uses Cisco Firepower Threat Defense (FTD) as its next-generation firewall. The network team recently deployed a new application that uses HTTPS for all communications. Users report that the application is slow and sometimes fails to load pages. The security team suspects that SSL inspection might be causing the issue. The FTD is configured with an SSL policy that decrypts all HTTPS traffic using a self-signed certificate. The internal CA is not trusted by the application servers. Which action should the engineer take to resolve the performance and connectivity issues while maintaining security visibility?

Trap 1: Increase the SSL decryption resources by adding more FTD modules.

Does not solve the certificate trust issue.

Trap 2: Install the internal CA certificate on all application servers.

May be impractical and does not address the root cause on the firewall.

Trap 3: Disable SSL inspection globally on the FTD.

This removes security visibility for all HTTPS traffic.

Study all Network Security common traps →

A
Increase the SSL decryption resources by adding more FTD modules.
Why wrong: Does not solve the certificate trust issue.
B
Create an SSL decryption bypass rule for the specific application servers' IP addresses.
Allows trusted traffic to pass without inspection, reducing load and avoiding certificate errors.
C
Install the internal CA certificate on all application servers.
Why wrong: May be impractical and does not address the root cause on the firewall.
D
Disable SSL inspection globally on the FTD.
Why wrong: This removes security visibility for all HTTPS traffic.

Full breakdown with real-world context →

Question 13mediumdrag order

Review the full routing breakdown →

Drag and drop the steps to configure a Cisco IOS router as a Zone-Based Firewall (ZBF) in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14mediumdrag order

Read the full DHCP explanation →

Drag and drop the steps to configure a Cisco router as a DHCP server in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediummatching

Read the full Network Security explanation →

Match each Cisco ASA feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Modular Policy Framework for traffic inspection

High availability with active/standby or active/active

Graphical management interface

Command-line interface for configuration

VPN client for remote access

Question 16mediummatching

Read the full Network Security explanation →

Match each encryption algorithm to its type.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Symmetric block cipher

Asymmetric public-key algorithm

Hash function

Symmetric block cipher (legacy)

Key exchange algorithm

Question 17easymultiple choice

Read the full VPN explanation →

A network engineer is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration includes a crypto map with a matching access list. Which command should be used to verify the security associations and error counters for the IPsec phase?

Trap 1: show crypto engine statistics

Shows crypto engine utilization, not SA details.

Trap 2: debug crypto isakmp

Debug command that can impact performance; not a verification show command.

Trap 3: show crypto isakmp sa

Shows IKE phase 1 SAs, not IPsec phase 2 SAs.

Study all Network Security common traps →

A
show crypto ipsec sa
Displays IPsec security associations and packet/error counters.
B
show crypto engine statistics
Why wrong: Shows crypto engine utilization, not SA details.
C
debug crypto isakmp
Why wrong: Debug command that can impact performance; not a verification show command.
D
show crypto isakmp sa
Why wrong: Shows IKE phase 1 SAs, not IPsec phase 2 SAs.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full Network Security explanation →

A company is deploying a new ASA firewall in a DMZ design. They need to allow web traffic from the internet to a web server in the DMZ, while also permitting outbound traffic from the DMZ to the internet for software updates. Which access control approach best meets these requirements with minimal risk?

Trap 1: Create an ACL that permits all inbound and outbound traffic between…

Overly permissive, defeats purpose of DMZ segmentation.

Trap 2: Create an ACL that permits inbound web traffic to the DMZ server…

Allowing all outbound without inspection increases risk of malware exfiltration.

Trap 3: Create an ACL that permits inbound web traffic to the DMZ server…

Denies software updates, breaking functionality.

Study all Network Security common traps →

A
Create an ACL that permits all inbound and outbound traffic between DMZ and internet.
Why wrong: Overly permissive, defeats purpose of DMZ segmentation.
B
Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection.
Balances security and functionality by inspecting traffic and limiting outbound to necessary services.
C
Create an ACL that permits inbound web traffic to the DMZ server and permits all outbound traffic from DMZ with no inspection.
Why wrong: Allowing all outbound without inspection increases risk of malware exfiltration.
D
Create an ACL that permits inbound web traffic to the DMZ server and denies all outbound traffic from DMZ.
Why wrong: Denies software updates, breaking functionality.

Full breakdown with real-world context →

Question 19hardmultiple choice

Read the full VPN explanation →

An engineer is designing a FlexVPN deployment with multiple hub routers and spoke routers. The spokes need to establish tunnels to the closest hub based on latency. Which feature should be configured to achieve dynamic hub selection?

Trap 1: Configure static priority on each hub and use priority-based…

Static priority does not adapt to latency changes.

Trap 2: Use Multipoint GRE with mGRE and NHRP for dynamic tunnel selection.

mGRE/NHRP is for DMVPN, not FlexVPN dynamic hub selection.

Trap 3: Use DHCP option 121 to push static routes for hub selection.

DHCP option 121 pushes routes, not adaptive hub selection.

Study all Network Security common traps →

A
Configure static priority on each hub and use priority-based selection.
Why wrong: Static priority does not adapt to latency changes.
B
Use Multipoint GRE with mGRE and NHRP for dynamic tunnel selection.
Why wrong: mGRE/NHRP is for DMVPN, not FlexVPN dynamic hub selection.
C
Use DHCP option 121 to push static routes for hub selection.
Why wrong: DHCP option 121 pushes routes, not adaptive hub selection.
D
Implement IKEv2 redirect mechanism to direct spokes to the optimal hub.
IKEv2 redirect allows hubs to redirect spokes to a better hub based on location or latency.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full DNS explanation →

A security administrator is reviewing firewall logs and notices that an internal user is generating excessive outbound DNS queries to a known malicious domain. The company uses Cisco Umbrella for DNS-layer security. How should the administrator investigate and block this traffic?

Trap 1: Create a firewall ACL to block the IP address of the DNS server…

Blocking the DNS server would disrupt all DNS, not just the malicious domain.

Trap 2: Disable the user's network access temporarily and inform the IT…

Disabling access is heavy-handed and does not address the root cause.

Trap 3: Enable full packet capture on the internal network and wait for the…

Reactive and does not immediately block the threat.

Study all Network Security common traps →

A
Check the Cisco Umbrella dashboard for the domain, identify the internal IP, and block the domain via policy.
Umbrella provides visibility and enforcement at the DNS layer, stopping malicious queries before connection.
B
Create a firewall ACL to block the IP address of the DNS server from the internal user.
Why wrong: Blocking the DNS server would disrupt all DNS, not just the malicious domain.
C
Disable the user's network access temporarily and inform the IT department.
Why wrong: Disabling access is heavy-handed and does not address the root cause.
D
Enable full packet capture on the internal network and wait for the next occurrence.
Why wrong: Reactive and does not immediately block the threat.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Network Security sessions

Start a Network Security only practice session

Every question in these sessions is drawn from the Network Security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Network Security questions →Mixed 350-701 session

Frequently asked questions

What does the 350-701 exam test about Network Security?: Network Security questions on this certification test your ability to deploy and manage network security concepts in scenario-based situations.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Network Security questions in a focused session?: Yes — the session launcher on this page draws every question from the Network Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 350-701 topics?: Use the topic links above to move to related areas, or go back to the 350-701 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 350-701 exam covers. They are not copied from any real exam or dump site.

Network Security only

10 questions 20 questions 30 questions 50 questions

Mixed 350-701 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 350-701 questions Network Security domain overview 350-701 exam guide

Exam traps to avoid

▸Selecting the most expensive service when a simpler managed option meets the requirement.
▸Forgetting that cloud resources must be explicitly secured — defaults are rarely secure.
▸Choosing a global service fix when the issue is region-specific.
▸Overlooking cost implications of cross-region data transfer in architecture questions.

Network Security practice questions

What to know about Network Security

Common Network Security exam traps

Network Security questions

An engineer applies the ACL shown in the exhibit to the inbound direction of interface GigabitEthernet0/0. The goal is to block all traffic from host 10.1.1.100 to the 192.168.0.0/16 network. However, traffic from 10.1.1.100 to 192.168.1.1 is still being permitted. What is the most likely reason?

Exhibit

Which TWO are valid methods for implementing Network Admission Control (NAC) in a Cisco environment?

Which THREE are characteristics of Cisco Stealthwatch?

A security engineer is configuring Cisco TrustSec on a network. Which TWO actions are required to enable TrustSec on a Cisco switch?

Refer to the exhibit. An engineer configured 802.1X on two switch ports. On Gi1/0/1, a VoIP phone and a PC are connected via a hub. On Gi1/0/2, only a single PC is connected. Which port will successfully authenticate both devices, and what is the issue with the other port?

Exhibit

Drag and drop the steps to configure a Cisco IOS router as a Zone-Based Firewall (ZBF) in the correct order.

Drag and drop the steps to configure a Cisco router as a DHCP server in the correct order.

Match each Cisco ASA feature to its description.

Match each encryption algorithm to its type.

A network engineer is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration includes a crypto map with a matching access list. Which command should be used to verify the security associations and error counters for the IPsec phase?

An engineer is designing a FlexVPN deployment with multiple hub routers and spoke routers. The spokes need to establish tunnels to the closest hub based on latency. Which feature should be configured to achieve dynamic hub selection?

A security administrator is reviewing firewall logs and notices that an internal user is generating excessive outbound DNS queries to a known malicious domain. The company uses Cisco Umbrella for DNS-layer security. How should the administrator investigate and block this traffic?

Track your progress over time

Start a Network Security only practice session

Related 350-701 topic practice pages

Endpoint Protection and Detection practice questions

Secure Network Access, Visibility and Enforcement practice questions

Security Concepts practice questions