Cisco SCOR 350-701 key terms

The three core security goals: confidentiality keeps data from unauthorized readers, integrity keeps it unaltered and trustworthy, and availability keeps systems and data reachable when legitimate users need them.

The likelihood that a threat exploits a vulnerability and the resulting business impact. Security decisions weigh risk against cost, since eliminating all risk is neither possible nor affordable.

Any actor, event, or circumstance with the potential to damage assets, such as an external attacker, malicious insider, malware, or natural disaster. Distinct from the weakness the threat exploits.

A weakness in code, configuration, process, or design that a threat can exploit. Tracked with severity scores and remediated through patching, hardening, or compensating controls.

Layering independent controls so that failure of one does not expose the whole environment. A breach of the perimeter still meets segmentation, endpoint protection, identity checks, and monitoring.

A model that grants no implicit trust based on network location. Every request is authenticated, authorized, and continuously assessed using identity, device posture, and context before access is allowed.

Authentication verifies who a subject is, authorization decides what it may do, and accounting records what it did. Network devices use AAA protocols such as RADIUS and TACACS+ to delegate these functions.

A UDP-based AAA protocol widely used for network access authentication and accounting. It encrypts only the password field, so it is typically wrapped in a secure tunnel for sensitive deployments.

A TCP-based AAA protocol from Cisco that encrypts the entire payload and separates authentication, authorization, and accounting. Common for administrative device access with per-command authorization.

Port-based network access control using EAP over LAN. A supplicant authenticates through an authenticator switch or wireless controller to an authentication server before the port passes normal traffic.

Extensible Authentication Protocol, a framework carrying authentication methods between supplicant and server. Variants such as EAP-TLS use certificates, while PEAP and EAP-FAST tunnel inner methods.

MAC Authentication Bypass. Devices that cannot run an 802.1X supplicant, such as printers and cameras, are authenticated by their MAC address against a database, which is convenient but spoofable.

Cisco's policy platform for identity-based network access, profiling endpoints, enforcing authorization profiles, guest access, and device administration. It acts as the RADIUS and TACACS+ server in 802.1X designs.

Cisco's segmentation approach that tags packets with a Security Group Tag so policy can be enforced on group membership rather than IP addresses, simplifying rule sets across the network.

Checking an endpoint's compliance before or after network admission, for example verifying antivirus, patches, and disk encryption. Noncompliant devices are quarantined or given limited remediation access.

Network access control governs whether and how devices join a network. It combines authentication, endpoint profiling, posture checks, and enforcement such as VLAN assignment or access control lists.

Dividing a network into zones with controlled traffic between them, limiting lateral movement after a compromise. Implemented with VLANs, firewalls, VRFs, and security group policy.

A firewall that adds application awareness, intrusion prevention, URL filtering, and threat intelligence beyond stateful port and address filtering, letting policy identify applications regardless of port.

An inline sensor that inspects traffic against signatures and behavioral rules and can drop malicious packets in real time, unlike a passive intrusion detection system that only alerts.

An open-source signature engine used by Cisco intrusion prevention products. Rules match headers and payload patterns, and rule actions determine alerting or dropping of matching traffic.

Decrypting TLS traffic at a proxy or firewall, inspecting it for threats, then re-encrypting it. Requires certificate trust on clients and careful handling of privacy and pinned applications.

A tunnel that protects traffic between sites or remote users over untrusted networks. Site-to-site designs commonly use IPsec, while remote access may use IPsec or TLS-based clients.

A suite securing IP traffic with authentication and encryption. IKE negotiates security associations, AH provides integrity only, and ESP provides encryption plus integrity for the data path.

Dynamic Multipoint VPN. Spoke routers register with a hub over permanent tunnels and build direct spoke-to-spoke tunnels on demand, reducing hub load and latency for site-to-site traffic.

A proxy that enforces acceptable-use policy for web traffic, blocking malicious or unwanted sites, scanning downloads, and applying user and category-based rules for outbound connections.

Cloud Access Security Broker. It sits between users and cloud services to discover shadow IT, enforce policy, control data uploads, and apply data loss prevention and threat protection for SaaS use.

Secure Access Service Edge. A cloud-delivered architecture combining networking and security services such as secure web gateway, firewall as a service, CASB, and zero trust access at the edge.

The split of security duties between a cloud provider and its customer. The provider secures the physical and virtualization layers, while the customer secures identities, data, and configuration.

Cloud Security Posture Management. Tools continuously scan cloud accounts for misconfigurations such as public storage buckets or overly permissive roles, and report drift from policy baselines.

Data loss prevention inspects content in motion, at rest, and in use to detect sensitive data such as personal or financial records and block or log its unauthorized transfer.

Layered protection against phishing, malware, and spoofing. It relies on SPF, DKIM, and DMARC for sender authentication plus link and attachment sandboxing before delivery.

Blocking or logging DNS queries to known malicious domains before a connection is made. It stops many command-and-control and phishing attempts cheaply across all devices on the network.

Detonating suspicious files or URLs in an isolated environment to observe behavior, such as registry changes or callbacks, and deriving verdicts that are shared with other defenses.

Endpoint detection and response continuously records endpoint activity such as processes and network connections, then detects and enables response to suspicious behavior rather than relying only on signatures.

Endpoint protection platform. Traditional prevention software on hosts, combining antivirus, personal firewall, and application control to block known and suspicious execution before damage occurs.

Extended detection and response correlates and analyzes telemetry across endpoints, network, email, cloud, and identity to surface incidents that a single product view would miss.

Security information and event management. It centralizes logs from many sources, correlates them with rules, generates alerts, and supports investigation and compliance reporting.

The continuous data sources and sensors that feed detection and analytics, including endpoint events, firewall logs, DNS queries, and flow records. Coverage gaps directly weaken detection quality.

A Cisco standard for exporting metadata about network conversations, such as addresses, ports, byte counts, and timestamps, without payload. Useful for traffic baselining and anomaly detection.

Common Vulnerability Scoring System. A standardized 0 to 10 severity score built from exploitability and impact metrics, often adjusted for environmental factors when prioritizing remediation.