I85PREP
⌘ K
CCNP Security study materials
CCNP Security study resources

CCNP Security practice questions

One question at a time. Build your CCNP Security understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security

Which IPsec protocol provides confidentiality for the encapsulated payload?

  1. Encapsulating Security Payload (ESP) Correct answer.
  2. Authentication Header (AH)
  3. Generic Routing Encapsulation (GRE)
  4. Internet Key Exchange (IKE)

Explanation

ESP encrypts the payload (for example with AES) and can also provide integrity and authentication, which is why it is used whenever confidentiality is required. AH provides integrity and origin authentication but never encrypts. IKE is only the negotiation protocol, and GRE provides tunneling without encryption.

Question 2Network Security

Which UDP port do two IPsec peers use for the initial IKE negotiation before any NAT detection has occurred?

  1. UDP 500 Correct answer.
  2. UDP 4500
  3. UDP 848
  4. TCP 443

Explanation

IKE uses UDP 500 as the source and destination port for the initial exchanges that build the IKE SA. UDP 4500 is used only after NAT-Traversal has been detected, and UDP 848 is the GDOI port used by group-encrypted VPN technologies.

Question 3Network Security

A packet arrives at an interface where an ACL is applied and matches no entry in the list. What happens to the packet?

  1. It is forwarded, because unmatched traffic is permitted by default
  2. It is dropped by the implicit deny Correct answer.
  3. It is forwarded if it matches the interface's default route
  4. It is logged and then forwarded

Explanation

Every Cisco ACL ends with an invisible deny statement covering all remaining traffic, so any packet that matches no configured entry is discarded. An explicit permit is required for traffic that should be allowed.

Question 4Network Security

Which feature prevents an unauthorized DHCP server on an untrusted switch port from offering IP configuration to clients?

  1. Dynamic ARP Inspection
  2. 802.1X port-based authentication
  3. IP Source Guard
  4. DHCP snooping Correct answer.

Explanation

DHCP snooping classifies ports as trusted or untrusted and discards server-to-client DHCP messages such as OFFER, ACK, and NAK that arrive on untrusted ports. It also builds the binding table used by other Layer 2 security features.

Question 5Network Security

Which port security violation mode silently drops frames from unknown MAC addresses without logging or incrementing the violation counter?

  1. shutdown
  2. restrict
  3. protect Correct answer.
  4. sticky

Explanation

Protect mode discards offending frames and produces no syslog message, SNMP trap, or counter increment. Restrict mode drops and reports the violation, while shutdown mode err-disables the port.

Question 6Network Security

In an 802.1X deployment, which role does the access switch perform?

  1. Authentication server
  2. Authenticator Correct answer.
  3. Policy decision point
  4. Supplicant

Explanation

The switch acts as the authenticator: it relays EAP messages between the client and the RADIUS server and enforces the resulting authorization decision on the port. The client is the supplicant and the RADIUS server is the authentication server.

Question 7Network Security

Two interfaces belong to different zones, and no zone-pair policy exists between those zones. What happens to traffic attempting to pass from one zone to the other?

  1. It is permitted if it is return traffic for an existing session
  2. It is inspected by the default policy
  3. It is permitted in both directions
  4. It is dropped Correct answer.

Explanation

Zone-based firewall behavior is deny-by-default between zones; a zone pair must exist and reference a service policy before any inter-zone traffic is allowed. Traffic within the same zone is treated differently and is not subject to zone-pair policies.

Question 8Network Security

What is the primary purpose of Control Plane Policing?

  1. To prioritize voice traffic over bulk data
  2. To shape traffic that is forwarded through the data plane
  3. To rate-limit traffic destined for the route processor Correct answer.
  4. To mark packets at the network edge for QoS treatment

Explanation

Control Plane Policing classifies traffic that is punted to or addressed to the route processor and applies policers so that flooding or attacks cannot exhaust CPU resources. It protects the control plane rather than forwarding behavior.

Question 9Network Security

After NAT-Traversal has been detected between two IPsec peers, which UDP port carries the encapsulated ESP packets?

  1. UDP 1701
  2. UDP 4500 Correct answer.
  3. UDP 848
  4. UDP 500

Explanation

When peers detect NAT through the vendor ID and hash payloads exchanged during IKE, ESP is encapsulated in UDP with source and destination port 4500, and keepalives are sent on the same port. UDP 500 remains in use for the IKE negotiation itself.

Question 10Network Security

Which DMVPN phase introduces NHRP redirect and shortcut messages so the hub can advertise a summary route while spokes still establish direct spoke-to-spoke tunnels?

  1. Phase 1
  2. Phase 2
  3. Phase 4
  4. Phase 3 Correct answer.

Explanation

Phase 3 adds NHRP redirects from the hub and shortcut requests between spokes, which removes the phase 2 requirement that every spoke hold a specific route to every other spoke tunnel subnet. That allows summarization at the hub while preserving direct spoke-to-spoke paths.

Question 11Network Security

Which VPN technology encrypts traffic without adding a tunnel header, so the original IP header is preserved end to end?

  1. Clientless SSL VPN
  2. DMVPN Phase 3
  3. FlexVPN
  4. GET VPN Correct answer.

Explanation

GET VPN uses GDOI group key management and encrypts packets in place, preserving the original IP header so that routing, QoS, and multicast operate exactly as they do on the underlying transport. The other options all add an outer tunnel IP header.

Question 12Network Security

Which protocol is used to share Security Group Tag bindings with network devices that do not support inline tagging?

  1. TACACS+
  2. 802.1X
  3. SXP Correct answer.
  4. RADIUS

Explanation

The SGT Exchange Protocol carries IP-address-to-SGT bindings to devices that cannot read the inline tag, using TCP port 64999. Devices that do support inline tagging carry the SGT in the Cisco Meta Data header instead.

Question 13Network Security

How does loose mode unicast RPF verify the source address of an arriving packet?

  1. It compares the source against a configured list of permitted prefixes
  2. It requires a route back to the source through the interface that received the packet
  3. It requires a matching entry in the CEF adjacency table
  4. It checks only that a route to the source exists in the routing table Correct answer.

Explanation

Loose mode performs a FIB lookup on the source address and forwards the packet as long as any route to the source exists, regardless of which interface the packet arrived on. Strict mode is the variant that additionally requires the return path to use the ingress interface.

Question 14Network Security

IP Source Guard on an access port uses which table to decide whether to permit a received packet?

  1. The MAC address table
  2. The CEF forwarding table
  3. The DHCP snooping binding table Correct answer.
  4. The ARP cache

Explanation

IP Source Guard builds its filter from the DHCP snooping binding database, which maps MAC address, IP address, VLAN, and port, and it can be supplemented with static IP source bindings. Packets whose source does not match a binding are dropped in hardware.

Question 15Network Security

Dynamic ARP Inspection validates ARP packets received on an untrusted port by comparing them against what?

  1. The ACL applied to the management SVI
  2. The DHCP snooping binding database Correct answer.
  3. Static ARP entries configured on the switch
  4. The MAC address table's port associations

Explanation

DAI intercepts ARP packets on untrusted ports and checks the sender MAC and sender IP against the DHCP snooping binding table, or against configured ARP ACLs where static addressing is used. Invalid ARP packets are dropped to prevent ARP poisoning.

Question 16Network Security

On a Cisco ASA, how is traffic treated by default when it flows from a higher security-level interface to a lower security-level interface with no ACL applied?

  1. Denied by the implicit deny
  2. Permitted only if inspected by a class map
  3. Permitted only for return traffic
  4. Permitted by default Correct answer.

Explanation

The ASA permits traffic from a higher security level to a lower one without an ACL and uses stateful inspection to allow the return traffic. An ACL is required only for traffic moving from a lower level to a higher level.

Question 17Network Security

Which method lets a relying party check certificate revocation status in real time from a dedicated responder instead of downloading a list?

  1. CRL distribution point
  2. Certificate chain validation
  3. OCSP Correct answer.
  4. SCEP

Explanation

Online Certificate Status Protocol queries a responder that returns a signed good, revoked, or unknown status for a specific certificate, avoiding the latency of periodic CRL downloads. CRLs are pre-published lists, and SCEP is a certificate enrollment protocol.

Question 18Network Security

Which statement correctly describes TACACS+ compared with RADIUS?

  1. TACACS+ uses TCP and encrypts only the password field
  2. TACACS+ uses UDP and encrypts only the password field
  3. TACACS+ uses TCP and encrypts the entire packet body Correct answer.
  4. TACACS+ uses UDP and encrypts the entire packet body

Explanation

TACACS+ runs over TCP with port 49 and encrypts the whole body of the packet after the header, which allows it to separate authentication, authorization, and accounting. RADIUS runs over UDP and hides only the user password in the access request.

Question 19Network Security

When MAC Authentication Bypass is used on a switch port, what does the switch place in the username and password fields of the RADIUS Access-Request?

  1. The client IP address and the MAC address
  2. The switch MAC address and the port number
  3. The client MAC address and a shared secret
  4. The client MAC address for both Correct answer.

Explanation

MAB submits the supplicant's MAC address as both the username and the password in the RADIUS request, and the policy server authorizes the device if that address is known. It is a fallback for endpoints that cannot run an 802.1X supplicant.

Question 20Network Security

Which protocol negotiates and distributes the session keys used by MACsec?

  1. SXP
  2. 802.1X
  3. IKEv2
  4. MKA Correct answer.

Explanation

The MACsec Key Agreement protocol, defined with IEEE 802.1X-2010, derives and distributes the secure association keys once the peer has been authenticated and a connectivity association key exists. IKEv2 serves the analogous role for IPsec, not for MACsec.

Question 21Network Security

In IKEv2, which exchange consists of two messages that negotiate cryptographic algorithms and exchange Diffie-Hellman public values?

  1. IKE_AUTH
  2. IKE_SA_INIT Correct answer.
  3. INFORMATIONAL
  4. CREATE_CHILD_SA

Explanation

IKE_SA_INIT is a two-message exchange that proposes algorithms, exchanges nonces and Diffie-Hellman values, and establishes the IKE SA. The subsequent IKE_AUTH exchange authenticates the peers and creates the first child SA.

Question 22Network Security

Within a zone-based firewall policy, which action forwards traffic between zones without creating state entries or automatically permitting return traffic?

  1. pass Correct answer.
  2. drop
  3. inspect
  4. reset

Explanation

The pass action provides a simple permit that does not build a state table entry, so return traffic must be permitted by its own policy. The inspect action creates sessions and permits return traffic automatically.

Question 23Network Security

Control Plane Protection divides the control plane into subinterfaces. Which one carries traffic that is destined to an IP address owned by the router itself?

  1. CEF-exception
  2. transit
  3. aggregate
  4. host Correct answer.

Explanation

The host subinterface handles traffic addressed directly to the device, such as management access to an interface address. The transit subinterface handles traffic that is destined to the router for processing but not owned by it, and CEF-exception handles traffic punted as an exception.

Question 24Network Security

Which IPv6 First Hop Security feature blocks rogue Router Advertisement messages received from an untrusted port?

  1. IPv6 Source Guard
  2. IPv6 RA Guard Correct answer.
  3. IPv6 Destination Guard
  4. DHCPv6 Guard

Explanation

RA Guard classifies ports as trusted or untrusted and drops Router Advertisement messages arriving on untrusted ports, which prevents a rogue host from becoming the default gateway. The other features filter source addresses, DHCPv6 server messages, or destination addresses respectively.

Question 25Network Security

A router uses strict mode uRPF on an internal interface and drops legitimate client traffic; traceroutes show the return path to those clients leaves through a different router. What is the most appropriate change?

  1. Change uRPF to loose mode on the interface Correct answer.
  2. Apply an inbound ACL that permits only the client subnet
  3. Configure the interface with the allow-default option
  4. Disable CEF switching on the interface

Explanation

Strict mode requires the source to be reachable through the exact interface that received the packet, which asymmetric routing invalidates. Loose mode only requires a route to the source to exist anywhere in the forwarding table, so it still blocks unroutable spoofed sources while tolerating the asymmetric path.

Question 26Network Security

Which Cisco ISE node persona processes the RADIUS access-request messages that network access devices send when a user or endpoint attempts to join the network?

  1. pxGrid controller node
  2. Monitoring and Troubleshooting node
  3. Policy Administration node
  4. Policy Service node Correct answer.

Explanation

The Policy Service persona terminates RADIUS and TACACS+ requests from network access devices and evaluates the matching authentication and authorization policy. Administration, configuration storage, and the graphical interface belong to a separate persona. The Monitoring node collects logs and reporting data, and pxGrid shares context with ecosystem partners.

Question 27Network Security

Which EAP method authenticates the server with a certificate and then carries a credential-based inner method such as MS-CHAPv2 inside an encrypted TLS tunnel, so the client does not need its own certificate?

  1. LEAP
  2. EAP-TLS
  3. EAP-MD5
  4. PEAP Correct answer.

Explanation

PEAP builds a TLS tunnel using only a server-side certificate, and the supplicant is authenticated inside that tunnel with a legacy method such as MS-CHAPv2. EAP-TLS is different because it requires certificates on both sides. The tunnel is what protects the inner credential exchange from eavesdropping.

Question 28Network Security

Which IPsec protocol authenticates the whole IP packet, including the outer IP header, but does not provide any confidentiality?

  1. Encapsulating Security Payload
  2. Authentication Header Correct answer.
  3. Internet Key Exchange
  4. Generic Routing Encapsulation

Explanation

The Authentication Header computes an integrity check value over the immutable fields of the IP header plus the payload, so header fields are protected, but it never encrypts the payload. ESP is the protocol that supplies confidentiality. IKE is a negotiation protocol, and GRE is a tunneling protocol with no built-in authentication.

Question 29Network Security

Which switch feature limits the number of source MAC addresses that can be learned on an access port and can discard frames from addresses that are not allowed?

  1. Dynamic ARP Inspection
  2. Port security Correct answer.
  3. IP Source Guard
  4. DHCP snooping

Explanation

Port security defines the maximum number of MAC addresses on a port and can restrict which addresses are valid, dropping frames that violate the policy. The other features validate ARP or IP-to-MAC bindings, or filter DHCP messages, but none of them limits the number of learned MAC addresses on a port.

Question 30Network Security

An internal server at 10.1.1.10 must be reachable from the internet at 203.0.113.10 on TCP 443 only, while all other inbound traffic is denied. Which ASA NAT configuration meets the requirement?

  1. Identity NAT that preserves the private address
  2. Dynamic PAT using the outside interface address
  3. Static PAT mapping TCP 443 to 10.1.1.10 Correct answer.
  4. Dynamic NAT using a pool of public addresses

Explanation

Static PAT creates a permanent one-to-one translation for a specific port, so inbound connections to 203.0.113.10 on TCP 443 are forwarded to 10.1.1.10 on the same port while other ports remain unopened. Dynamic NAT and dynamic PAT require inside-initiated traffic and cannot host an inbound service. Identity NAT leaves the address unchanged and therefore does not publish the server.

Question 31Network Security

DHCP snooping is enabled, and an access port is left in its default untrusted state. A DHCP OFFER arrives on that port from a device attached to it. What does the switch do with the OFFER?

  1. It forwards the OFFER and adds the client to the snooping binding table
  2. It forwards the OFFER but logs a syslog message
  3. It converts the OFFER into a DHCP NAK and returns it to the server
  4. It drops the OFFER received on the untrusted port Correct answer.

Explanation

Only trusted ports may carry DHCP server messages such as OFFER, ACK, and NAK; messages of those types received on an untrusted port are dropped. Binding entries are created from client messages observed on untrusted ports, not from server replies. The switch does not generate a NAK in response to a rogue server.

Question 32Network Security

A switch port must support several endpoints that authenticate independently, and new endpoints must be able to authenticate after the link has already come up. Which 802.1X host mode should be configured?

  1. Multi-host mode
  2. Single-host mode
  3. Multi-domain mode
  4. Multi-auth mode Correct answer.

Explanation

Multi-auth mode authenticates each endpoint on the port separately, so additional endpoints can open their own sessions and be authorized without disturbing existing ones. Multi-host mode authenticates only the first endpoint and then admits all others under that session. Single-host and multi-domain modes restrict the port to one or two authenticated sessions respectively.

Question 33Network Security

A Cisco ISE posture assessment shows that an endpoint has just become compliant. How does the network access device learn that it must apply a new authorization result to that endpoint's session?

  1. The endpoint sends a new EAPOL-Start after the posture change
  2. The switch waits for the next EAP session timeout to reauthenticate
  3. The switch receives a RADIUS CoA request from ISE Correct answer.
  4. The switch resets the port after receiving an SNMP trap

Explanation

A RADIUS Change of Authorization message lets ISE push a new policy decision to an already-authenticated session, and the switch then applies the new authorization attributes without a full reauthentication. The switch does not need to bounce the port or wait for a timer. This keeps the session up while the authorization result changes.

Question 34Network Security

On a Cisco ASA, which mechanism binds a traffic class to an action such as application inspection or a connection limit?

  1. A route-map referenced by the interface for policy routing
  2. An interface access-group that filters the matching packets
  3. A service policy that binds the class to an action Correct answer.
  4. A class-map that matches the traffic with match-any criteria

Explanation

Modular Policy Framework requires a class-map to identify traffic and a policy-map to define the action, and the service policy then attaches that policy-map globally or to an interface. A class-map alone only classifies traffic. Access-groups and route-maps perform filtering and forwarding decisions, not inspection configuration.

Question 35Network Security

For a site-to-site IPsec VPN between two peers, which security associations are established?

  1. A single IKE SA is created and a single IPsec SA carries traffic in both directions
  2. Two IKE SAs are created and one IPsec SA is created for each direction
  3. A single IKE SA is created and one IPsec SA is created for each direction Correct answer.
  4. Two IKE SAs are created and a single IPsec SA carries traffic in both directions

Explanation

IKE negotiates one bidirectional IKE SA that protects the control plane, and then IPsec creates two unidirectional SAs, one per direction, each with its own keys and sequence numbers. This is why the SA database shows an inbound and an outbound entry for the same tunnel. Only one IKE SA is needed because IKE messages are request/response.

Question 36Network Security

In a Cisco TrustSec deployment that uses inline tagging, where are SGACLs enforced for traffic flowing from a source in one security group to a destination in another?

  1. On the first-hop router, before the tag is inserted
  2. On the ISE Policy Service node, after the packet is mirrored
  3. On the device closest to the source, using the destination SGT
  4. On the device closest to the destination, using the source SGT Correct answer.

Explanation

Inline tagging carries the source SGT inside the frame, and the device at the egress of the TrustSec domain compares that tag with the destination tag to select and enforce the SGACL. Enforcement therefore happens as close to the destination as the tagged path allows. ISE defines the policies but does not sit in the data path.

Question 37Network Security

An administrator must complete IKEv1 phase 1 with the fewest possible messages and accepts that the peer identities will not be protected. Which mode satisfies this requirement?

  1. Quick mode, because it negotiates the IPsec SAs
  2. Aggressive mode, which uses three messages Correct answer.
  3. Extended authentication, because it runs after phase 1
  4. Main mode, because it encrypts the peer identities

Explanation

Aggressive mode completes phase 1 in three messages, but the identity payloads travel in cleartext. Main mode uses six messages and protects the identities. Quick mode belongs to phase 2, and XAUTH is an additional user-authentication step rather than a phase 1 exchange mode.

Question 38Network Security

Hosts in one VLAN must reach their default gateway but must not be able to communicate with one another, even when they are attached to different access switches in that VLAN. Which design accomplishes this?

  1. Private VLAN with isolated ports and a promiscuous port Correct answer.
  2. Dynamic ARP Inspection applied to all access ports
  3. Protected ports configured on every access switch in the VLAN
  4. A VACL that filters all peer-to-peer traffic in the VLAN

Explanation

A private VLAN places hosts on isolated secondary ports that can talk only to the promiscuous port hosting the gateway, so host-to-host traffic is blocked even across switches. Protected ports enforce the same idea but only locally on one switch. VACLs and DAI do not reliably provide isolation between hosts in the same subnet.

Question 39Network Security

A switch port is configured with authentication event fail action authorize 99, and the supplicant keeps failing authentication. What is the result on that port?

  1. The port is placed in the err-disabled state
  2. The port stays unauthorized and only EAPOL traffic is allowed
  3. The port is moved to the configured VLAN and traffic is allowed Correct answer.
  4. The client is moved to the guest VLAN and must reauthenticate

Explanation

The authentication event fail action authorize command defines a fallback VLAN that the port is placed in when authentication fails, and the port is then authorized in that VLAN. A guest VLAN is a separate feature triggered by a supplicant that never attempts 802.1X. Err-disabled behavior comes from a different configuration, such as authentication failure handling with no fallback policy.

Question 40Network Security

Two router interfaces are both assigned to the same zone in a zone-based firewall configuration. How is traffic between those two interfaces handled?

  1. It is dropped until a zone-pair is configured
  2. It is dropped by the self-zone policy
  3. It is routed without any zone-pair inspection Correct answer.
  4. It is inspected by the class-default policy of the zone

Explanation

Zone-based firewall policy is applied only between different zones, so interfaces inside the same zone are not subject to zone-pair inspection and traffic between them is routed normally. A zone pair must reference two different zones. The self zone applies to traffic destined to or sourced from the router itself.

Question 41Cloud Security

According to NIST SP 800-145, which of the following is one of the five essential characteristics of cloud computing?

  1. Measured service with metered billing Correct answer.
  2. Mandatory hardware security modules
  3. Regional data residency guarantees
  4. Dedicated physical hosts per tenant

Explanation

NIST defines five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Metered billing is how measured service is normally delivered in practice. Dedicated hosts, HSMs, and residency commitments are optional design choices rather than defining traits.

Question 42Cloud Security

A development team deploys only application code and configuration while the provider supplies the operating system, runtime, and middleware. Which service model does this describe?

  1. Software as a Service
  2. Desktop as a Service
  3. Platform as a Service Correct answer.
  4. Infrastructure as a Service

Explanation

In Platform as a Service the provider manages the stack below the application, leaving the customer responsible for code, configuration, and data. Infrastructure as a Service leaves OS management with the customer, while Software as a Service delivers a finished application the customer merely consumes.

Question 43Cloud Security

Under the shared responsibility model for Infrastructure as a Service, which task belongs to the customer?

  1. Maintaining the physical hypervisor
  2. Securing the data center building
  3. Curating the provider's OS images
  4. Patching the guest operating system Correct answer.

Explanation

In IaaS the provider secures facilities, hardware, and the virtualization layer, while the customer is responsible for everything from the guest operating system upward, including patching, hardening, and data protection. The dividing line sits at the hypervisor.

Question 44Cloud Security

Cisco Umbrella makes its initial security decision at which point in the connection path?

  1. Disk-level encryption
  2. DNS resolution Correct answer.
  3. Layer 2 switching decisions
  4. SMTP relay inspection

Explanation

Umbrella intercepts DNS queries and resolves them through its global network, blocking malicious or disallowed domains before any IP connection is opened. This blocks threats at the earliest possible point and requires no inline appliance at the branch or endpoint.

Question 45Cloud Security

Which Cisco product is an API-based cloud access security broker that discovers sanctioned SaaS usage and sensitive data exposure?

  1. Cisco Secure Network Analytics
  2. Cisco Cloudlock Correct answer.
  3. Cisco Secure Workload
  4. Cisco Defense Orchestrator

Explanation

Cloudlock, Cisco's cloud security offering, connects out-of-band to SaaS APIs to enumerate applications, users, and shared content, then applies policy and data loss prevention rules. Because it works through APIs, it does not sit inline in the traffic path.

Question 46Cloud Security

Which statement about Amazon VPC security groups is accurate?

  1. They are stateless and require explicit return rules
  2. They can contain explicit deny rules for source IPs
  3. They evaluate numbered rules in order until a match
  4. They are stateful and permit return traffic automatically Correct answer.

Explanation

Security groups are stateful, so response traffic for an already permitted flow is allowed automatically without a matching rule. They support allow rules only, and all rules are evaluated before a decision is made rather than stopping at the first match.

Question 47Cloud Security

What is the primary role of a SAML assertion in cloud single sign-on?

  1. It signs the TLS certificate of the load balancer
  2. It encrypts objects stored in the provider's bucket
  3. It carries identity claims from an IdP to a service provider Correct answer.
  4. It defines the virtual network address plan

Explanation

A SAML assertion is a signed XML statement issued by an identity provider that carries authentication status and attribute claims to a service provider. This lets the application trust the IdP's authentication instead of maintaining separate credentials.

Question 48Cloud Security

Cisco Duo is primarily used to provide which capability?

  1. Configuration backup of firewall appliances
  2. Inline file detonation and sandboxing
  3. Multi-factor authentication and device trust signals Correct answer.
  4. Network address translation for cloud VPCs

Explanation

Duo verifies user identity with multi-factor authentication and evaluates device health, feeding that context into access decisions for VPN, applications, and zero trust policies. The result is stronger proof of who and what is requesting access.

Question 49Cloud Security

A company wants Umbrella to inspect the URL path of a request only when the destination domain is suspicious but not known to be malicious. Which capability performs this?

  1. Selective proxying of risky domains for URL inspection Correct answer.
  2. Always-on proxying of every HTTP request
  3. Static file signature scanning at the resolver
  4. Full inline TLS break-and-inspect of all traffic

Explanation

The Umbrella intelligent proxy selectively proxies requests to domains that are neither clearly malicious nor clearly benign, enabling URL-level inspection without forcing all web traffic through the proxy. This keeps performance overhead low while still covering uncertain destinations.

Question 50Cloud Security

Which Cisco platform builds application dependency maps and enforces micro-segmentation policy for workloads across data centers and clouds?

  1. Cisco Umbrella
  2. Cisco Secure Workload Correct answer.
  3. Cisco Secure Firewall Management Center
  4. Cisco Duo

Explanation

Secure Workload, formerly Tetration, collects flow telemetry from software agents and network sensors, maps application dependencies, and generates allow-list segmentation policy that can span on-premises, public cloud, and Kubernetes workloads.