350-701 practice questions
Cisco · 350-701 · 300 questions
Original practice questions for the Cisco 350-701 SCOR v2.0 exam (the CCNP and CCIE Security core exam), covering security concepts, network security, cloud security, Secure Service Edge, endpoint protection and detection, and network access, visibility, and enforcement, written to the official v2.0 exam topics.
This course contains the use of artificial intelligence.
About the 350-701 exam
- Time allowed
- 2 hours
- Questions
- not published
- Passing score
- not published
- Format
- Multiple choice, drag-and-drop, and performance-based
Schedule this exam The certification this earns
Exam details published by the vendor, checked 7 October 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Security Concepts · 60 questions
- After several employees installed a free PDF utility that looked legitimate and worked as advertised, the help desk finds that every installed copy opened a remote shell to an outside host. The program never spread to other machines on its own. Which type of malware best describes this behavior?
- A public web portal becomes unreachable. Logs show completed TCP handshakes and full HTTP requests arriving at the same moment from thousands of residential IP addresses in many countries, and adding the busiest addresses to a deny list has no visible effect. Which attack is occurring, and why does the deny list fail?
- On a Linux server, ps, netstat, and ls report nothing unusual, yet an offline scan from trusted boot media reveals a running backdoor binary and an outbound connection that the live system tools never displayed. Which threat is the most likely explanation?
- On public coffee-shop Wi-Fi, a user sees a browser warning that the bank's certificate was issued by an unknown authority, clicks through, and later finds the account drained. The attacker was on the same wireless network and relayed the session to the real bank. Which attack occurred, and which control would have stopped it had the user heeded it?
- A cloud tenant's storage buckets were copied out over a weekend. The attacker used a valid access key that a developer had committed to a public code repository, and the on-premises firewall, IPS, and VPN logged nothing unusual. What does this incident illustrate?
- Security leadership asks why the team is starting post-quantum cryptography planning now for VPN and TLS traffic whose contents must stay confidential for 15 years, even though no cryptographically relevant quantum computer exists today. Which explanation is correct?
- A vulnerability scan reports CVE-A with a CVSS base score of 9.8 on an internet-facing web server and CVE-B with a base score of 6.5 on an isolated lab host with no external connectivity. The team can remediate only one finding this week. Which approach is correct?
- Typing a single quote into a web application's login field produces a database syntax error that names the table being queried. Which vulnerability does this indicate, and what is the root-cause fix?
- A download request whose file parameter climbs two parent directories and names the system password file returns the contents of the server's account file instead of a product brochure. Which vulnerability is present, and which control addresses it?
- Researchers find that a vendor's firmware image contains the same built-in administrative password on every unit shipped, and the account cannot be disabled from the management interface. A customer proposes enforcing a strong local password policy at each site. Why is that insufficient?
- While logged in to a banking site in one tab, a user clicks a forum link that silently submits a funds-transfer form to the bank. The bank processes it because the browser automatically attached the user's session cookie, and no script ever ran on the bank's own pages. Which attack is this?
- A network service written in C crashes when it receives an input string longer than expected, and researchers then craft a payload that overwrites the saved return address and runs their own code. Which vulnerability is this, and which class of mitigation addresses it?
- A support chatbot summarizes incoming customer emails for agents. One email contains white-on-white text instructing the model to ignore its rules and list internal discount codes, and the resulting summary includes those codes. The sender never interacted with the chatbot directly. Which vulnerability was exploited?
- Users discover they can coax an internal assistant into printing its full hidden instruction block, which includes an internal API endpoint and a service token. Which remediation addresses the root cause of this system prompt leakage?
- A retrieval-augmented generation (RAG) assistant answers an engineer's question using salary documents from HR. All departments' documents were embedded into a single shared vector store, and retrieval returns the nearest matches without checking who is asking. Which weakness does this describe, and what fixes it?
- A data science team downloaded a pretrained model and a fine-tuning dataset from a public hub. Months later, the publisher's account is found to have been compromised, and the model contains a hidden backdoor behavior. Which risk category is this, and which control most directly reduces it?
- An attacker with edit rights to an internal wiki plants pages containing false remediation steps. A RAG assistant indexes the wiki nightly and begins recommending the false steps, although its underlying language model was never retrained or modified. What best describes this attack?
- An AI agent reads external web pages and can call internal tools that create tickets, query a CRM, and send email. The architect accepts that prompt filtering cannot catch every injection. Which control most effectively limits the damage a successful injection can cause?
- A finance clerk receives an urgent email that appears to come from the CEO, requesting a wire transfer to a new supplier account before end of day and asking that no one else be told. The message passed SPF because it came from a look-alike domain the attacker registered. Which control most directly stops this attack?
- An organization wants receiving mail servers on the internet to reject messages that claim to come from its exact domain but were neither sent through its authorized servers nor signed with its keys. Which control should it publish?
- A phishing campaign tricks several employees into entering their passwords on a fake portal, yet the attackers fail to sign in to the real applications with those passwords. Which control most likely produced this outcome, and which form of it best resists an attacker who relays the login in real time?
- A CISO wants to measure how often employees click phishing links and demonstrate a downward trend each quarter. Which control fits this requirement?
- An employee receives a phone call from someone claiming to be the IT help desk, who says the user's account is being migrated and asks them to read out the six-digit code that just arrived on their phone. Which attack is this, and which policy best counters it?
- A user clicks a link in a phishing email that slipped past the email filters. The link points to a credential-harvesting site that threat intelligence already lists as malicious. Which network-layer control can still stop the connection after the click?
- An administrator downloads a firewall software image and must confirm it was not altered in transit. The vendor publishes a SHA-512 value for the file on its support site. What should the administrator do?
- Two data centers must exchange large volumes of data quickly over the internet, and the encryption keys must be agreed without ever being sent in the clear. Which design meets both requirements?
- A site-to-site IPsec tunnel works until one peer is moved behind a router that performs port address translation. After the move, IKE negotiation completes but ESP packets are dropped at the PAT router and no protected traffic passes. Which mechanism resolves this, and why?
- Users' browsers reject a web server's TLS certificate even though it is within its validity period and its subject alternative name matches the hostname. Packet capture shows the server sends only its own leaf certificate, which was issued by an intermediate CA. What is the most likely cause?
- A remote-access design team wants the client's transport to run over QUIC and wants tunneled user traffic carried through an HTTP/3 proxy. Which description of these technologies is correct?
- A VPN design will connect 200 branch firewalls to two hubs. If one branch device is stolen, the team must cut it off quickly without changing configuration on the hubs or on the other 199 branches. Which peer authentication method fits, and why?
- A retailer runs a hub-and-spoke WAN of 300 stores over the internet. Store-to-store video traffic currently hairpins through the hub, and the team wants spokes to build direct encrypted tunnels to each other only when needed, without preconfiguring every pair. Which VPN technology fits?
- A company's private MPLS WAN must encrypt any-to-any traffic among 80 sites. The carrier requires that original IP headers remain visible so its QoS and routing keep working, and the team wants no point-to-point tunnels. Which technology fits?
- An engineer wants OSPF to run across an IPsec site-to-site connection between two sites and wants traffic selected for encryption by routing rather than by an access list that names the protected networks. Which approach provides this?
- An organization standardizing on IKEv2 wants one Cisco configuration framework it can use for site-to-site, hub-and-spoke, spoke-to-spoke, and remote access VPNs instead of maintaining separate technologies. Which framework fits?
- Contractors must reach internal applications from hotel and customer networks that block all outbound traffic except HTTPS on TCP port 443, and IPsec clients fail to connect from those networks. Which remote access approach fits this constraint?
- A company must build a site-to-site VPN between its Cisco Secure Firewall and a partner's firewall from a different vendor. Which choice gives the best chance of interoperability?
- Two organizations want to share threat indicators in a structured, machine-readable language and exchange them automatically between their platforms over HTTPS. Which pairing describes the roles correctly?
- An analyst receives a third-party feed of 5,000 IP addresses labeled as command-and-control infrastructure, with no confidence ratings and no dates. Before loading the addresses into firewall blocklists, what is the most important consideration?
- A SOC keeps blocking malware hashes and command-and-control IP addresses from one threat group, but the group replaces them within days. The SOC lead wants detections that stay effective when those artifacts change. What should the team focus on?
- After an incident, a team documents indicators and observed attacker behavior and wants to share them with peer companies in its industry while controlling how far recipients may redistribute the information. Which approach fits?
- A Cisco Secure Firewall blocks a connection to a domain that the security team never added to any list. The connection event shows the destination was blocked by Security Intelligence as a known malicious domain. Where did that verdict most likely come from?
- A peer company shares an indicator report labeled TLP:AMBER under Traffic Light Protocol version 2.0. An analyst wants to forward it. Under the label's rules, with whom may the report be shared?
- A company is replacing a model in which anything on the internal network was trusted with one where every access request is evaluated on its own merits. Which statement captures the core principle of the new model?
- Following NIST SP 800-207, an architect places components in front of a finance application so that each session request is decided by policy and then allowed or blocked at the connection itself. Which division of roles is correct?
- A user with valid credentials who has just approved an MFA prompt tries to reach a sensitive application from a personal laptop with an outdated operating system and no endpoint protection. Under zero trust, what should happen?
- A user authenticates successfully in the morning. An hour later, the same session begins downloading large volumes of customer records from an unusual country. How does a zero trust architecture handle this?
- An incident review finds that malware on one compromised web server reached database and backup servers in the same data center VLAN without crossing any firewall. How does microsegmentation support zero trust in this situation?
- A vendor tells leadership that buying its single appliance will deliver zero trust for the company. The CISO disagrees. Which statement best supports the CISO's view?
- A board member asks why the company funds endpoint protection, email security, DNS-layer filtering, MFA, and segmentation instead of relying on one top-tier perimeter firewall. Which answer reflects the principle of defense in depth?
- An architect uses Cisco SAFE to organize a security design around the locations where the business operates, such as branch, campus, data center, edge, cloud, and WAN. Which SAFE construct is the architect using?
- A security architect is using Cisco SAFE to plan controls for a campus, a branch and a data center. The team has already identified the business flows in each area and the threats against them. What does SAFE use next to organize the security capabilities each of those places needs?
- A malicious attachment passes the email security layer because its file hash was unknown when the message was delivered. A user opens it on a Windows laptop. Which additional defense-in-depth layer is most likely to stop the file from executing on that host?
- A company places every security control at the data-center internet edge: a next-generation firewall, IPS and web filtering. Half the staff now work remotely and reach SaaS applications directly from home without a VPN. What is the main defense-in-depth gap in this design?
- A security team must present a new branch design to executives and explain why each control was chosen, tracing from the branch's business flows and threats to the selected capabilities. Which Cisco SAFE resources best support that explanation?
- A script runs r = requests.post(fmc + '/api/fmcplatform/v1/auth/generatetoken', auth=(user, pw)), then tok = r.headers['X-auth-access-token'] and h = {'X-auth-access-token': tok}. Every later call is requests.get(url, headers=h). How does the script use the credentials and the token?
- A script queries a firewall manager with requests.get(url, headers=h, verify=False). The call succeeds even though the manager presents a self-signed certificate. What is the security consequence of this setting?
- A script runs data = r.json() and then for obj in data['items']: print(obj['name']). The response body is {"items": [{"name": "WebSrv", "value": "10.1.1.10"}, {"name": "DNS1", "value": "10.1.1.53"}], "paging": {"count": 2}}. What does the script print?
- A nightly script obtains an API token from a firewall manager at the start of the job, and its first calls succeed. Hours later in the same run, a GET using the same header returns HTTP 401 Unauthorized. What is the most likely cause?
- A script calls requests.get(objectsurl, headers=h, params={'name': 'web'}) and then requests.post(objectsurl, headers=h, json={'name': 'Web2', 'type': 'Host', 'value': '10.1.1.20'}). What do the two calls do?
- A teammate's script defines APIKEY = 'a1b2c3d4e5' near the top, and the file has already been committed and pushed to the team's Git repository. The script works. What is the correct fix?
Network Security · 75 questions
- An engineer must deploy intrusion prevention so that malicious packets are dropped before they reach a server farm. The current sensor receives a copy of traffic from a switch SPAN session. What change achieves the requirement?
- A Cisco Secure Firewall (FTD) must be inserted between a server subnet and its default gateway router. The servers' IP addresses, subnet and default gateway cannot change. Which firewall mode meets the requirement?
- A data center wants one physical Cisco Secure Firewall chassis to serve three business units. Each unit needs its own independently managed FTD policy and dedicated hardware resources, so that rebooting or upgrading one unit's firewall does not affect the others. Which capability fits?
- An organization's current firewall permits outbound TCP 443 for everyone. It cannot tell a sanctioned SaaS application from a file-sharing site that uses the same port, or which employee generated the traffic. What should replace it?
- Cisco Secure Firewall interfaces are already cabled inline for an intrusion prevention pilot. Management wants intrusion events generated from real traffic, no packets dropped during the pilot, and the option to switch to blocking later without recabling. Which interface mode fits?
- Two Cisco Secure Firewall devices protect a data-center edge. The requirement is that established connections continue if the active device fails. A single device has enough throughput for the load. Which deployment meets the requirement?
- A branch router's stateless inbound ACL on its internet link drops the replies to users' outbound HTTPS sessions. The engineer replaces it with a stateful firewall whose only rule permits outbound HTTPS from inside users. Why do the replies now reach the users?
- A data center's only Cisco Secure Firewall sits at the internet edge. Web, application and database servers in separate VLANs route to each other on the core switch, and a compromised web server connected straight to the database. Which design change addresses this?
- The SOC wants to know which internal hosts talked to which destinations, for how long and with how many bytes, across the whole campus, retained for 90 days. Storage for full packet capture is not available. Which telemetry source fits?
- Flow records show a workstation sent 4 GB to an unknown external host over unencrypted FTP overnight. Legal asks for evidence of exactly which files and content left the network. Which data source can provide that?
- Firewalls send syslog across a WAN to a central collector over UDP. Auditors note that messages can be lost without any indication and can be read or altered in transit. Which change addresses both concerns?
- Two finance workstations that have never communicated before suddenly exchange SMB traffic at 3 a.m. No intrusion signature matched the traffic. Which detection approach is designed to flag this activity?
- A sensor must receive every frame on a busy 10-Gbps uplink, including frames with errors, with no risk of copies being dropped when the switch is under heavy load. Which method should feed the sensor?
- Most outbound traffic is TLS 1.3, and company policy forbids decrypting it. The SOC still wants to detect malware command-and-control sessions on the network. What can detection rely on?
- Operations wants interface counters and state changes from IOS XE switches pushed to a collector every few seconds, instead of a management server polling each device on a timer. Which technology fits?
- Each access port must accept only the first device MAC address it learns, and the port must be disabled for investigation if a different MAC address appears. Which port security configuration meets this requirement?
- A rogue DHCP server connected to an access port is handing clients a wrong default gateway. The legitimate DHCP server is reached through the access switch's uplink to the distribution layer. Which configuration stops the rogue server?
- A host on a user VLAN sends gratuitous ARP replies that claim the default gateway's IP address with the host's own MAC address. DHCP snooping is already enabled on that VLAN. Which feature stops this attack, and how?
- An attacker on an access port in VLAN 1 sends frames carrying two 802.1Q tags, the outer tag matching the trunk's native VLAN 1 and the inner tag VLAN 20, to reach a server in VLAN 20. Which mitigation directly defeats this technique?
- A user plugs a consumer switch into a PortFast access port, and it starts sending superior BPDUs in an attempt to become the spanning-tree root. Policy says any edge port that receives a BPDU must be disabled. Which feature enforces that policy?
- A faulty device floods broadcast frames into an access VLAN, saturating links and switch CPUs. The team wants each access port to limit broadcast traffic to a set share of bandwidth and take an action when the threshold is exceeded. Which feature fits?
- Users' access rights must follow their role, such as contractor or finance, wherever they connect on campus, without redesigning VLANs or maintaining IP-based ACLs for every subnet. Which segmentation approach fits?
- A switch suddenly floods unicast frames out of every port in a VLAN after one access port sends thousands of frames with random source MAC addresses. Which attack is this, and which control mitigates it?
- A small site has one Cisco Secure Firewall (FTD) and no central management appliance or cloud management subscription. The administrator wants to configure it through a web interface running on the device itself. Which manager fits?
- An enterprise runs 60 Cisco Secure Firewall (FTD) devices at its sites. Today each one is configured individually, policies have drifted apart, and analysts must log in to each device to review events. Which management approach addresses this?
- A company wants to manage its Cisco Secure Firewall devices from a SaaS portal, with no on-premises management appliance to install, patch or back up. Which option meets that requirement?
- During a routing outage on the production network, administrators lost access to every firewall and switch they needed to fix it, because management traffic shares the data interfaces. Which design keeps management reachable when the data network is down?
- Auditors require firewall and switch management sessions to be isolated from user traffic, and the team proposes a dedicated out-of-band management network. Which statement describes the main benefit and the main cost of this design?
- A defense contractor's management network has no internet access by policy, and all firewall configuration and event data must stay on site. The team must centrally manage 25 Cisco Secure Firewall (FTD) devices. Which management option fits?
- A team wants to define firewall objects and access rules in a version-controlled repository and have a CI pipeline push them automatically to 50 Cisco Secure Firewall (FTD) devices that share a central manager. Where should the pipeline make its API calls?
- An auditor asks how the network team proves its IOS XE routers and switches are hardened consistently against an industry-recognized standard rather than individual engineers' preferences. What should the team use?
- A hardening review of branch routers finds the HTTP server, Telnet and several unused services enabled. The team is applying benchmark-style guidance to the routers. What is the recommended action for these findings?
- A team reading a CIS benchmark asks how Level 1 and Level 2 profile recommendations differ. Which description is correct?
- A team is applying benchmark-style hardening to the management plane of its Cisco Secure Firewall (FTD) devices. Which set of settings falls within that scope?
- An organization passed a CIS benchmark audit last year, but emergency changes have since introduced configuration drift. Leadership wants benchmark compliance verified continuously rather than once a year. Which approach fits?
- A CIS benchmark item recommends disabling a protocol that a legacy monitoring system still requires on several switches. The system cannot be replaced this year. What is the appropriate way to handle this item?
- A hardening review of IOS XE devices finds that SSH version 1 is still accepted and weak algorithms are enabled for management sessions. Which change aligns with benchmark guidance?
- After a policy change on Cisco ISE, network administrators still log in to switches over TACACS+ successfully, but every configuration command they enter is rejected with an authorization failure. What should the engineer check first?
- A company needs centralized administrator logins to routers and switches, with authorization and accounting for each individual command an administrator enters, and the entire packet body encrypted. Which protocol fits?
- An engineer is configuring access switches and Cisco ISE to authenticate employee laptops with 802.1X before granting them network access. Which AAA protocol carries the EAP exchange between the switch and ISE?
- A newly installed access switch is configured to send 802.1X requests to Cisco ISE. Ping from the switch to ISE succeeds, but endpoints time out and the RADIUS server never answers the switch, not even with an Access-Reject. What is the most likely cause?
- An IOS XE router uses 'aaa authentication login default group tacacs+' for administrator logins. During a WAN outage both TACACS+ servers become unreachable and nobody can log in to fix the router. Which change prevents this lockout without weakening normal TACACS+ use?
- Network administrators log in to IOS XE switches through Cisco ISE using TACACS+. Authentication succeeds and the ISE shell profile returns privilege level 15, yet every administrator lands at the user EXEC prompt. Which missing configuration on the switches explains this?
- Switches in a branch authenticate 802.1X users against Cisco ISE in the data center, and a new firewall was just placed between the two. Authentication and accounting both stopped working. Which firewall rule restores the standard RADIUS exchange?
- Users fail 802.1X on a wired port. The Cisco ISE live log shows the user's credentials were verified successfully against Active Directory, then the request was rejected because no authorization rule matched the user's group membership and the default rule denied access. What should the engineer do?
- A security policy requires that SNMP polling of perimeter devices authenticate each message and encrypt its payload, and that SNMPv2c community strings be retired. Which configuration meets the requirement?
- During an incident review, log timestamps from routers, switches and firewalls disagree by several minutes, and the team suspects a rogue time source could shift clocks to hide activity. What should be configured so devices accept time only from approved servers?
- An automation team must push configuration to IOS XE devices using YANG models. They want a protocol that runs over SSH, exchanges XML-encoded RPCs, and supports candidate datastores and network-wide transactions. Which protocol fits?
- Firewall syslog messages contain usernames and internal addresses, and they cross an untrusted transit network to reach a SIEM. Currently they are sent in clear text over UDP 514. Which change protects these messages in transit?
- An audit finds that administrators still manage switches with Telnet and the HTTP web interface, exposing credentials on the network. Which change remediates the finding?
- Only hosts in the 10.10.50.0/24 administrator subnet should be able to open SSH sessions to an IOS XE router, but today any internal host can reach the login prompt. Which configuration enforces this?
- A script uses the Cisco Secure Firewall Management Center REST API only to read device health and export inventory. Today it authenticates with the shared admin account. Which change best applies least privilege to this automation?
- On a Cisco Secure Firewall (FTD), a social-media application must be blocked for all users except members of the Marketing AD group. Identity sources are already mapping users to IP addresses. How should the access control rules be built?
- An FTD access control policy has rule 3 allowing any internal network to any destination over HTTPS, and rule 9 blocking HTTPS from the Guest network to a known malicious subnet. Guests still reach that subnet. What is the fix?
- A company wants its Cisco Secure Firewall (FTD) to block gambling websites and any site with a poor reputation, without maintaining lists of individual domains. Which access control configuration fits?
- Traffic from partner networks to a public web server must be permitted on Cisco Secure Firewall (FTD), but the security team still wants the sessions inspected for exploit attempts. Which rule configuration achieves this?
- Users download files over HTTP through a Cisco Secure Firewall (FTD), and the security team wants known malicious files stopped in transit using cloud disposition lookups. How is this configured?
- Nightly backups between two data center subnets saturate inspection resources on a Cisco Secure Firewall (FTD), even though the backup flow is fully trusted and must still be logged as allowed. Which approach reduces inspection load for this flow?
- On a Cisco Secure Firewall (FTD), URL rules must block one specific path on an otherwise allowed HTTPS site, but connection events show only the server name, never the full URL path. What is required to enforce the rule?
- A user reports a blocked connection through a Cisco Secure Firewall (FTD), but no connection event exists for it. The engineer suspects a block rule but must prove which rule handled the session. What should be done first?
- A branch Cisco Secure Firewall (FTD) and an HQ FTD, both managed by the same management center, need a site-to-site IPsec tunnel between 10.20.0.0/16 and 10.1.0.0/16. Which set of elements defines this VPN topology?
- Remote employees must connect with Cisco Secure Client to a Cisco Secure Firewall (FTD) and send all traffic through the tunnel. Which set of components does the remote access VPN policy need?
- Remote users on Cisco Secure Client should send only traffic destined for corporate networks 10.0.0.0/8 and 172.16.0.0/12 through the FTD tunnel, while internet traffic goes directly out their local connection. Where is this configured?
- Remote access VPN users on Cisco Secure Firewall (FTD) must authenticate with their Active Directory password and approve a Duo push before the tunnel is established. Which configuration achieves this?
- Remote access VPN clients connect to a Cisco Secure Firewall (FTD) and inside servers see the traffic, but replies never reach the clients. A packet trace shows the servers' replies to the VPN pool being translated to the outside interface address. What is the fix?
- Employees without Cisco Secure Client installed must be able to browse to the Cisco Secure Firewall (FTD) remote access VPN address, log in, and receive the client automatically on their first connection. What must the administrator provide?
- A newly acquired company uses 192.168.10.0/24 internally, which is also used at headquarters. A site-to-site VPN between the two Cisco Secure Firewall (FTD) devices must let hosts at each site reach the other. Which design makes this possible?
- A new site-to-site tunnel between two Cisco Secure Firewall (FTD) devices never completes IKEv2 Phase 1. The logs show each peer rejecting the other's IKESAINIT proposal because no acceptable proposal was found. What is the most likely cause?
- Between two Cisco Secure Firewall (FTD) peers, the IKEv2 security association is established and authenticated, but no IPsec (child) security association ever forms. Which cause best fits this symptom?
- A site-to-site tunnel on a Cisco Secure Firewall (FTD) shows IKE and IPsec SAs up, yet remote hosts cannot reach local servers. A packet trace of traffic arriving from the tunnel shows it dropped by the access control policy default action. What should be changed?
- A site-to-site tunnel between HQ and branch Cisco Secure Firewall (FTD) devices comes up whenever HQ hosts send traffic first. When only branch hosts start traffic, the IKE SA forms but the IPsec SA is refused. What most likely explains this?
- Site-to-site VPNs on a Cisco Secure Firewall (FTD) work normally, but remote access users report that Cisco Secure Client accepts the server certificate, shows the login prompt, and then returns login failed. Where should troubleshooting focus first?
- A branch Cisco Secure Firewall (FTD) sits behind an ISP router performing NAT. The tunnel to HQ starts IKEv2 successfully, then fails once the peers detect NAT. The ISP filter permits only UDP 500 between the peers. Which change resolves this?
- On a Cisco Secure Firewall (FTD), 'show crypto ipsec sa' for a site-to-site tunnel shows the encaps counter increasing steadily while the decaps counter stays at zero. Users at both sites report no connectivity. What does this indicate?
- A certificate-authenticated site-to-site tunnel between two Cisco Secure Firewall (FTD) devices stopped establishing right after the remote peer's identity certificate was reissued by a newly deployed enterprise CA. Nothing else changed. What should be done on the local FTD?
Cloud Security · 45 questions
- A company moves its customer relationship management system from on-premises servers to a SaaS provider. An auditor asks who is responsible for patching the CRM application and its underlying platform. What is the correct answer?
- An attacker compromises a virtual machine in an IaaS environment through a vulnerability in the guest operating system that had a patch available for months. Under a typical shared responsibility model, who failed in their duty?
- A team uses a managed PaaS database service. The provider runs the database engine and its hosts, but a developer added a network rule allowing access from any internet address, and the data was scraped. Who is responsible for the exposure?
- An auditor building a cloud risk register asks who is responsible for physical security of the data centers, such as badge access, guards and environmental controls, for workloads in IaaS, PaaS and SaaS. What is the correct answer?
- An employee with valid access to a SaaS collaboration platform deletes a large set of shared project files before leaving the company. The files are past the provider's retention window. Who was responsible for preventing this loss?
- A security team is building one responsibility matrix covering workloads in IaaS, PaaS and SaaS. Which statement should guide how the customer's share is shown across the three models?
- An organization wants a framework of cloud-specific security controls, mapped to other standards, to assess prospective cloud providers and its own cloud deployments. Which resource fits this purpose?
- An enterprise runs dozens of cloud accounts, and teams change settings by hand. Storage buckets become public and logging gets disabled without anyone noticing. Which capability continuously detects these misconfigurations against a security baseline?
- A company runs workloads in AWS, Azure and Google Cloud. Each team writes network security rules separately in each provider's native console, and the policies have drifted apart. The company wants one centrally managed policy enforced across all three. Which solution fits?
- Cloud workloads in several virtual networks currently reach the internet directly. The security team needs inline inspection of this outbound traffic, including threat prevention and URL filtering, before it leaves the cloud. Which deployment model fits?
- A security team wants to guarantee that no Terraform template can create a publicly readable storage bucket. Violations must be stopped before anything is deployed, not reported afterward. Which control meets this requirement?
- A security team must assess vulnerabilities and misconfigurations on thousands of virtual machines across 40 cloud accounts within days. Other teams own the workloads, and the security team is not permitted to install software on them. Which approach fits?
- A regulator requires that encryption keys protecting customer records in cloud object storage stay under the company's control, including the ability to disable a key and render the data unreadable. Which capability should be selected?
- Several regional hospitals want to share cloud infrastructure that is provisioned for their exclusive use, because they all have the same regulatory and privacy requirements. One of the hospitals will operate it on behalf of the group. Which NIST SP 800-145 deployment model is this?
- A development team wants to deploy its web application code to the cloud using the provider's languages, runtimes and tools, without managing servers, operating systems or storage, while still controlling the application and its configuration. Which NIST SP 800-145 service model is this?
- A healthcare company keeps its patient-record databases in its own data center under tight control, but bursts its customer web front end into a public cloud provider during seasonal peaks. The two environments stay separate yet are linked so data and workloads can move between them. Which NIST SP 800-145 deployment model describes this arrangement?
- Firewall logs show employees uploading files to several personal cloud storage services the company never approved. Leadership wants the security team to discover which SaaS applications are in use, rate each one's risk, and then block or restrict the risky ones. Which type of security solution is designed for this requirement?
- Files already stored in the company's sanctioned Microsoft 365 tenant must be scanned for sensitive data and have public sharing links revoked, including files employees uploaded from personal, unmanaged phones that never route through a corporate proxy. Which CASB deployment mode meets this requirement?
- A company rents virtual machines, block storage and virtual networks from a provider. Its own team installs and patches the guest operating systems, deploys its middleware and applications, and configures host firewalls, while the provider runs the physical hosts and the hypervisor. Which NIST SP 800-145 service model is this?
- A defense contractor builds a cloud with on-demand self-service provisioning, resource pooling and measured usage. The infrastructure is provisioned for the exclusive use of that one organization and its business units, whether it sits in the contractor's own facility or in a third-party hosted facility. Which deployment model is this?
- A team runs applications in AWS VPCs and Azure VNets and must apply ingress, egress and east-west inspection with one policy set managed centrally, without hand-building and scaling separate firewall stacks in each cloud. How does Cisco Multicloud Defense deliver this?
- Before writing segmentation policy for a three-tier application, the security team needs an accurate map of which workloads talk to which and on what ports, so it can build an allowlist that permits only the observed, required flows. Which Cisco Secure Workload capability provides this?
- An enterprise's applications run on VMware VMs in its data center, on bare-metal Linux servers, and on instances in two public clouds. The security team wants one microsegmentation policy model enforced consistently at each workload regardless of where it runs. Which approach does Cisco Secure Workload use?
- Developers create new VPCs, VNets and instances across several clouds faster than the security team can record them, so the team often learns about exposed assets only after an incident. Which Cisco Multicloud Defense capability addresses this gap first?
- A cloud storage bucket holds customer records. An audit warns that a future misconfiguration could make the bucket reachable, and the company wants the records to stay unreadable and governed even if that happens. Which combination of controls addresses data security most directly?
- A customer-facing web application in a public cloud is being probed with SQL injection and cross-site scripting payloads inside otherwise normal HTTPS requests to port 443. The security group must keep allowing TCP 443 from anywhere. Which control addresses these attacks?
- A cloud security service can push its events as JSON over HTTPS to a URL, but nothing can be installed in the vendor's environment and the Splunk team does not want to add a forwarder. How should the Splunk administrator accept these events directly?
- The SOC wants AWS CloudTrail events from several accounts searchable in Splunk beside its other security data, using a supported Splunk-built integration rather than custom code. What is the appropriate approach?
- Cisco Secure Firewall events are arriving in Splunk, but they land as raw text under a generic sourcetype, so analysts cannot filter on fields such as source address or rule action and the data does not populate Common Information Model data models. What is the most likely fix?
- Several on-premises Linux servers write application and audit logs to local files. The Splunk team wants those files collected continuously, with the collector tracking how far it has read and holding data when the indexers are briefly unreachable, so no lines are lost. What should be deployed?
- A SOC wants data from several Cisco security products, such as Secure Firewall, Secure Endpoint and Duo, brought into Splunk through one Cisco-supported integration that also provides ready-made dashboards for those products. Which approach fits best?
- Splunk will ingest firewall logs that must be kept for one year and be searchable by the whole SOC, and HR system audit logs that must be kept for seven years and be searchable only by two investigators. What is the correct design?
- A platform team wants deep visibility into process execution, system calls and network connections on its Linux workload hosts, but the operations group refuses to load third-party kernel modules because a faulty module can crash the kernel. Which technology fits this requirement?
- A payment application's web tier needs only HTTPS from the load balancer and must reach the app tier on one TCP port, and the app tier reaches the database on one port. The security team wants a workload policy that limits lateral movement if any tier is compromised. Which policy model should it apply?
- An audit finds that container images in the company's registry include operating system packages and libraries with published CVEs, and some of those images are already running in production. Which control addresses the source of this problem?
- Images passed vulnerability scanning, yet an attacker exploited an unknown flaw in a running container, spawned an interactive shell and began downloading tools. Which control is designed to catch this activity as it happens?
- A team compares two workload agents for Linux hosts. One relies on long iptables rule chains and periodic log parsing for visibility; the other attaches eBPF programs to kernel hooks. Why is the eBPF-based design generally preferred for visibility and enforcement at scale?
- In a Kubernetes cluster with autoscaling, workload IP addresses change every time pods are rescheduled, and IP-based security rules keep breaking or matching the wrong workloads. How should the workload security policy be written instead?
- A team's Terraform modules have repeatedly created cloud storage buckets with public read access, and each time the problem is found only after deployment by a posture tool. The team wants these misconfigurations caught before any resource exists. What should it add?
- Security testing for a product happens only in a two-week window before each release, and late findings repeatedly delay launches. Leadership wants most code vulnerabilities found within hours of the code being written. What DevSecOps change addresses this?
- A CI pipeline printed a cloud access key into its build logs, where anyone with read access to the CI project could see it. The same key was stored as plaintext in the repository's pipeline configuration file. What is the right DevSecOps fix?
- A review finds that many Kubernetes pods run as privileged containers with root users and host access, and developers can deploy any pod specification they like. The platform team wants such pods rejected before they are ever scheduled. Which control fits?
- A critical vulnerability is announced in a widely used open-source logging library. The security team must determine quickly which of the company's hundreds of applications include that library, including as a transitive dependency. Which practice makes this answerable in minutes?
- A team already runs static analysis on its source code. It now wants to test the deployed staging build of its web application from the outside, sending crafted requests to find exploitable flaws such as injection and broken authentication in the running system. Which testing type is this?
- Scanners already run in the team's CI pipeline, but their findings are only written to a report that nobody reads, and builds with critical vulnerabilities keep reaching production. The team wants the pipeline itself to stop such builds. What should it implement?
Secure Service Edge · 30 questions
- An organization wants a cloud-delivered secure web gateway, CASB, zero trust network access and firewall as a service for its users, but it has just renewed its WAN contracts and will not change its branch networking. Which architecture term best describes what it is adopting?
- A retailer wants to converge its branch SD-WAN and its cloud-delivered security services (secure web gateway, CASB, ZTNA and firewall as a service) into one architecture with consistent policy for both branches and remote users. Which term describes this target?
- Remote and branch users' internet traffic is backhauled over VPN and MPLS to headquarters for inspection, which adds latency to every SaaS session and congests the data center's internet link. Which property of SSE addresses this problem?
- A security architect compares zero trust network access with the company's full-tunnel remote access VPN for reaching private applications. What is the key access-model difference between them?
- Branch offices send traffic to the cloud security service over IPsec tunnels. Web traffic is inspected, but a custom inventory application uses a non-HTTP protocol on uncommon TCP and UDP ports, and that traffic must also be controlled by port, protocol and application. Which SSE capability covers it?
- After the company adopts SSE for user access to the internet, SaaS and private applications, an executive asks whether the data center firewall that protects public-facing servers from inbound internet traffic can now be removed. What is the correct answer?
- A branch office has many devices, including printers and IoT sensors, on which no endpoint client can be installed, yet all of the site's internet traffic must be inspected by Cisco Secure Access. What is the appropriate way to connect the site?
- Laptops that are protected while on the corporate network lose DNS and web protection when employees work from hotels and home networks. The company wants Secure Access policy to follow these managed laptops wherever they connect. What should it deploy?
- The internet access policy must block destinations associated with malware, phishing and command-and-control while permitting business-category sites, and it must keep working as new malicious domains appear every day. How should the rules be built?
- After the team enables HTTPS decryption in Secure Access to gain full URL and file inspection, users on managed laptops suddenly see browser certificate warnings on every HTTPS site. What step was missed?
- Company privacy policy forbids inspecting the content of employees' sessions to banking and healthcare websites, but all other HTTPS traffic must remain decrypted for malware and DLP inspection. What is the appropriate configuration?
- An internet access rule that allows a partner's file-sharing site never matches. Logs show the partner traffic is blocked by a broader rule above it that blocks the entire file-sharing category. The allow rule's identities and destinations are correct. What is the fix?
- An external contractor on a personal, unmanaged laptop needs access to one internal web application for a month. No software may be installed on the laptop, and the contractor must not receive network-level access. Which Secure Private Access method fits?
- Managed employee laptops need access to private applications, including several non-web TCP applications, and access must be granted only when the device passes posture checks such as disk encryption and firewall status. Which access method fits best?
- Private applications in the data center must be reachable through Cisco Secure Access, but the security team will not open any inbound ports on the data center firewall for this purpose. What should be deployed?
- A legacy thick-client application negotiates many dynamic ports and uses server-initiated connections, and it fails over per-application ZTNA. Remote users still need it, and the company wants to deliver this through Secure Access rather than its own VPN headend. Which option fits?
- An administrator wants to let the finance group reach a new internal web application through Secure Private Access, but cannot select the application as a destination when writing the private access rule. What was skipped?
- Users authenticate to Secure Access successfully and the activity log shows their private access rule matched with an allow action, but the private web application still times out. Other users reach different apps through the same connector group. Where should troubleshooting focus first?
- Users must be stopped from uploading documents that contain payment card numbers to personal cloud storage sites at the moment of upload, while uploads without such data continue normally. Which Secure Access configuration achieves this?
- Employees paste source code and customer records into public generative AI chat tools. The company wants to keep allowing these tools but detect and block prompts that carry sensitive data, and also guard against prompt injection content in what users send. Which Secure Access capability fits?
- A compliance team plans a real-time DLP rule in Cisco Secure Access to stop credit card numbers from leaving through web uploads. Before enforcing anything, it wants to measure how often the rule would fire and how many matches are false positives, without interrupting users. How should the rule be deployed initially?
- An audit reveals that files containing customer account numbers were uploaded months ago to the organization's sanctioned cloud storage tenant. Security must find those files that are already stored there, not only future uploads. Which Cisco Secure Access DLP capability addresses this?
- Internal project codenames follow a fixed pattern of two capital letters, a hyphen and four digits, and no built-in data identifier in Cisco Secure Access matches them. The team wants DLP rules to detect these codenames in web uploads. What should be configured?
- A real-time DLP rule in Cisco Secure Access is set to block uploads of documents containing health record numbers to a file-sharing site. Test uploads over HTTPS succeed and no DLP event is logged, even though the identity and destination match the rule. What is the most likely cause?
- In Cisco Secure Access Investigate, an analyst reviews a domain contacted by one workstation. The domain was registered three days ago and carries a high risk score, but it has no security category assigned yet. What is the most appropriate interpretation?
- During an investigation, an analyst notices that a little-known domain is queried by the same clients within moments of queries to domains already confirmed as part of a phishing campaign. Which Investigate indicator captures this relationship?
- Investigate shows that a domain resolved to dozens of different IP addresses across many unrelated autonomous systems and countries during the last week, with short TTLs and records changing constantly. What does this DNS and IP history most strongly suggest?
- Three domains used in a recent malware campaign all list the same registrant email address in their registration data. The analyst wants to find other domains the attacker may have prepared but not used yet. Which Investigate pivot is most useful?
- Investigate shows a domain with extremely low popularity that almost no other networks query, yet DNS logs show one internal host resolving it every 60 seconds around the clock, including when no user is logged in. What does this pattern most likely indicate?
- A domain carries a benign business-related content category in Investigate, but it has a high risk score, appeared recently and co-occurs with known malware domains. A manager argues that the business category means it is safe. How should the analyst respond?
Endpoint Protection and Detection · 45 questions
- An organization relies on signature-based antivirus. An attacker uses a phishing macro to launch PowerShell, which downloads and runs a payload entirely in memory without writing an executable to disk, and the antivirus raises no alert. Which capability is designed to detect this kind of activity?
- Incident responders learn that a laptop was compromised about two weeks ago. They need to reconstruct which processes ran, which files were created and which network connections the host made since then. Which endpoint capability makes this possible?
- A security team's primary requirement is to stop known malware from running on workstations at all, by checking files when they are written or executed and blocking or quarantining any with a known malicious disposition. Which category of solution is built for this?
- A laptop shows signs of active compromise and may be spreading laterally. Responders need to cut it off from the rest of the network immediately while keeping it reachable from the security console so they can continue collecting evidence. Which EDR response action fits?
- Leadership asks how an XDR platform such as Cisco XDR differs from the EDR capability the organization already runs on its endpoints. Which explanation is accurate?
- A file was seen on several endpoints last week and judged clean when it arrived. Today new threat intelligence shows that the same file is malicious. How does Cisco Secure Endpoint handle the hosts that already received it?
- A threat intelligence report names a suspicious process used in recent intrusions. No alert has fired in the organization, but threat hunters want to check whether that process has ever run on any endpoint. Which approach fits?
- An employee reports that a company-owned smartphone enrolled in the organization's MDM was lost in an airport. The phone holds corporate email and documents. What is the most appropriate immediate action?
- Employees using personal phones for work insist that IT must not see or erase their personal photos and apps, while security requires that corporate email and files can be controlled and removed when an employee leaves. Which approach meets both requirements?
- A security team discovers devices on the network that appear in no system it manages: no EDR agent, no MDM record and no known owner. Before it can protect or monitor these endpoints, what must it establish first?
- A new policy requires every corporate phone to have a passcode of minimum complexity and device storage encryption enabled. The organization wants these settings enforced automatically and noncompliant devices reported. What should it use?
- An organization wants mobile devices to receive full network access only if its MDM reports them as enrolled and compliant; other devices should be redirected to enroll. Which design achieves this?
- A critical vulnerability is announced in a specific version of a PDF reader. The vulnerability team must identify every laptop running that version so it can prioritize remediation. Which data source answers this most directly?
- Corporate laptops connecting through Cisco ISE must have critical OS patches installed. Laptops missing them should not be blocked outright; they should receive only enough access to fix the problem and then gain full access. Which approach meets this requirement?
- Policy states that each Windows laptop must have an approved antimalware product installed with recently updated definitions. In Cisco ISE posture, how are these checks expressed so that the agent can evaluate them?
- Contractors bring their own Windows laptops for a two-week project. Policy requires a posture check before network access, but the contractors' employers forbid installing any persistent software on those laptops. Which Cisco ISE posture option fits?
- A corporate laptop has just authenticated with 802.1X, and the posture agent has not yet reported any result to Cisco ISE. What posture status does ISE hold for the endpoint, and what access does a typical posture design give it at this point?
- A noncompliant laptop should be able to reach only the internal patch server and the ISE nodes needed for posture, and nothing else, while remaining on its normal access VLAN. How is this enforced in a Cisco ISE design?
- A laptop passes posture at connection time. Hours later, the user disables the antimalware service, but the laptop keeps full network access until it reconnects the next day. Which Cisco ISE posture feature closes this gap?
- An unknown executable with no existing reputation arrives as an email attachment. The SOC wants to see what it actually does when run: files dropped, registry changes, processes spawned and network connections attempted. Which Cisco solution is designed for this?
- An administrator is planning a Cisco Secure Client rollout that must provide remote access VPN, ISE posture checks and endpoint flow visibility on corporate laptops. How should the deployment be approached?
- A Secure Malware Analytics report shows no hash match for a file in any reputation source, but it lists behavioral indicators such as modifying autorun registry keys, injecting into another process and contacting a recently registered domain, along with a high threat score. How should the analyst interpret it?
- A sample shows no malicious activity in the sandbox, yet the same file later compromises a physical workstation. Researchers find that it checks for virtual machine artifacts and sleeps for a long period before acting. What does this indicate about the analysis?
- A SOC wants suspicious files collected by several other security tools to be submitted to Cisco Secure Malware Analytics automatically, with verdicts returned to those tools, instead of analysts uploading samples by hand. What enables this?
- The security team wants endpoint flow records that show, for each network connection, which process on the laptop generated it and which user was logged in, including while the laptop is off the corporate network. Which Cisco Secure Client capability provides this?
- During a pilot of Cisco Secure Endpoint on production workstations, the team wants detections logged so it can find false positives, but nothing may be quarantined or blocked until the pilot ends. How should the policy be set?
- The SOC confirms that a file with a specific SHA-256 hash is malicious, but Cisco Secure Endpoint does not yet treat it as malicious. Analysts want every connector to detect and quarantine that exact file immediately. What should they configure?
- Company policy prohibits a specific remote-administration tool that is not malware and has no malicious disposition. Security wants Cisco Secure Endpoint to prevent that executable from running on any managed computer. Which feature fits?
- Cisco Secure Endpoint repeatedly scans a line-of-business application's data folder, slowing the application, and investigation confirms the files there are benign. What is the recommended way to address this?
- Servers running critical databases need a Cisco Secure Endpoint policy with different exclusions and protection settings from employee laptops, and both sets of computers are managed in the same organization. How should this be organized?
- Attackers are targeting a browser vulnerability that uses memory corruption to inject code into the running browser process, without dropping a malicious file. Which Cisco Secure Endpoint engine is designed to protect against this technique?
- A ransomware variant with no known file disposition starts encrypting user documents rapidly, launched by malicious scripts through built-in system tools. Which Cisco Secure Endpoint protections address this activity rather than relying on file reputation?
- Cisco Secure Endpoint shows a Threat Detected event followed by a Threat Quarantined event for the same file on one laptop. What is the correct next step?
- Cisco Secure Endpoint reports a Threat Detected event followed by a Quarantine Failure event for a malicious file on a server. How should this be interpreted?
- Cisco Secure Endpoint generates a retrospective detection for a file that executed on four laptops several days ago, when its disposition was unknown. What does this event mean for the response?
- An analyst needs to see how a malicious file arrived on one specific laptop, which process created it, what it executed afterward and which network connections followed. Which Cisco Secure Endpoint view is designed for this?
- After confirming that a file is malicious, an analyst must identify every computer in the organization where that file appeared, when it first arrived on each and which of those hosts executed it. Which Cisco Secure Endpoint view answers this?
- Cisco Secure Endpoint flags several indications of compromise on a laptop: a document opened from email spawned a scripting engine, a new persistence entry appeared and an unusual outbound connection followed. No file on the laptop was convicted. How should this be interpreted?
- An organization uses Microsoft 365 for email and wants Cisco Security Email Threat Defense, but the messaging team will not change MX records or place another gateway in the mail flow. Which deployment model fits?
- Cisco Security Email Threat Defense is connected to a Microsoft 365 tenant, but the security team must ensure it receives copies of incoming, outgoing and internal messages for analysis. What must be configured in Microsoft 365?
- A company uses Cisco Security Email Threat Defense with its Microsoft 365 tenant. The security team is tired of manually moving each malicious message out of user inboxes after the verdict appears and wants this to happen without analyst action. What should the team configure?
- Finance staff at a company protected by Cisco Security Email Threat Defense receive messages that impersonate the CFO and urge them to pay a new supplier invoice today. The messages contain no attachments and no links. Which verdict category is designed to catch this pattern?
- Yesterday a vendor-themed message reached 40 mailboxes and was judged clean. Today threat intelligence shows its embedded link is a credential-harvesting site. The company uses Cisco Security Email Threat Defense with Microsoft 365. What is the most effective response?
- An administrator configuring Cisco Security Email Threat Defense wants malicious and phishing messages taken out of reach of users, while ordinary spam should still be available to users if they want to check it. How should this be implemented?
- An analyst opens a message that Cisco Security Email Threat Defense flagged as phishing and must explain to the user's manager why it was flagged, without guessing from the subject line. Which information in the message view best supports that explanation?
Network Access, Visibility, and Enforcement · 45 questions
- A hotel-style lobby network managed by Cisco ISE must give visitors internet-only access after they accept an acceptable-use policy. No employee should create accounts or approve anyone. Which guest access flow fits this requirement?
- A company using Cisco ISE requires that each visitor's guest account be created or approved by a front desk employee before the visitor can connect. The employee should only manage guests, not change ISE policy. Which approach meets this requirement?
- IP phones, printers and badge cameras on a campus cannot run an 802.1X supplicant. Cisco ISE must still place each type into the correct VLAN or apply the correct dACL automatically. Which ISE capability makes this possible?
- An employee wants to connect a personal phone to the corporate SSID. Security forbids a shared Wi-Fi password and wants each device to authenticate individually with credentials that can be revoked. Which Cisco ISE approach meets this?
- A Cisco ISE deployment must give full access only to users who are members of a specific Active Directory group, while other domain users get restricted access. Which configuration supports this decision?
- A corporate laptop passes 802.1X authentication through Cisco ISE, but policy says it must not receive full network access until its antivirus and patch level are confirmed. How should ISE enforce this?
- A contractor laptop authenticates to the network successfully, but its compliance check fails because disk encryption is disabled. Policy says the device must still be able to fix the problem itself. What authorization outcome should be returned?
- Self-service kiosks in a store run a fixed set of business applications. Security wants to ensure that no other executable can run on them, including malware that has never been seen before. Which control best meets this goal?
- The network team wants to block a peer-to-peer file-sharing application for all devices crossing the internet edge, including unmanaged devices that have no endpoint agent. The application changes ports dynamically. Which control fits best?
- A company already manages its mobile devices with an MDM platform that tracks encryption, jailbreak status and PIN enforcement. It wants Cisco ISE to grant network access based on that compliance without installing another agent. What should be configured?
- A previously unseen application keeps appearing on corporate endpoints. One team runs a blocklist of known-bad software, another runs an application allowlist. What happens to the unknown application under each model by default?
- A campus access port must authenticate laptops with 802.1X, but printers on the same port type have no supplicant. The engineer wants 802.1X tried first, then MAB if no EAP response arrives. What should be configured on the switch?
- A new engineer is mapping the 802.1X roles in a deployment where a laptop connects to a Catalyst switch port and Cisco ISE makes the access decision. Which mapping of supplicant, authenticator and authentication server is correct?
- A network printer authenticates with MAB through Cisco ISE. An attacker unplugs it and connects a laptop configured with the printer's MAC address to the same port. Which design limits the damage of this attack?
- A company is introducing 802.1X with Cisco ISE on 3,000 wired ports. Leadership says no user can be locked out during rollout while the team reviews which devices pass and fail authentication. Which deployment approach fits?
- Contractors who authenticate with 802.1X through Cisco ISE must reach only two application servers, while employees on the same switches keep normal access. The engineer wants the restriction applied per session from ISE. What should the contractor authorization profile return?
- An IP phone and a PC daisy-chained behind it share one switch port. Both must authenticate separately through Cisco ISE, with the phone placed in the voice VLAN and the PC in the data VLAN. Which host mode supports this?
- A laptop connects with 802.1X, Cisco ISE assigns a posture-pending profile, and the posture agent then reports the laptop compliant. The user must receive full access without unplugging or rebooting. What makes the new policy take effect?
- A Cisco XDR analyst confirms an endpoint is compromised and wants to quarantine it on the network immediately through Cisco ISE, without logging in to the switch. Which mechanism makes this possible?
- Cisco ISE shows that it sent CoA requests to a Catalyst access switch, but sessions on the switch never change and ISE reports no acknowledgment. RADIUS authentication itself works normally. What is the most likely cause?
- A new device first connects and Cisco ISE gives it a generic unknown-device authorization. Seconds later, profiling probes classify it as a badge-reader controller, which has its own authorization rule. How does the device receive the correct access?
- After a device is reprofiled, Cisco ISE must move it from VLAN 50 to VLAN 60. The device does not renew its DHCP lease on a reauthentication, so it keeps an address from the wrong subnet. Which CoA type should be used?
- An engineer is writing firewall rules between a Catalyst switch and Cisco ISE and must understand CoA traffic direction. Normal RADIUS authentication flows from the switch to ISE. Which statement describes how CoA messages flow?
- DNS logs show one internal host querying thousands of long, random-looking subdomains of a single unfamiliar domain, mostly TXT record lookups, at a steady rate. What is the most likely explanation, and which control addresses it?
- A network sensor shows a workstation sending ICMP echo requests to one external host every few seconds, with payloads much larger than usual and different content in each packet. Normal pings in the environment carry small fixed payloads. What does this most likely indicate?
- A database server uploads several gigabytes each night to a personal account on a public cloud storage service that the company does not use. The traffic is HTTPS to a reputable provider. Which control best detects and prevents this exfiltration path?
- An attacker exfiltrates data from a compromised host in HTTPS POSTs to a newly registered domain that mimics a SaaS vendor. The firewall allows the traffic because it is encrypted on port 443. Which combination best improves detection?
- Flow records show a workstation sending steady UDP 123 traffic to an unknown external server, with packet sizes far larger than normal time requests. Corporate devices are supposed to use two internal time servers. What is the best response?
- An employee who has resigned starts sending compressed archives of customer records from the corporate mailbox to a personal webmail address. Which control is designed to detect and stop this exfiltration path?
- A single phishing campaign produces separate alerts in Cisco Secure Firewall, Cisco Secure Endpoint and Cisco Security Email Threat Defense. Analysts triage them one at a time and miss that they are linked. What capability addresses this?
- A SOC already collects logs centrally and writes detection rules, but each confirmed alert still requires an analyst to run the same lookups and containment steps by hand. The team asks whether it needs a SIEM, a SOAR, or both. What fills the gap described?
- A server that normally exchanges a few megabytes daily with two internal databases suddenly starts connecting to dozens of internal hosts on SMB at night. No signature matches the traffic. Which detection approach is most likely to flag this?
- While reviewing a Cisco XDR incident, an analyst confirms a laptop is beaconing to a command-and-control domain and wants to contain it immediately from the incident view rather than opening each product console. What should the analyst use?
- A SOC manager argues that network telemetry is redundant because every corporate laptop runs EDR. The network also has printers, IP cameras, contractor devices and IoT sensors. What is the strongest argument for keeping network telemetry?
- Analysts in a SOC receive thousands of low-severity alerts per day and routinely miss the few that matter. Leadership wants fewer, higher-confidence items to investigate without turning off detections. Which approach addresses this?
- Cisco Duo administrators want to be told when a user authenticates in an unusual way, for example from a new country and a never-seen device shortly after a normal login elsewhere, so they can review it. Which Duo capability is designed for this?
- A company wants its finance applications reachable only from company-managed laptops, while personal devices can still reach the intranet portal. Users already authenticate with Cisco Duo MFA. Which Duo capability enforces the managed-device requirement?
- Security wants Cisco Duo to warn or block users at login if their laptop is running an out-of-date operating system or has its host firewall or disk encryption turned off. Which Duo capability provides this?
- A company using Cisco Duo wants login requirements to tighten automatically when context is risky, for example when users connect from countries where it has no staff or through anonymizing networks, while normal office logins stay simple. Which Duo feature should be configured?
- Users complain about logging in separately to a dozen SaaS applications, while security also wants identity threats such as dormant privileged accounts surfaced across identity providers. Which Cisco Duo combination addresses both needs?
- A SOC using Splunk Enterprise Security wants an alert when the same user fails authentication on several different systems within a short window and then succeeds on one of them. Which Splunk ES mechanism should produce this alert?
- Tier-one analysts handle dozens of reported phishing emails daily, each time extracting URLs and attachments, checking reputation, searching for other recipients and opening a ticket. The steps never change. Which Splunk capability addresses this?
- Splunk Enterprise Security raises dozens of separate low-severity notable events for one user each day, such as an odd login time, a new device and a rare process. Analysts dismiss them individually. Which approach surfaces the user only when combined activity becomes significant?
- Security leadership wants to see monthly trends in incident counts, mean time to respond and the top attack categories across the environment, without asking analysts to run searches each time. What should be built in Splunk?
- Analysts need to track each investigation from detection to closure, including ownership, status changes, notes, evidence and actions taken, so audits can reconstruct who did what. Which Splunk capability supports this?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by Cisco Systems, Inc..