Security Concepts

350-701 · 60 questions

• After several employees installed a free PDF utility that looked legitimate and worked as advertised, the help desk finds that every installed copy opened a remote shell to an outside host. The program never spread to other machines on its own. Which type of malware best describes this behavior?
• A public web portal becomes unreachable. Logs show completed TCP handshakes and full HTTP requests arriving at the same moment from thousands of residential IP addresses in many countries, and adding the busiest addresses to a deny list has no visible effect. Which attack is occurring, and why does the deny list fail?
• On a Linux server, ps, netstat, and ls report nothing unusual, yet an offline scan from trusted boot media reveals a running backdoor binary and an outbound connection that the live system tools never displayed. Which threat is the most likely explanation?
• On public coffee-shop Wi-Fi, a user sees a browser warning that the bank's certificate was issued by an unknown authority, clicks through, and later finds the account drained. The attacker was on the same wireless network and relayed the session to the real bank. Which attack occurred, and which control would have stopped it had the user heeded it?
• A cloud tenant's storage buckets were copied out over a weekend. The attacker used a valid access key that a developer had committed to a public code repository, and the on-premises firewall, IPS, and VPN logged nothing unusual. What does this incident illustrate?
• Security leadership asks why the team is starting post-quantum cryptography planning now for VPN and TLS traffic whose contents must stay confidential for 15 years, even though no cryptographically relevant quantum computer exists today. Which explanation is correct?
• A vulnerability scan reports CVE-A with a CVSS base score of 9.8 on an internet-facing web server and CVE-B with a base score of 6.5 on an isolated lab host with no external connectivity. The team can remediate only one finding this week. Which approach is correct?
• Typing a single quote into a web application's login field produces a database syntax error that names the table being queried. Which vulnerability does this indicate, and what is the root-cause fix?
• A download request whose file parameter climbs two parent directories and names the system password file returns the contents of the server's account file instead of a product brochure. Which vulnerability is present, and which control addresses it?
• Researchers find that a vendor's firmware image contains the same built-in administrative password on every unit shipped, and the account cannot be disabled from the management interface. A customer proposes enforcing a strong local password policy at each site. Why is that insufficient?
• While logged in to a banking site in one tab, a user clicks a forum link that silently submits a funds-transfer form to the bank. The bank processes it because the browser automatically attached the user's session cookie, and no script ever ran on the bank's own pages. Which attack is this?
• A network service written in C crashes when it receives an input string longer than expected, and researchers then craft a payload that overwrites the saved return address and runs their own code. Which vulnerability is this, and which class of mitigation addresses it?
• A support chatbot summarizes incoming customer emails for agents. One email contains white-on-white text instructing the model to ignore its rules and list internal discount codes, and the resulting summary includes those codes. The sender never interacted with the chatbot directly. Which vulnerability was exploited?
• Users discover they can coax an internal assistant into printing its full hidden instruction block, which includes an internal API endpoint and a service token. Which remediation addresses the root cause of this system prompt leakage?
• A retrieval-augmented generation (RAG) assistant answers an engineer's question using salary documents from HR. All departments' documents were embedded into a single shared vector store, and retrieval returns the nearest matches without checking who is asking. Which weakness does this describe, and what fixes it?
• A data science team downloaded a pretrained model and a fine-tuning dataset from a public hub. Months later, the publisher's account is found to have been compromised, and the model contains a hidden backdoor behavior. Which risk category is this, and which control most directly reduces it?
• An attacker with edit rights to an internal wiki plants pages containing false remediation steps. A RAG assistant indexes the wiki nightly and begins recommending the false steps, although its underlying language model was never retrained or modified. What best describes this attack?
• An AI agent reads external web pages and can call internal tools that create tickets, query a CRM, and send email. The architect accepts that prompt filtering cannot catch every injection. Which control most effectively limits the damage a successful injection can cause?
• A finance clerk receives an urgent email that appears to come from the CEO, requesting a wire transfer to a new supplier account before end of day and asking that no one else be told. The message passed SPF because it came from a look-alike domain the attacker registered. Which control most directly stops this attack?
• An organization wants receiving mail servers on the internet to reject messages that claim to come from its exact domain but were neither sent through its authorized servers nor signed with its keys. Which control should it publish?
• A phishing campaign tricks several employees into entering their passwords on a fake portal, yet the attackers fail to sign in to the real applications with those passwords. Which control most likely produced this outcome, and which form of it best resists an attacker who relays the login in real time?
• A CISO wants to measure how often employees click phishing links and demonstrate a downward trend each quarter. Which control fits this requirement?
• An employee receives a phone call from someone claiming to be the IT help desk, who says the user's account is being migrated and asks them to read out the six-digit code that just arrived on their phone. Which attack is this, and which policy best counters it?
• A user clicks a link in a phishing email that slipped past the email filters. The link points to a credential-harvesting site that threat intelligence already lists as malicious. Which network-layer control can still stop the connection after the click?
• An administrator downloads a firewall software image and must confirm it was not altered in transit. The vendor publishes a SHA-512 value for the file on its support site. What should the administrator do?
• Two data centers must exchange large volumes of data quickly over the internet, and the encryption keys must be agreed without ever being sent in the clear. Which design meets both requirements?
• A site-to-site IPsec tunnel works until one peer is moved behind a router that performs port address translation. After the move, IKE negotiation completes but ESP packets are dropped at the PAT router and no protected traffic passes. Which mechanism resolves this, and why?
• Users' browsers reject a web server's TLS certificate even though it is within its validity period and its subject alternative name matches the hostname. Packet capture shows the server sends only its own leaf certificate, which was issued by an intermediate CA. What is the most likely cause?
• A remote-access design team wants the client's transport to run over QUIC and wants tunneled user traffic carried through an HTTP/3 proxy. Which description of these technologies is correct?
• A VPN design will connect 200 branch firewalls to two hubs. If one branch device is stolen, the team must cut it off quickly without changing configuration on the hubs or on the other 199 branches. Which peer authentication method fits, and why?
• A retailer runs a hub-and-spoke WAN of 300 stores over the internet. Store-to-store video traffic currently hairpins through the hub, and the team wants spokes to build direct encrypted tunnels to each other only when needed, without preconfiguring every pair. Which VPN technology fits?
• A company's private MPLS WAN must encrypt any-to-any traffic among 80 sites. The carrier requires that original IP headers remain visible so its QoS and routing keep working, and the team wants no point-to-point tunnels. Which technology fits?
• An engineer wants OSPF to run across an IPsec site-to-site connection between two sites and wants traffic selected for encryption by routing rather than by an access list that names the protected networks. Which approach provides this?
• An organization standardizing on IKEv2 wants one Cisco configuration framework it can use for site-to-site, hub-and-spoke, spoke-to-spoke, and remote access VPNs instead of maintaining separate technologies. Which framework fits?
• Contractors must reach internal applications from hotel and customer networks that block all outbound traffic except HTTPS on TCP port 443, and IPsec clients fail to connect from those networks. Which remote access approach fits this constraint?
• A company must build a site-to-site VPN between its Cisco Secure Firewall and a partner's firewall from a different vendor. Which choice gives the best chance of interoperability?
• Two organizations want to share threat indicators in a structured, machine-readable language and exchange them automatically between their platforms over HTTPS. Which pairing describes the roles correctly?
• An analyst receives a third-party feed of 5,000 IP addresses labeled as command-and-control infrastructure, with no confidence ratings and no dates. Before loading the addresses into firewall blocklists, what is the most important consideration?
• A SOC keeps blocking malware hashes and command-and-control IP addresses from one threat group, but the group replaces them within days. The SOC lead wants detections that stay effective when those artifacts change. What should the team focus on?
• After an incident, a team documents indicators and observed attacker behavior and wants to share them with peer companies in its industry while controlling how far recipients may redistribute the information. Which approach fits?
• A Cisco Secure Firewall blocks a connection to a domain that the security team never added to any list. The connection event shows the destination was blocked by Security Intelligence as a known malicious domain. Where did that verdict most likely come from?
• A peer company shares an indicator report labeled TLP:AMBER under Traffic Light Protocol version 2.0. An analyst wants to forward it. Under the label's rules, with whom may the report be shared?
• A company is replacing a model in which anything on the internal network was trusted with one where every access request is evaluated on its own merits. Which statement captures the core principle of the new model?
• Following NIST SP 800-207, an architect places components in front of a finance application so that each session request is decided by policy and then allowed or blocked at the connection itself. Which division of roles is correct?
• A user with valid credentials who has just approved an MFA prompt tries to reach a sensitive application from a personal laptop with an outdated operating system and no endpoint protection. Under zero trust, what should happen?
• A user authenticates successfully in the morning. An hour later, the same session begins downloading large volumes of customer records from an unusual country. How does a zero trust architecture handle this?
• An incident review finds that malware on one compromised web server reached database and backup servers in the same data center VLAN without crossing any firewall. How does microsegmentation support zero trust in this situation?
• A vendor tells leadership that buying its single appliance will deliver zero trust for the company. The CISO disagrees. Which statement best supports the CISO's view?
• A board member asks why the company funds endpoint protection, email security, DNS-layer filtering, MFA, and segmentation instead of relying on one top-tier perimeter firewall. Which answer reflects the principle of defense in depth?
• An architect uses Cisco SAFE to organize a security design around the locations where the business operates, such as branch, campus, data center, edge, cloud, and WAN. Which SAFE construct is the architect using?
• A security architect is using Cisco SAFE to plan controls for a campus, a branch and a data center. The team has already identified the business flows in each area and the threats against them. What does SAFE use next to organize the security capabilities each of those places needs?
• A malicious attachment passes the email security layer because its file hash was unknown when the message was delivered. A user opens it on a Windows laptop. Which additional defense-in-depth layer is most likely to stop the file from executing on that host?
• A company places every security control at the data-center internet edge: a next-generation firewall, IPS and web filtering. Half the staff now work remotely and reach SaaS applications directly from home without a VPN. What is the main defense-in-depth gap in this design?
• A security team must present a new branch design to executives and explain why each control was chosen, tracing from the branch's business flows and threats to the selected capabilities. Which Cisco SAFE resources best support that explanation?
• A script runs r = requests.post(fmc + '/api/fmcplatform/v1/auth/generatetoken', auth=(user, pw)), then tok = r.headers['X-auth-access-token'] and h = {'X-auth-access-token': tok}. Every later call is requests.get(url, headers=h). How does the script use the credentials and the token?
• A script queries a firewall manager with requests.get(url, headers=h, verify=False). The call succeeds even though the manager presents a self-signed certificate. What is the security consequence of this setting?
• A script runs data = r.json() and then for obj in data['items']: print(obj['name']). The response body is {"items": [{"name": "WebSrv", "value": "10.1.1.10"}, {"name": "DNS1", "value": "10.1.1.53"}], "paging": {"count": 2}}. What does the script print?
• A nightly script obtains an API token from a firewall manager at the start of the job, and its first calls succeed. Hours later in the same run, a GET using the same header returns HTTP 401 Unauthorized. What is the most likely cause?
• A script calls requests.get(objectsurl, headers=h, params={'name': 'web'}) and then requests.post(objectsurl, headers=h, json={'name': 'Web2', 'type': 'Host', 'value': '10.1.1.20'}). What do the two calls do?
• A teammate's script defines APIKEY = 'a1b2c3d4e5' near the top, and the file has already been committed and pushed to the team's Git repository. The script works. What is the correct fix?