Cisco SCOR 350-701 cheat sheet

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, digital signatures), Availability (redundancy, DoS protection).

Threat vs. vulnerability vs. risk: a threat is a potential cause of harm, a vulnerability is a weakness, and risk is the likelihood of exploitation multiplied by impact.

Defense in depth layers controls across administrative, technical, and physical categories so no single failure exposes the asset.

Authentication factors are knowledge (password), possession (token, certificate), and inherence (biometric); MFA requires two or more distinct factor types.

Common attack classes: phishing, on-path (MITM), DoS/DDoS, spoofing, social engineering, and password attacks such as brute force and dictionary.

Confidentiality controls include AES symmetric encryption, RSA/ECDSA asymmetric encryption, and TLS for data in transit.

Integrity uses SHA-256 hashes and HMAC; digital signatures add non-repudiation through sender private-key signing.

AAA separates Authentication (identity proof), Authorization (permission grant), and Accounting (audit logging).

Zone-based firewall design places interfaces into security zones; traffic between zones requires an explicit policy, while intra-zone traffic is denied by default on ASA/FTD.

Stateful inspection tracks connection state in a session table; stateless ACLs evaluate each packet independently and cannot verify return traffic.

Next-generation firewall (NGFW) adds application visibility (App-ID), intrusion prevention, and TLS decryption beyond L3/L4 filtering.

Site-to-site IPsec uses IKEv2 for key exchange, then ESP for encrypted payload; transport mode encrypts payload only, tunnel mode encrypts the full packet.

IPsec Phase 1 builds the ISAKMP/IKE SA (peer auth, encryption, hashing, DH group); Phase 2 builds the IPsec SA for data protection.

DMZ architecture separates internet-facing servers from internal hosts so a compromised public server cannot directly reach the internal network.

NAT/PAT translates private RFC 1918 addresses to public addresses; static NAT preserves one-to-one mapping for inbound services.

Cisco Secure Firewall Management Center (FMC) centrally manages FTD devices, policies, and event correlation.

Shared responsibility model: the provider secures the cloud infrastructure; the customer secures data, identities, configurations, and access.

IaaS, PaaS, SaaS shift control: IaaS gives most customer responsibility, SaaS gives least.

CASB sits between users and cloud services to enforce policy, discover shadow IT, and apply data loss prevention.

Cisco Umbrella provides DNS-layer security, secure web gateway, and firewall controls from a cloud-delivered platform.

Cloud Workload Protection (Cisco Secure Cloud Analytics / CWPP) addresses virtual machine and container workload security.

Zero trust assumes no implicit trust from network location; each request is authenticated and authorized by identity and context.

Cloud access control uses identity federation (SAML 2.0, OIDC) and role-based access control to enforce least privilege.

Encryption for cloud data: at rest via provider KMS or customer-managed keys, in transit via TLS 1.2+.

Cisco ESA (Email Security Appliance) filters inbound and outbound mail using reputation, antivirus, anti-spam, and content filters.

Cisco WSA (Web Security Appliance) enforces acceptable-use policy, URL filtering, and malware scanning over HTTP/HTTPS.

Cisco Umbrella DNS-layer security blocks malicious domains before a connection is established.

SPF, DKIM, and DMARC collectively authenticate sender domains and reduce spoofed email.

TLS decryption on the firewall inspects encrypted traffic; it requires a trusted CA certificate deployed to endpoints.

Data loss prevention (DLP) classifies content (PII, PCI, PHI) and blocks or quarantines policy-violating transfers.

File reputation and sandboxing (Cisco Secure Malware Analytics/Threat Grid) detect zero-day and evasive malware.

Proxy modes: explicit proxy requires client configuration; transparent proxy redirects traffic without client configuration.

Cisco Secure Endpoint (formerly AMP for Endpoints) combines antivirus, exploit prevention, and file reputation.

Endpoint detection and response (EDR) records process, file, and network telemetry for retrospective hunting and response.

Cisco SecureX unifies visibility and automates workflows across Cisco security products.

Real-time protection vs. scanning: on-access scanning blocks at execution; scheduled scans are periodic and detect dormant threats.

Signature-based detection matches known malware; behavioral/heuristic detection identifies suspicious activity patterns.

Isolation (network containment) quarantines an endpoint from the network while preserving management connectivity.

Application allowlisting permits only approved executables, blocking unknown binaries by default.

Host-based firewall and device control restrict inbound connections and peripheral (USB) usage.

802.1X port-based access control uses three roles: supplicant (client), authenticator (switch/WLC), and authentication server (RADIUS, e.g., Cisco ISE).

EAP methods: EAP-TLS uses mutual certificate authentication; PEAP and EAP-FAST use server certificate plus inner credential.

MAB (MAC Authentication Bypass) authenticates devices that cannot run a supplicant, using the MAC address as identity.

Cisco ISE enforces identity-based policy, posture assessment, and guest/device onboarding.

TrustSec uses Security Group Tags (SGT) and SGACL for role-based segmentation independent of IP subnet.

Posture assessment verifies endpoint compliance (AV, patch level) before granting full network access.

WebAuth and guest portals provide browser-based authentication for guests and BYOD.

Dynamic VLAN assignment and downloadable ACLs (dACL) are pushed to the switch after successful authentication.

NetFlow/IPFIX exports flow metadata (source, destination, ports, bytes) for traffic analysis and anomaly detection.

Cisco Stealthwatch (Secure Network Analytics) uses flow telemetry to detect behavioral anomalies and insider threats.

Full packet capture provides forensic depth, while flow data provides scalable breadth.

Syslog forwards device events to a collector; SNMP provides polling and traps for device health.

Encrypted Traffic Analytics (ETA) identifies malware in encrypted flows using flow metadata and TLS handshake features without decryption.

Enforcement points include firewall policy, ISE authorization, SGT/SGACL, and endpoint isolation.

SIEM correlates logs across sources to detect multi-stage attacks and support compliance reporting.

Network segmentation and micro-segmentation limit lateral movement and enforce least-privilege east-west traffic.