Cisco SCOR 350-701 flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

Model of three security goals: confidentiality protects data from unauthorized disclosure, integrity ensures data is unaltered, and availability ensures systems remain accessible to authorized users.

Risk

The combination of the likelihood that a threat exploits a vulnerability and the resulting business impact. Risk is reduced by applying controls that lower likelihood or impact.

Multi-factor authentication

Authentication requiring two or more distinct factor types from knowledge, possession, and inherence. Two passwords are not MFA because both are the same factor type.

Digital signature

A cryptographic value created with the sender's private key and verified with the public key. It proves integrity and origin and provides non-repudiation.

AAA framework

Authentication proves identity, authorization determines permitted actions, and accounting records activity for audit. RADIUS and TACACS+ implement AAA for network devices.

Stateful inspection

A firewall maintains a session table tracking connection state, automatically permitting return traffic for established flows. Stateless ACLs cannot verify return traffic belongs to an existing session.

IPsec tunnel mode

Mode that encrypts and encapsulates the entire original IP packet inside a new IP header. Used for site-to-site VPNs where gateways protect traffic between networks.

IKE Phase 1

Negotiates the ISAKMP security association: peer authentication, encryption, hashing, and Diffie-Hellman group. It builds a secure channel for later IPsec SA negotiation.

DMZ

A segmented network zone holding internet-facing services, isolated from the internal network by firewall policy. Compromise of a DMZ host does not grant direct internal access.

Security zone

A logical grouping of interfaces sharing a trust level. Firewall policy controls traffic between zones, and inter-zone traffic is denied by default on ASA and FTD.

NGFW

Next-generation firewall combining stateful inspection with application identification, intrusion prevention, URL filtering, and TLS decryption for deeper control than L3/L4 filtering.

Shared responsibility model

Cloud security split where the provider secures infrastructure, networking, and physical facilities, while the customer secures data, identities, configurations, and access policies.

CASB

Cloud Access Security Broker positioned between users and cloud services to discover shadow IT, enforce policy, and apply data loss prevention and access controls.

Cisco Umbrella

Cloud-delivered security platform that blocks malicious destinations at the DNS layer before connections establish, plus secure web gateway and firewall capabilities.

Zero trust

Security model that grants no implicit trust based on network location. Every request is authenticated and authorized using identity, device, and context signals.

Identity federation

Trust relationship letting an identity provider assert user identity to service providers via standards such as SAML 2.0 or OIDC, avoiding separate credentials per application.

Cloud encryption at rest

Protecting stored cloud data with provider key management services or customer-managed keys, so unauthorized access to storage media does not expose plaintext data.

Cisco ESA

Email Security Appliance that filters inbound and outbound mail using sender reputation, antivirus, anti-spam, content filters, and outbreak intelligence to block phishing and malware.

SPF DKIM DMARC

Email authentication trio: SPF authorizes sending IPs, DKIM cryptographically signs messages, and DMARC sets policy and reporting based on SPF and DKIM alignment.

TLS decryption

Firewall function that intercepts encrypted sessions, presents a trusted certificate to the client, and inspects plaintext for threats. Requires distributing a trusted CA certificate.

Data loss prevention

Content inspection that classifies sensitive data such as PII, PCI, or PHI and blocks, quarantines, or logs transfers that violate policy.

Transparent proxy

Deployment where network devices redirect client web traffic to the proxy without client configuration, unlike explicit proxy which requires clients to be configured.

Cisco Secure Endpoint

Endpoint agent combining antivirus, exploit prevention, file reputation, and cloud analytics to detect and block malware and malicious behavior on hosts.

EDR

Endpoint detection and response continuously records process, file, and network telemetry, enabling threat hunting, retrospective analysis, and rapid containment of compromised hosts.

Network isolation

Containment action that cuts an endpoint off from the network while preserving management channel connectivity, stopping lateral movement while allowing investigation.

Application allowlisting

Control that permits execution only of explicitly approved binaries, blocking unknown or malicious executables by default. Stricter than blocklisting known-bad signatures.

802.1X

Port-based access control with three roles: supplicant client, authenticator switch or wireless controller, and authentication server such as Cisco ISE using RADIUS.

EAP-TLS

EAP method using mutual certificate authentication between client and server. Considered strongest because it requires certificates on both sides and no password.

MAB

MAC Authentication Bypass authenticates devices lacking an 802.1X supplicant by using the MAC address as identity. Weak alone because MAC addresses can be spoofed.

TrustSec SGT

Cisco segmentation using Security Group Tags applied to traffic and SGACLs enforcing role-based policy regardless of IP address or subnet.

Posture assessment

Compliance check verifying endpoint conditions such as antivirus status and patch level before granting full network access, often remediating noncompliant devices into a limited VLAN.

NetFlow

Cisco flow export technology that summarizes traffic as metadata records of source, destination, ports, and byte counts, enabling scalable traffic analysis without full packet capture.

Encrypted Traffic Analytics

Cisco capability that identifies malware in encrypted flows using flow metadata and TLS handshake features, without decrypting traffic or breaking privacy.