Scenario practice questions

During a security incident, it is observed that a server behind a Cisco ASA is being accessed repeatedly with different source IPs in a short time. The firewall logs show many dropped packets to the server's IP on port 443. What is the most effective mitigation to reduce the impact while maintaining legitimate access?

Trap 1: Increase the connection timeout

Increasing timeout may worsen the impact by holding more table entries.

Trap 2: Implement an access-list to allow only known source IPs

Unknown sources would be legitimate users, so this is impractical.

Trap 3: Configure a static route to null0 for the server's IP

Null routing drops all traffic to that IP, including legitimate.

A
Increase the connection timeout
Why wrong: Increasing timeout may worsen the impact by holding more table entries.
B
Implement an access-list to allow only known source IPs
Why wrong: Unknown sources would be legitimate users, so this is impractical.
C
Configure a static route to null0 for the server's IP
Why wrong: Null routing drops all traffic to that IP, including legitimate.
D
Enable TCP Intercept with a low threshold
TCP Intercept mitigates SYN floods by intercepting and verifying connections.

Question 2hardmultiple choice

A SOC analyst notices that a user downloaded a malicious file from a website. The Cisco WSA is configured with AMP file scanning. However, the file was not blocked. Which scenario best explains why AMP failed to detect the file?

Trap 1: The file was cached from a previous scan

Caching would still have a disposition if previously scanned.

Trap 2: The file was less than 10 KB

File size is not a typical reason for AMP to miss detection.

Trap 3: SSL decryption was disabled

If the download was over HTTPS, decryption would be needed to inspect the file. But if decryption was disabled, AMP might not see the file at all.

A
The file was a zero-day malware not yet analyzed by AMP
Correct. Zero-day files may not have a known reputation and could be allowed.
B
The file was cached from a previous scan
Why wrong: Caching would still have a disposition if previously scanned.
C
The file was less than 10 KB
Why wrong: File size is not a typical reason for AMP to miss detection.
D
SSL decryption was disabled
Why wrong: If the download was over HTTPS, decryption would be needed to inspect the file. But if decryption was disabled, AMP might not see the file at all.

Question 3hardmultiple choice

A company using Cisco ESA receives an email that appears to be from the CEO requesting an urgent wire transfer. The email fails SPF and DKIM checks but passes DMARC. What is the most likely explanation?

Trap 1: The email passed SPF alignment

The stem says SPF failed.

Trap 2: DKIM signature was valid but not aligned

DKIM failed, so no.

Trap 3: The sender IP is in the SPF whitelist

SPF failed, so not whitelisted.

A
The email passed SPF alignment
Why wrong: The stem says SPF failed.
B
DMARC policy is set to 'p=none'
Correct. DMARC with 'p=none' only monitors, does not affect delivery.
C
DKIM signature was valid but not aligned
Why wrong: DKIM failed, so no.
D
The sender IP is in the SPF whitelist
Why wrong: SPF failed, so not whitelisted.

Question 4hardmultiple choice

A security analyst receives an alert that a user clicked a link in an email that led to a malicious website. The email was allowed by the Cisco ESA because it passed SPF, DKIM, and DMARC checks. Later analysis reveals the email was sent from a compromised account within the same domain. Which type of attack best describes this scenario?

Trap 1: Malspam

Malspam is spam with malware attachments; this scenario involves a link and a compromised account.

Trap 2: Spear phishing

Spear phishing is targeted but does not necessarily involve a compromised account within the organization.

Trap 3: Whaling

Whaling targets executives; the scenario does not specify the user.

A
Account takeover (BEC)
Account takeover involves using a compromised legitimate account to send malicious emails, bypassing authentication.
B
Malspam
Why wrong: Malspam is spam with malware attachments; this scenario involves a link and a compromised account.
C
Spear phishing
Why wrong: Spear phishing is targeted but does not necessarily involve a compromised account within the organization.
D
Whaling
Why wrong: Whaling targets executives; the scenario does not specify the user.

Question 5mediummultiple choice

An engineer is configuring an access control policy on Cisco FMC for FTD. The policy must allow HTTP traffic from the inside zone to the outside zone, but block all other traffic. Which rule configuration is correct?

Trap 1: Rule 1: Trust HTTP from inside to outside; Rule 2: Block all…

Trust rule allows HTTP without inspection, but a default deny rule would block other traffic; however trust is not necessary and could bypass security checks.

Trap 2: Rule 1: Block all traffic; Rule 2: Allow HTTP from inside to…

Block all traffic first would deny HTTP before it can be allowed.

Trap 3: Rule 1: Allow HTTP from inside to outside; no default rule.

Without a default deny rule, all other traffic would be allowed by default.

A
Rule 1: Trust HTTP from inside to outside; Rule 2: Block all traffic.
Why wrong: Trust rule allows HTTP without inspection, but a default deny rule would block other traffic; however trust is not necessary and could bypass security checks.
B
Rule 1: Permit HTTP from inside to outside; Rule 2: Block all traffic.
Correct; permit allows HTTP with inspection, and the default deny blocks everything else.
C
Rule 1: Block all traffic; Rule 2: Allow HTTP from inside to outside.
Why wrong: Block all traffic first would deny HTTP before it can be allowed.
D
Rule 1: Allow HTTP from inside to outside; no default rule.
Why wrong: Without a default deny rule, all other traffic would be allowed by default.

Question 6hardmultiple choice

A Cisco FTD device is configured with an SSL decryption rule using 'Decrypt - Known Key'. In which scenario is this action appropriate?

Trap 1: Decrypting traffic to any HTTPS site using a self-signed certificate

Self-signed certificates would use Decrypt - Resign.

Trap 2: Decrypting traffic to an external website

For external sites, you would use Decrypt - Resign.

Trap 3: Decrypting traffic without inspecting the certificate

That would be 'Do not decrypt' or bypass.

A
Decrypting traffic to any HTTPS site using a self-signed certificate
Why wrong: Self-signed certificates would use Decrypt - Resign.
B
Decrypting traffic to an external website
Why wrong: For external sites, you would use Decrypt - Resign.
C
Decrypting traffic without inspecting the certificate
Why wrong: That would be 'Do not decrypt' or bypass.
D
Decrypting traffic to an internal server whose private key is imported
Known Key is used when you have the server's private key.

Question 7hardmultiple choice

A Cisco FTD sensor is deployed in passive mode (IDS) and is receiving traffic via a network tap. The access control policy is configured with an intrusion policy set to 'Security over Connectivity'. However, the administrator notices that the sensor is not generating alerts for some attacks that were identified by a previous inline sensor. What is the most likely reason?

Trap 1: The access control policy requires an 'allow' action to perform…

Incorrect. In passive mode, the sensor inspects all traffic regardless of action.

Trap 2: The intrusion policy is set to 'Security over Connectivity', which…

Incorrect. 'Security over Connectivity' increases sensitivity, not reduces.

Trap 3: The intrusion policy is not configured to generate alerts.

Incorrect. Intrusion policy by default generates alerts.

A
The sensor is in passive mode and cannot see return traffic due to asymmetric routing.
Correct. Passive sensors rely on seeing both directions of traffic; asymmetric routing can cause missed detections.
B
The access control policy requires an 'allow' action to perform intrusion inspection.
Why wrong: Incorrect. In passive mode, the sensor inspects all traffic regardless of action.
C
The intrusion policy is set to 'Security over Connectivity', which reduces false positives but may miss some attacks.
Why wrong: Incorrect. 'Security over Connectivity' increases sensitivity, not reduces.
D
The intrusion policy is not configured to generate alerts.
Why wrong: Incorrect. Intrusion policy by default generates alerts.

Question 8hardmultiple choice

Based on the exhibit, what is the root cause of the AMP connector's inability to connect to the cloud?

Exhibit

Refer to the exhibit.

```
2024-01-15 11:00:00 ERROR: Failed to connect to AMP cloud: Connection timed out
2024-01-15 11:01:00 WARNING: Retrying connection in 60 seconds
2024-01-15 11:02:00 INFO: Proxy configured: proxy.company.com:3128
2024-01-15 11:03:00 ERROR: Proxy authentication failed: 407 Proxy Authentication Required
```

Trap 1: The AMP cloud servers are blocking the connector's IP address.

There is no evidence of cloud blocking; the error is at the proxy level.

Trap 2: The proxy server address is incorrect in the connector…

The log shows the proxy is configured and the connector is attempting to use it (407 error).

Trap 3: The connector has no network connectivity to the internet.

The initial timeout could be due to proxy, but later logs show the proxy is reachable.

A
The AMP cloud servers are blocking the connector's IP address.
Why wrong: There is no evidence of cloud blocking; the error is at the proxy level.
B
The proxy server address is incorrect in the connector configuration.
Why wrong: The log shows the proxy is configured and the connector is attempting to use it (407 error).
C
The proxy requires authentication, and the AMP connector has no credentials configured.
The 407 error explicitly indicates proxy authentication failure.
D
The connector has no network connectivity to the internet.
Why wrong: The initial timeout could be due to proxy, but later logs show the proxy is reachable.

Question 9mediummultiple choice

An organization uses Cisco ISE for guest access. They want to allow guests to create their own accounts through a web portal while requiring approval from a sponsor before network access is granted. Which guest access method should be configured?

Trap 1: Hotspot guest access

Hotspot typically uses a simple acceptance page, not account creation.

Trap 2: Self-registration without approval

This grants immediate access without sponsor approval, not matching the requirement.

Trap 3: Sponsor portal

Sponsor portal allows sponsors to create accounts for guests, not self-registration.

A
Hotspot guest access
Why wrong: Hotspot typically uses a simple acceptance page, not account creation.
B
Self-registration with sponsor approval
This allows guests to register themselves and then requires sponsor approval.
C
Self-registration without approval
Why wrong: This grants immediate access without sponsor approval, not matching the requirement.
D
Sponsor portal
Why wrong: Sponsor portal allows sponsors to create accounts for guests, not self-registration.

Read the full wireless explanation →

Question 10easymultiple choice

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?

Trap 1: Profiling policy

Profiling policy is used to identify device attributes, not to grant access.

Trap 2: Authentication policy

Authentication policy only determines how users are authenticated, not the resulting access.

Trap 3: Policy set

Policy set is a container that groups authentication and authorization policies; it does not directly enforce access.

A
Profiling policy
Why wrong: Profiling policy is used to identify device attributes, not to grant access.
B
Authentication policy
Why wrong: Authentication policy only determines how users are authenticated, not the resulting access.
C
Authorization policy
Authorization policy defines what access is granted after authentication.
D
Policy set
Why wrong: Policy set is a container that groups authentication and authorization policies; it does not directly enforce access.

Read the full DNS explanation →

Question 11hardmultiple choice

A network administrator is configuring Cisco Umbrella for web security. They want to ensure that all DNS requests from branch offices are sent to Umbrella for policy enforcement, but they have limited control over the branch routers. What is the most effective deployment method?

Trap 1: Set up a transparent proxy on the branch routers

Proxy configuration is more involved and not DNS-specific.

Trap 2: Configure Umbrella as DNS forwarder on the branch routers

Requires control over routers, which the administrator does not have.

Trap 3: Use PAC files on the clients to redirect web traffic

PAC files are for HTTP proxy, not DNS-level enforcement.

A
Deploy the Umbrella roaming client on endpoints
Endpoints send DNS directly to Umbrella, no network changes needed.
B
Set up a transparent proxy on the branch routers
Why wrong: Proxy configuration is more involved and not DNS-specific.
C
Configure Umbrella as DNS forwarder on the branch routers
Why wrong: Requires control over routers, which the administrator does not have.
D
Use PAC files on the clients to redirect web traffic
Why wrong: PAC files are for HTTP proxy, not DNS-level enforcement.

Review the full routing breakdown →

Question 12hardmultiple choice

A network administrator is configuring IKEv2 on a Cisco router and wants to ensure that the router does not initiate connections but only responds to incoming IKEv2 requests. Which configuration command should be applied?

Trap 1: crypto ikev2 no initiate

Not a valid command in Cisco IOS.

Trap 2: crypto ikev2 limit max-incoming-sa 10

Limits number of incoming SAs, but does not prevent initiation.

Trap 3: crypto ikev2 limit max-negotiations 10

Limits simultaneous negotiations, but router can still initiate.

A
crypto ikev2 no initiate
Why wrong: Not a valid command in Cisco IOS.
B
crypto ikev2 passive
This command disables IKEv2 initiation, making the router respond-only.
C
crypto ikev2 limit max-incoming-sa 10
Why wrong: Limits number of incoming SAs, but does not prevent initiation.
D
crypto ikev2 limit max-negotiations 10
Why wrong: Limits simultaneous negotiations, but router can still initiate.

Question 13hardmultiple choice

An organization is using Cisco Umbrella alongside Cisco AMP for Endpoints. A user reports that they cannot access a legitimate file-sharing website. However, the site is not categorized as malicious by Umbrella. What is the most likely reason for the block?

Trap 1: The website's domain is in a custom block list

The scenario says the site is not categorized as malicious, and custom block lists would be part of Umbrella's policy.

Trap 2: The endpoint's firewall is blocking the connection

Firewall would affect all sites, not just this one.

Trap 3: The user is behind a proxy that is not configured with Umbrella

If Umbrella is enforced via DNS, proxy configuration is not required.

A
Cisco AMP's Intelligent Proxy detected the file download as potentially malicious and blocked it
Cisco AMP's Intelligent Proxy detected the file download as potentially malicious and blocked it. This feature inspects file downloads based on real-time threat intelligence, even if the website itself is not categorized as malicious by Cisco Umbrella.
B
The website's domain is in a custom block list
Why wrong: The scenario says the site is not categorized as malicious, and custom block lists would be part of Umbrella's policy.
C
The endpoint's firewall is blocking the connection
Why wrong: Firewall would affect all sites, not just this one.
D
The user is behind a proxy that is not configured with Umbrella
Why wrong: If Umbrella is enforced via DNS, proxy configuration is not required.

Question 14mediummultiple choice

An engineer is configuring Cisco ISE for guest access. The requirement is that guests must accept an acceptable use policy (AUP) before being granted network access. Which portal type should be used?

Trap 1: Sponsored guest portal

Requires a sponsor, not suitable for self-service AUP acceptance.

Trap 2: Hotspot guest portal

Provides open access without authentication.

Trap 3: BYOD portal

Used for device onboarding, not guest access.

A
Sponsored guest portal
Why wrong: Requires a sponsor, not suitable for self-service AUP acceptance.
B
Hotspot guest portal
Why wrong: Provides open access without authentication.
C
BYOD portal
Why wrong: Used for device onboarding, not guest access.
D
Self-registration guest portal
Allows guests to register and accept AUP.