How should I use these Security Concepts practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security Concepts questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security Concepts domain.

350-701 · topic practice

Security Concepts practice questions

Use this page to practise Security Concepts questions for this certification. Focus on how the exam tests security concepts in scenario format — understanding the why behind each answer builds more durable knowledge than memorising options.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security Concepts

Practice 10 questions Browse domain →

What the exam tests

What to know about Security Concepts

Security Concepts questions on this certification test your ability to deploy and manage security concepts concepts in scenario-based situations.

Core Security Concepts concepts and how they apply in real-world cloud scenarios.

How to deploy security concepts correctly and verify the outcome.

Troubleshooting security concepts issues by interpreting error output and system state.

Cloud best practices and Security Concepts design trade-offs tested by this certification.

Watch out for

Common Security Concepts exam traps

▸Selecting the most expensive service when a simpler managed option meets the requirement.
▸Forgetting that cloud resources must be explicitly secured — defaults are rarely secure.
▸Choosing a global service fix when the issue is region-specific.
▸Overlooking cost implications of cross-region data transfer in architecture questions.

Practice set

Security Concepts questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Open the full VLAN trunking answer →

A network security engineer is deploying Cisco Firepower Threat Defense (FTD) in a data center. The requirement is to inspect traffic between two internal VLANs while allowing the firewall to enforce access control policies based on source and destination zones. Which deployment mode should the engineer use?

Trap 1: Routed mode

Routed mode requires IP changes and is not optimal for same-subnet traffic inspection between VLANs.

Trap 2: Inline mode

Inline mode is not a standard FTD deployment mode; it refers to inline tap/set on Firepower sensors.

Trap 3: Hybrid mode

Hybrid mode is not a valid deployment mode for FTD.

Study all Security Concepts common traps →

A
Routed mode
Why wrong: Routed mode requires IP changes and is not optimal for same-subnet traffic inspection between VLANs.
B
Inline mode
Why wrong: Inline mode is not a standard FTD deployment mode; it refers to inline tap/set on Firepower sensors.
C
Transparent mode
Transparent mode operates at layer 2, allowing inspection between VLANs without IP renumbering.
D
Hybrid mode
Why wrong: Hybrid mode is not a valid deployment mode for FTD.

Full breakdown with real-world context →

Question 2hardmultiple choice

Study the full SD-WAN breakdown →

A security architect is designing a zero-trust architecture for a remote workforce using Cisco SD-WAN. The company requires that all traffic between branch sites and the data center is encrypted and authenticated, and that no device can access resources unless it has a valid certificate. Which technology should be used to enforce device identity?

Trap 1: 802.1X with EAP-TLS

While 802.1X authenticates devices, TrustSec builds on it to tag and enforce policies across the network.

Trap 2: Network Access Control (NAC)

NAC is a broad concept; TrustSec is the Cisco-specific implementation for identity-based policy enforcement.

Trap 3: IPsec VPN

IPsec encrypts traffic but does not enforce device identity or posture checks.

Study all Security Concepts common traps →

A
802.1X with EAP-TLS
Why wrong: While 802.1X authenticates devices, TrustSec builds on it to tag and enforce policies across the network.
B
Network Access Control (NAC)
Why wrong: NAC is a broad concept; TrustSec is the Cisco-specific implementation for identity-based policy enforcement.
C
Cisco TrustSec
TrustSec uses SGTs to enforce access based on device identity and is a key component of zero trust.
D
IPsec VPN
Why wrong: IPsec encrypts traffic but does not enforce device identity or posture checks.

Full breakdown with real-world context →

Question 3easymultiple choice

Study the full ACL explanation →

An engineer is troubleshooting a Cisco ASA firewall and notices that traffic from a specific subnet is being dropped. The engineer wants to verify if the drop is due to an access control list (ACL) or an inspection policy. Which command should be used to see the reason for packet drops?

Trap 1: show access-list

Shows ACL hit counts but not drop reasons.

Trap 2: show conn

Shows active connections, not drop reasons.

Trap 3: show service-policy

Shows inspection policy statistics but not specific drop reasons.

Study all Security Concepts common traps →

A
show access-list
Why wrong: Shows ACL hit counts but not drop reasons.
B
show asp drop
Displays packet drop counters with reasons, including ACL and inspection drops.
C
show conn
Why wrong: Shows active connections, not drop reasons.
D
show service-policy
Why wrong: Shows inspection policy statistics but not specific drop reasons.

Full breakdown with real-world context →

Question 4mediummulti select

Read the full Security Concepts explanation →

Which TWO of the following are valid approaches to mitigate ARP spoofing attacks on a switched network?

Trap 1: Enable BPDU Guard on all switchports

BPDU Guard prevents STP attacks, not ARP spoofing.

Trap 2: Enable Port Security on all access ports

Port Security limits MAC addresses but does not prevent ARP spoofing.

Trap 3: Enable DHCP Snooping globally

DHCP Snooping is a prerequisite for DAI but does not directly mitigate ARP spoofing.

Study all Security Concepts common traps →

A
Enable BPDU Guard on all switchports
Why wrong: BPDU Guard prevents STP attacks, not ARP spoofing.
B
Enable Dynamic ARP Inspection (DAI) on VLANs
DAI validates ARP packets and drops invalid ones.
C
Enable IP Source Guard on untrusted ports
IP Source Guard filters traffic based on IP-MAC binding, preventing spoofing.
D
Enable Port Security on all access ports
Why wrong: Port Security limits MAC addresses but does not prevent ARP spoofing.
E
Enable DHCP Snooping globally
Why wrong: DHCP Snooping is a prerequisite for DAI but does not directly mitigate ARP spoofing.

Full breakdown with real-world context →

Question 5hardmulti select

Read the full Security Concepts explanation →

Which THREE of the following are key principles of the Cisco Zero Trust security model?

Trap 1: Implicit trust for internal traffic

Zero trust eliminates implicit trust.

Trap 2: Perimeter-based security

Zero trust moves beyond perimeter-based models.

Study all Security Concepts common traps →

A
Never trust, always verify
Core principle of zero trust.
B
Continuous monitoring and validation
Constant verification of trust is essential.
C
Implicit trust for internal traffic
Why wrong: Zero trust eliminates implicit trust.
D
Perimeter-based security
Why wrong: Zero trust moves beyond perimeter-based models.
E
Least privilege access
Users and devices get only minimum required access.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full DHCP explanation →

Refer to the exhibit. An engineer has configured IP Source Guard and DHCP Snooping. A host with MAC 00:11:22:33:44:55 on Gi0/0 is assigned IP 192.168.1.10 via DHCP. However, the host cannot ping its default gateway 192.168.1.1. What is the most likely cause?

Exhibit

Refer to the exhibit.

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip verify source
!
interface GigabitEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 ip verify source
!
ip dhcp snooping vlan 1-100
ip dhcp snooping information option
ip dhcp snooping
!
ip source binding 00:11:22:33:44:55 vlan 10 192.168.1.10 interface GigabitEthernet0/0
!

Trap 1: The static IP source binding is configured on the wrong VLAN

The binding is for VLAN 10, and the host is on VLAN 10 (implied by IP 192.168.1.10/24).

Trap 2: ARP inspection is not enabled, so the switch drops ARP replies

DAI is not configured, but without it, ARP works normally.

Trap 3: The 'ip verify source' command is missing the 'port-security'…

Without 'port-security', IP Source Guard only checks IP, not MAC, but the host's IP matches.

Study all Security Concepts common traps →

A
The DHCP snooping database is not updated because interface Gi0/1 is not trusted
Gi0/1 is not configured as trust, so DHCP replies from the server are dropped, and the host may not have a valid lease. However, the static binding exists, but dynamic bindings fail.
B
The static IP source binding is configured on the wrong VLAN
Why wrong: The binding is for VLAN 10, and the host is on VLAN 10 (implied by IP 192.168.1.10/24).
C
ARP inspection is not enabled, so the switch drops ARP replies
Why wrong: DAI is not configured, but without it, ARP works normally.
D
The 'ip verify source' command is missing the 'port-security' keyword
Why wrong: Without 'port-security', IP Source Guard only checks IP, not MAC, but the host's IP matches.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full Security Concepts explanation →

Refer to the exhibit. An engineer is analyzing an intrusion policy on Cisco Firepower Management Center (FMC). The network uses Windows servers and clients. A flood of HTTP traffic is being detected as a potential attack, but it is legitimate. Which preprocessor configuration change would most likely reduce false positives without losing detection of real attacks?

Exhibit

Refer to the exhibit.

! Cisco FMC intrusion policy snippet
preprocessor global_sensitivity: sensitivity_level high
preprocessor frag3: frag3_engine policy=first, bind_to=0.0.0.0
preprocessor stream5_global: track_tcp yes, track_udp yes
preprocessor stream5_tcp: policy=windows, use_static_footprint_sizes yes
preprocessor http_inspect: global iis_unicode_map unicode.map 1252
preprocessor http_inspect: default_inspect_http_profiles
preprocessor smtp: ports 25 465 587
!

Trap 1: Disable the http_inspect preprocessor

Disabling HTTP inspection would prevent detection of HTTP-based attacks.

Trap 2: Change frag3 policy to bsd

Frag3 policy affects IP fragmentation reassembly, not HTTP false positives.

Trap 3: Change stream5_tcp policy to linux

Linux policy is not optimal for Windows environment and may cause false negatives.

Study all Security Concepts common traps →

A
Disable the http_inspect preprocessor
Why wrong: Disabling HTTP inspection would prevent detection of HTTP-based attacks.
B
Change global_sensitivity to medium
Lowering sensitivity reduces false positives for benign traffic while still detecting true attacks.
C
Change frag3 policy to bsd
Why wrong: Frag3 policy affects IP fragmentation reassembly, not HTTP false positives.
D
Change stream5_tcp policy to linux
Why wrong: Linux policy is not optimal for Windows environment and may cause false negatives.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full DNS explanation →

A company is implementing Cisco Umbrella to provide DNS-layer security. They want to block access to known malicious domains while allowing all other traffic. Which policy configuration should be used?

Trap 1: Enable selective proxy for all traffic

Selective proxy is not a policy type in Umbrella.

Trap 2: Create an allow list with only safe domains

That would block all domains not on the list, which is too restrictive.

Trap 3: Use a custom policy with both allow and block lists

While possible, it is not the simplest and typically block list is sufficient.

Study all Security Concepts common traps →

A
Create a block list with known malicious domains
Block list allows all traffic except specified malicious domains.
B
Enable selective proxy for all traffic
Why wrong: Selective proxy is not a policy type in Umbrella.
C
Create an allow list with only safe domains
Why wrong: That would block all domains not on the list, which is too restrictive.
D
Use a custom policy with both allow and block lists
Why wrong: While possible, it is not the simplest and typically block list is sufficient.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Security Concepts explanation →

An engineer is configuring Cisco ISE for guest access. The requirement is that guests must accept an acceptable use policy (AUP) before being granted network access. Which portal type should be used?

Trap 1: Sponsored guest portal

Requires a sponsor, not suitable for self-service AUP acceptance.

Trap 2: Hotspot guest portal

Provides open access without authentication.

Trap 3: BYOD portal

Used for device onboarding, not guest access.

Study all Security Concepts common traps →

A
Sponsored guest portal
Why wrong: Requires a sponsor, not suitable for self-service AUP acceptance.
B
Hotspot guest portal
Why wrong: Provides open access without authentication.
C
BYOD portal
Why wrong: Used for device onboarding, not guest access.
D
Self-registration guest portal
Allows guests to register and accept AUP.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full VPN explanation →

Which TWO of the following are valid methods for authenticating VPN users in a Cisco AnyConnect deployment?

Trap 1: TACACS+

TACACS+ is for device administration, not VPN user authentication.

Trap 2: OSPF

OSPF is a routing protocol, not authentication.

Trap 3: SNMP

SNMP is for network management, not authentication.

Study all Security Concepts common traps →

A
TACACS+
Why wrong: TACACS+ is for device administration, not VPN user authentication.
B
OSPF
Why wrong: OSPF is a routing protocol, not authentication.
C
RADIUS
RADIUS is commonly used for VPN authentication.
D
LDAP
LDAP can be used for direct authentication against directory services.
E
SNMP
Why wrong: SNMP is for network management, not authentication.

Full breakdown with real-world context →

Question 11hardmulti select

Read the full Security Concepts explanation →

Which THREE of the following are common indicators of a DDoS attack at the network layer?

Trap 1: Unusual traffic on non-standard TCP/UDP ports

This is more indicative of application-layer attacks.

Trap 2: High CPU usage on network devices

While a symptom of DDoS, it is not a direct indicator of attack type.

Study all Security Concepts common traps →

A
A spike in UDP traffic to a single target
UDP flood is a common network-layer DDoS.
B
Unusual traffic on non-standard TCP/UDP ports
Why wrong: This is more indicative of application-layer attacks.
C
A high number of TCP SYN packets from multiple sources
SYN flood is a common network-layer DDoS.
D
High CPU usage on network devices
Why wrong: While a symptom of DDoS, it is not a direct indicator of attack type.
E
A sudden increase in ICMP echo request packets from many IPs
ICMP flood is a common network-layer DDoS.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Security Concepts explanation →

A financial company has a data center with Cisco FTD firewalls in a high-availability pair. They use Cisco ISE for network access control and Cisco Stealthwatch for network visibility. Recently, they deployed a new web application that is accessed by both internal employees and external customers. The application uses HTTPS on port 443. After deployment, the security team notices that the FTD is dropping some HTTPS sessions that appear legitimate. The drops are inconsistent and seem to occur only during peak hours. The FTD logs show the drop reason as 'TCP state violation'. The team has verified that the web server and clients are configured correctly. The Stealthwatch reports show no anomalies. What is the most likely cause and solution?

Trap 1: Enable SSL decryption to inspect the encrypted traffic

SSL decryption does not solve TCP state violations.

Trap 2: Increase the TCP timeout values on the FTD to accommodate longer…

Longer timeouts may help but the issue is state mismatch, not timeout.

Trap 3: Block all traffic to the web server except from trusted IPs

This is too restrictive and would block legitimate external customers.

Study all Security Concepts common traps →

A
Enable SSL decryption to inspect the encrypted traffic
Why wrong: SSL decryption does not solve TCP state violations.
B
Increase the TCP timeout values on the FTD to accommodate longer sessions
Why wrong: Longer timeouts may help but the issue is state mismatch, not timeout.
C
Block all traffic to the web server except from trusted IPs
Why wrong: This is too restrictive and would block legitimate external customers.
D
Configure TCP state bypass on the FTD for the web server traffic
Bypassing state tracking allows packets that may be asymmetric to pass without being dropped.

Full breakdown with real-world context →

Question 13easymultiple choice

Read the full Security Concepts explanation →

A security engineer is configuring a Cisco ASA to block traffic from a specific IP address. Which access control entry (ACE) should be applied to the inbound direction of the outside interface?

Trap 1: access-list outside_in extended deny ip any host 10.1.1.1

Blocks all IP traffic to the host, not from it.

Trap 2: access-list outside_in extended deny tcp any host 10.1.1.1

Blocks TCP traffic to the host, not from it.

Trap 3: access-list outside_in extended deny tcp host 10.1.1.1 any eq 80

Only blocks HTTP traffic from the host, not all traffic.

Study all Security Concepts common traps →

A
access-list outside_in extended deny ip any host 10.1.1.1
Why wrong: Blocks all IP traffic to the host, not from it.
B
access-list outside_in extended deny ip host 10.1.1.1 any
Correctly blocks all IP traffic from the specified host.
C
access-list outside_in extended deny tcp any host 10.1.1.1
Why wrong: Blocks TCP traffic to the host, not from it.
D
access-list outside_in extended deny tcp host 10.1.1.1 any eq 80
Why wrong: Only blocks HTTP traffic from the host, not all traffic.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full DNS explanation →

A company is deploying Cisco Umbrella to protect against DNS-based threats. Which deployment method provides the most comprehensive coverage for all devices on the network without requiring per-device configuration?

Trap 1: Install the Umbrella roaming client on every endpoint.

Requires per-device installation and may not cover all devices.

Trap 2: Configure each device's DNS settings to use Umbrella's resolvers.

Requires per-device configuration and may not be feasible for many devices.

Trap 3: Deploy a PAC file that routes all traffic through a proxy with DNS…

Only covers devices that use the proxy and may not cover all traffic.

Study all Security Concepts common traps →

A
Install the Umbrella roaming client on every endpoint.
Why wrong: Requires per-device installation and may not cover all devices.
B
Configure each device's DNS settings to use Umbrella's resolvers.
Why wrong: Requires per-device configuration and may not be feasible for many devices.
C
Deploy a PAC file that routes all traffic through a proxy with DNS filtering.
Why wrong: Only covers devices that use the proxy and may not cover all traffic.
D
Configure the network's DNS forwarders to point to Umbrella's DNS resolvers.
Covers all devices using the network's DNS.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full Security Concepts explanation →

An engineer is troubleshooting traffic drops on a Cisco Firepower Threat Defense (FTD) device. The traffic is allowed by the access control policy but is being dropped. Which feature should the engineer check to identify the cause of the drop?

Trap 1: Check the 'show access-list' output for the hit count.

Shows if the ACL matches, but not where drops occur.

Trap 2: Check the 'show route' output for routing issues.

Routing issues may cause drops, but not the only cause.

Trap 3: Check the 'show conn' output for the connection state.

Shows active connections, not drops.

Study all Security Concepts common traps →

A
Check the 'show access-list' output for the hit count.
Why wrong: Shows if the ACL matches, but not where drops occur.
B
Check the 'show route' output for routing issues.
Why wrong: Routing issues may cause drops, but not the only cause.
C
Use the 'capture' command with trace option to see packet flow and drop reason.
Captures packets and shows the disposition, including drops.
D
Check the 'show conn' output for the connection state.
Why wrong: Shows active connections, not drops.

Full breakdown with real-world context →

Question 16mediumdrag order

Read the full Security Concepts explanation →

Drag and drop the steps to configure 802.1X port-based authentication on a Cisco switch in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 17mediumdrag order

Review the full routing breakdown →

Drag and drop the steps to recover a lost password on a Cisco IOS router in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 18mediummatching

Read the full Security Concepts explanation →

Match each protocol to its default port number.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

443

161

Question 19mediummatching

Read the full Security Concepts explanation →

Match each Cisco security solution to its primary use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Next-generation firewall and IPS

DNS-layer security and web filtering

Endpoint threat detection and response

Network access control and policy enforcement

Network traffic analysis and anomaly detection

Question 20easymultiple choice

Open the full VLAN trunking answer →

A network engineer is configuring a new firewall to enforce security policies between two internal VLANs. The goal is to allow only HTTP traffic from the finance VLAN to the HR VLAN, while blocking all other traffic. Which type of firewall rule should be applied to achieve this requirement with minimal administrative overhead?

Trap 1: Implicit deny rule

Implicit deny is a default behavior, but the question asks for the type of rule to apply; explicit deny is the appropriate action to clearly block unwanted traffic.

Trap 2: Stateful rule

Stateful rules track connections but do not enforce a default-deny; they require explicit permit and deny rules.

Trap 3: Default-permit rule

Default-permit allows all traffic, which contradicts the requirement to block all except HTTP.

Study all Security Concepts common traps →

A
Explicit deny rule
An explicit deny at the end of the rule base ensures that only explicitly permitted traffic (HTTP) is allowed, following best practice.
B
Implicit deny rule
Why wrong: Implicit deny is a default behavior, but the question asks for the type of rule to apply; explicit deny is the appropriate action to clearly block unwanted traffic.
C
Stateful rule
Why wrong: Stateful rules track connections but do not enforce a default-deny; they require explicit permit and deny rules.
D
Default-permit rule
Why wrong: Default-permit allows all traffic, which contradicts the requirement to block all except HTTP.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Security Concepts sessions

Start a Security Concepts only practice session

Every question in these sessions is drawn from the Security Concepts domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Security Concepts questions →Mixed 350-701 session

Frequently asked questions

What does the 350-701 exam test about Security Concepts?: Security Concepts questions on this certification test your ability to deploy and manage security concepts concepts in scenario-based situations.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Security Concepts questions in a focused session?: Yes — the session launcher on this page draws every question from the Security Concepts domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 350-701 topics?: Use the topic links above to move to related areas, or go back to the 350-701 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 350-701 exam covers. They are not copied from any real exam or dump site.

Security Concepts only

10 questions 20 questions 30 questions 50 questions

Mixed 350-701 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 350-701 questions Security Concepts domain overview 350-701 exam guide

Exam traps to avoid

▸Selecting the most expensive service when a simpler managed option meets the requirement.
▸Forgetting that cloud resources must be explicitly secured — defaults are rarely secure.
▸Choosing a global service fix when the issue is region-specific.
▸Overlooking cost implications of cross-region data transfer in architecture questions.

Security Concepts practice questions

What to know about Security Concepts

Common Security Concepts exam traps

Security Concepts questions

An engineer is troubleshooting a Cisco ASA firewall and notices that traffic from a specific subnet is being dropped. The engineer wants to verify if the drop is due to an access control list (ACL) or an inspection policy. Which command should be used to see the reason for packet drops?

Which TWO of the following are valid approaches to mitigate ARP spoofing attacks on a switched network?

Which THREE of the following are key principles of the Cisco Zero Trust security model?

Refer to the exhibit. An engineer has configured IP Source Guard and DHCP Snooping. A host with MAC 00:11:22:33:44:55 on Gi0/0 is assigned IP 192.168.1.10 via DHCP. However, the host cannot ping its default gateway 192.168.1.1. What is the most likely cause?

Exhibit

Exhibit

A company is implementing Cisco Umbrella to provide DNS-layer security. They want to block access to known malicious domains while allowing all other traffic. Which policy configuration should be used?

An engineer is configuring Cisco ISE for guest access. The requirement is that guests must accept an acceptable use policy (AUP) before being granted network access. Which portal type should be used?

Which TWO of the following are valid methods for authenticating VPN users in a Cisco AnyConnect deployment?

Which THREE of the following are common indicators of a DDoS attack at the network layer?

A security engineer is configuring a Cisco ASA to block traffic from a specific IP address. Which access control entry (ACE) should be applied to the inbound direction of the outside interface?

A company is deploying Cisco Umbrella to protect against DNS-based threats. Which deployment method provides the most comprehensive coverage for all devices on the network without requiring per-device configuration?

An engineer is troubleshooting traffic drops on a Cisco Firepower Threat Defense (FTD) device. The traffic is allowed by the access control policy but is being dropped. Which feature should the engineer check to identify the cause of the drop?

Drag and drop the steps to configure 802.1X port-based authentication on a Cisco switch in the correct order.

Drag and drop the steps to recover a lost password on a Cisco IOS router in the correct order.

Match each protocol to its default port number.

Match each Cisco security solution to its primary use case.

Track your progress over time

Start a Security Concepts only practice session

Related 350-701 topic practice pages

Endpoint Protection and Detection practice questions

Secure Network Access, Visibility and Enforcement practice questions