I85PREP
⌘ K
Cisco SCOR 350-701 study materials
Cisco SCOR 350-701 study resources

Cisco SCOR 350-701 practice questions

One question at a time. Build your Cisco SCOR 350-701 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Concepts

Which security concept describes the assurance that data has not been altered in transit or at rest by an unauthorized party?

  1. Availability
  2. Confidentiality
  3. Non-repudiation
  4. Integrity Correct answer.

Explanation

Integrity guarantees that data remains accurate and unmodified except by authorized processes, and it is typically enforced with hashing, digital signatures, and checksums. Confidentiality hides data from unauthorized readers, availability keeps resources reachable, and non-repudiation prevents denial of an action.

Question 2Security Concepts

A company wants a mathematical technique that allows two parties to establish a shared secret over an untrusted network without prior shared secrets. Which mechanism should be selected?

  1. HMAC-SHA-256
  2. Diffie-Hellman key exchange Correct answer.
  3. RSA digital signature
  4. AES-GCM encryption

Explanation

Diffie-Hellman is a key agreement algorithm that lets two parties derive a common secret over an insecure channel without exchanging the secret itself. It is the standard building block for forward-secret TLS key exchange, while signatures, HMAC, and symmetric ciphers serve different purposes.

Question 3Security Concepts

Which statement best distinguishes symmetric from asymmetric encryption in enterprise deployments?

  1. Symmetric keys are always longer than asymmetric keys of equivalent strength
  2. Symmetric encryption requires a PKI, whereas asymmetric encryption does not
  3. Symmetric provides non-repudiation by default, whereas asymmetric cannot support signatures
  4. Symmetric uses one shared key for both directions, whereas asymmetric uses a public/private key pair Correct answer.

Explanation

Symmetric algorithms such as AES use a single shared secret for encryption and decryption, making them fast but requiring secure key distribution. Asymmetric algorithms such as RSA or ECC use a public key to encrypt or verify and a private key to decrypt or sign, which also enables digital signatures and key exchange.

Question 4Security Concepts

An administrator needs a certificate-based identity check that validates the full chain to a trusted root and confirms the certificate has not been revoked. Which two mechanisms are combined for this purpose?

  1. Symmetric key wrapping and rotation
  2. PKI trust chain validation and OCSP or CRL checking Correct answer.
  3. TLS session resumption and SNI
  4. Password hashing and salting

Explanation

PKI validates a certificate by building a chain from the leaf through intermediates to a trusted root CA and verifying signatures along the way. Revocation status is then checked using OCSP or a CRL so that certificates revoked before expiry are rejected.

Question 5Security Concepts

Which hashing property is essential when a hash is used to verify that a downloaded file has not been tampered with?

  1. Salting
  2. Reversibility
  3. Collision resistance Correct answer.
  4. Key escrow

Explanation

Collision resistance ensures an attacker cannot find two different files producing the same hash, which is what lets a published digest reliably identify a specific file. Salting and key escrow relate to password storage and key management, and hashes are by design not reversible.

Question 6Security Concepts

Which Cisco solution provides network access control by enforcing identity-based policy on wired and wireless endpoints before they gain full network access?

  1. Cisco Identity Services Engine Correct answer.
  2. Cisco AnyConnect Network Visibility Module
  3. Cisco Secure Firewall Management Center
  4. Cisco Umbrella

Explanation

Cisco ISE is the policy decision and enforcement platform for 802.1X, MAB, and posture assessment, applying authorization profiles based on identity and device context. Umbrella provides DNS-layer security, FMC manages firewalls, and the NVM only collects endpoint telemetry.

Question 7Security Concepts

Which IEEE standard defines port-based network access control using EAP over LAN, commonly implemented with Cisco ISE?

  1. IEEE 802.11ax
  2. IEEE 802.1Q
  3. IEEE 802.3ad
  4. IEEE 802.1X Correct answer.

Explanation

IEEE 802.1X defines port-based access control in which a supplicant authenticates through an authenticator to an authentication server before the port is authorized. The other standards address VLAN tagging, wireless LAN, and link aggregation respectively.

Question 8Security Concepts

In an 802.1X deployment, which component acts as the authenticator?

  1. The switch port that relays EAP messages to the authentication server Correct answer.
  2. The certificate authority that issues server certificates
  3. The endpoint supplicant software requesting access
  4. The RADIUS server that validates credentials

Explanation

The authenticator is the network device, such as a switch or wireless controller, that controls access to the port and relays EAP exchanges between the supplicant and the authentication server. The supplicant is the endpoint, and the RADIUS server is the authentication server.

Question 9Security Concepts

Which statement describes the difference between TACACS+ and RADIUS as AAA protocols?

  1. TACACS+ is used only for 802.1X, while RADIUS is used only for device administration
  2. RADIUS supports command authorization per privilege level, while TACACS+ does not
  3. TACACS+ uses UDP port 1812, while RADIUS uses TCP port 49
  4. TACACS+ encrypts the entire payload and separates AAA functions, while RADIUS encrypts only the password Correct answer.

Explanation

TACACS+ runs over TCP 49, encrypts the full packet body, and separates authentication, authorization, and accounting, which suits granular command authorization on network devices. RADIUS runs over UDP and encrypts only the password field, making it common for user authentication and 802.1X.

Question 10Security Concepts

Which capability is provided by Cisco TrustSec?

  1. Endpoint disk encryption with centralized recovery keys
  2. Email gateway filtering with DLP inspection
  3. Centralized DNS-layer threat blocking for roaming users
  4. Scalable group tags that enforce role-based segmentation independent of IP addressing Correct answer.

Explanation

TrustSec assigns security group tags (SGTs) to users and devices and enforces security group ACLs, allowing segmentation that follows identity rather than subnet. This simplifies policy in dynamic environments where IP addresses change frequently.

Question 11Security Concepts

A security architect wants to limit lateral movement inside a data center by placing workloads in isolated logical networks with policy enforced between them. Which design principle is being applied?

  1. Implicit trust between internal hosts
  2. Flat network design
  3. Microsegmentation Correct answer.
  4. Perimeter-only defense

Explanation

Microsegmentation applies fine-grained policy between individual workloads or small groups so that a compromised host cannot freely reach peers. Flat designs and perimeter-only models assume internal traffic is trusted, which enables lateral movement after a breach.

Question 12Security Concepts

Which term describes a network architecture in which every access request is authenticated and authorized regardless of whether the user is on-premises or remote?

  1. Zero Trust Correct answer.
  2. Defense in depth
  3. Least privilege
  4. Separation of duties

Explanation

Zero Trust removes the assumption that internal networks are safe and requires continuous verification of identity and device context for every request. Defense in depth, least privilege, and separation of duties are supporting principles rather than the overarching architecture.

Question 13Security Concepts

Which element of a Zero Trust architecture evaluates context such as user identity, device posture, and location to decide whether to grant access?

  1. Certificate revocation list
  2. Policy Decision Point Correct answer.
  3. Syslog collector
  4. Data plane enforcement node

Explanation

The policy decision point evaluates access requests against policy using identity, device, and environmental context, then instructs enforcement points to allow or deny. Enforcement nodes apply decisions, while CRLs and syslog collectors are supporting infrastructure.

Question 14Security Concepts

Which Cisco product delivers DNS-layer security by resolving queries through a cloud service that blocks malicious domains before a connection is made?

  1. Cisco Umbrella Correct answer.
  2. Cisco Secure Network Analytics
  3. Cisco ISE
  4. Cisco Secure Email

Explanation

Cisco Umbrella forwards DNS queries to a cloud resolver that blocks domains associated with malware, phishing, or policy violations before any IP connection occurs. This protects users on and off the corporate network without requiring a VPN.

Question 15Security Concepts

An organization wants to detect command-and-control traffic by analyzing NetFlow records for beaconing behavior. Which telemetry source are they using?

  1. Email header metadata
  2. Network flow data Correct answer.
  3. Endpoint process telemetry
  4. Full packet capture

Explanation

NetFlow and similar flow records summarize connection metadata such as source, destination, bytes, and timing, which is well suited to spotting periodic beaconing patterns. Full packet capture provides payload detail but is far more storage intensive, and endpoint and email telemetry cover different layers.

Question 16Security Concepts

Which security control best mitigates the risk of credential reuse across multiple services after one service is breached?

  1. Storing credentials in a shared spreadsheet
  2. Multi-factor authentication combined with unique per-service credentials Correct answer.
  3. Password rotation every 30 days for all users
  4. Longer password maximum length settings

Explanation

Unique credentials per service prevent a breach at one provider from unlocking others, and MFA adds a factor that a stolen password alone cannot satisfy. Rotation without uniqueness and shared storage both increase exposure.

Question 17Security Concepts

Which attack involves an adversary inserting themselves between two parties to intercept or modify traffic?

  1. On-path attack Correct answer.
  2. Privilege escalation
  3. Cross-site scripting
  4. SQL injection

Explanation

An on-path attack, formerly called man-in-the-middle, positions the attacker between communicating parties so traffic can be read or altered. SQL injection and cross-site scripting target application inputs, and privilege escalation raises an attacker's rights on a host.

Question 18Security Concepts

Which characteristic most strongly suggests that observed activity is an advanced persistent threat rather than opportunistic malware?

  1. Rapid encryption of files across all hosts on a network
  2. Mass scanning of random internet addresses for open ports
  3. Sustained low-and-slow access with custom tooling and specific objectives Correct answer.
  4. A single failed login attempt from a known bad IP address

Explanation

APTs are characterized by long dwell time, stealthy lateral movement, custom malware, and a defined mission, often tied to espionage or data theft. Ransomware outbreaks, broad scanning, and isolated failed logins are typical of commodity or opportunistic activity.

Question 19Security Concepts

Which threat intelligence source is considered most trustworthy for blocking known malicious domains in production?

  1. A list of domains compiled from an anonymous forum post
  2. Domains observed in a single honeypot over one hour
  3. A curated feed with confidence scoring and regular updates from a reputable provider Correct answer.
  4. User-submitted reports without validation

Explanation

Effective threat intelligence requires provenance, confidence scoring, and timely updates to limit false positives that would disrupt business traffic. Unverified forum lists, single-source observations, and unvalidated submissions lack the reliability needed for enforcement.

Question 20Security Concepts

Which protocol should be used to securely transfer threat intelligence indicators between platforms in a standardized format?

  1. FTP with plaintext authentication
  2. SNMPv2c traps
  3. Telnet with syslog
  4. TAXII over HTTPS with STIX-formatted content Correct answer.

Explanation

TAXII defines a secure transport for exchanging cyber threat intelligence, and STIX provides the structured data model for indicators, observables, and relationships. Using HTTPS protects the exchange, whereas the other options are insecure or not designed for intelligence sharing.

Question 21Security Concepts

Which practice supports compliance with data protection regulations by ensuring data is only kept as long as necessary?

  1. Disabling audit logging to save storage
  2. Continuous packet capture of all traffic
  3. Granting all administrators permanent access
  4. Data retention and disposal policy Correct answer.

Explanation

A retention and disposal policy defines how long each data class is kept and how it is securely destroyed, which is a common regulatory requirement. Unlimited capture, standing access, and disabled logging all increase exposure and complicate compliance.

Question 22Security Concepts

Which data classification label typically applies to information whose disclosure would cause severe harm and is restricted to a small, named group?

  1. Restricted Correct answer.
  2. Decommissioned
  3. Internal
  4. Public

Explanation

Restricted data is limited to specific authorized individuals because disclosure would cause serious damage to the organization or individuals. Public data is freely shareable, internal data is broadly available inside the organization, and decommissioned describes lifecycle state rather than sensitivity.

Question 23Security Concepts

A SOC wants to correlate endpoint, network, and identity events to detect multi-stage attacks. Which capability is most important in the selected platform?

  1. Storing logs in separate unindexed files per source
  2. Manual review of each raw log line
  3. Cross-source event correlation with normalized timestamps and entity context Correct answer.
  4. Alerting only on individual signature matches

Explanation

Detecting multi-stage attacks requires joining events across sources using normalized time and shared entity identifiers such as user or host, so related activity can be linked into a single incident. Isolated signature alerts and manual log review cannot scale to cross-domain correlation.

Question 24Security Concepts

Which control reduces the impact of a compromised endpoint by limiting what the malware can reach on the network?

  1. Disabling endpoint logging
  2. Using a single flat VLAN for all devices
  3. Network segmentation with least-privilege firewall rules Correct answer.
  4. Increasing local disk capacity

Explanation

Segmentation combined with least-privilege rules restricts east-west traffic so an infected host cannot reach unrelated systems, containing the blast radius. Disk capacity, disabled logging, and flat VLANs do not limit reachability and may worsen detection.

Question 25Security Concepts

An engineer is comparing a stateful firewall with a stateless ACL on a Cisco router. Which statement is accurate?

  1. A stateful firewall cannot perform NAT, while an ACL can
  2. A stateless ACL tracks TCP sessions, while a stateful firewall evaluates each packet in isolation
  3. Both mechanisms inspect application-layer payloads by default
  4. A stateful firewall tracks connection state and can permit return traffic automatically, while a stateless ACL must explicitly allow it Correct answer.

Explanation

Stateful inspection maintains a session table so return traffic for an allowed flow is permitted without a mirrored rule, whereas a stateless ACL evaluates every packet independently and needs explicit entries in both directions. Application inspection and NAT are separate features from the stateful versus stateless distinction.

Question 26Security Concepts

Which Cisco security architecture framework is built on the principle of never trusting and always verifying, and is designed to secure access regardless of where users or devices are located?

  1. Cisco TrustSec
  2. Cisco Zero Trust Correct answer.
  3. Cisco SecureX
  4. Cisco SAFE

Explanation

Cisco Zero Trust is the framework that assumes no implicit trust and continuously verifies every access request based on identity, device posture, and context. It aligns with the NIST Zero Trust Architecture and is a core concept in the SCOR exam. The other options are either a security reference architecture (SAFE), a segmentation technology (TrustSec), or a platform for integration (SecureX).

Question 27Security Concepts

Which Cisco product provides a cloud-delivered secure web gateway that enforces acceptable use policies and blocks access to malicious or inappropriate websites for roaming users?

  1. Cisco Identity Services Engine (ISE)
  2. Cisco Umbrella Correct answer.
  3. Cisco Firepower Next-Generation Firewall
  4. Cisco Stealthwatch

Explanation

Cisco Umbrella is a cloud-delivered secure web gateway that provides DNS-layer security, URL filtering, and cloud firewall capabilities to protect users regardless of location. It is a key component of Cisco's SASE offering. The other options are an on-premises NGFW, a policy engine for network access control, and a network traffic analysis tool.

Question 28Security Concepts

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

  1. Ransomware Correct answer.
  2. Trojan horse
  3. Rootkit
  4. Worm

Explanation

Ransomware is a category of malware that encrypts data and holds it for ransom, often demanding cryptocurrency payment. It is a major threat vector covered in the SCOR exam. The other options describe different malware behaviors: Trojans disguise themselves as legitimate software, worms self-propagate across networks, and rootkits hide privileged access.

Question 29Security Concepts

Which security concept refers to the practice of granting users only the permissions they need to perform their job functions and no more?

  1. Principle of least privilege Correct answer.
  2. Defense in depth
  3. Separation of duties
  4. Zero trust

Explanation

The principle of least privilege states that users, processes, and systems should be given the minimum levels of access necessary to perform their required tasks. This reduces the attack surface and limits the impact of a compromise. Separation of duties divides critical tasks among multiple people, defense in depth layers controls, and zero trust is a broader architectural model.

Question 30Security Concepts

Which Cisco solution uses security group tags (SGTs) to enforce policy based on user and device identity without requiring traditional IP-based ACLs?

  1. Cisco Firepower
  2. Cisco TrustSec Correct answer.
  3. Cisco AnyConnect
  4. Cisco Umbrella

Explanation

Cisco TrustSec provides software-defined segmentation by assigning security group tags (SGTs) to users and devices, and enforcing policies based on those tags rather than IP addresses. This simplifies policy management and enables consistent enforcement across the network. Umbrella is a cloud security service, Firepower is an NGFW platform, and AnyConnect is a VPN client.

Question 31Security Concepts

Which protocol is commonly used to provide secure encrypted communication for remote access VPNs and is often associated with Cisco AnyConnect?

  1. PPTP
  2. GRE
  3. IPsec
  4. SSL/TLS Correct answer.

Explanation

SSL/TLS is the foundation for clientless and client-based remote access VPNs, including Cisco AnyConnect, because it can traverse firewalls and NAT devices easily. IPsec is also used for VPNs but is more common for site-to-site and requires different configuration. GRE is a tunneling protocol without built-in encryption, and PPTP is an obsolete, insecure protocol.

Question 32Security Concepts

Which type of firewall maintains a state table to track the state of network connections and allows return traffic for established sessions?

  1. Stateful firewall Correct answer.
  2. Proxy firewall
  3. Stateless packet filter
  4. Next-generation firewall

Explanation

A stateful firewall tracks the state of active connections and automatically permits return traffic for sessions that were initiated from inside the network, without requiring explicit rules for each direction. A stateless packet filter examines each packet in isolation. A proxy firewall operates at the application layer, and an NGFW includes stateful inspection plus additional features.

Question 33Security Concepts

Which security principle states that a system should continue to function correctly and protect sensitive data even when an individual component fails or is compromised?

  1. Fail secure Correct answer.
  2. High availability
  3. Fault tolerance
  4. Fail open

Explanation

Fail secure is a design principle where, upon failure, a system defaults to a secure state that denies access rather than allowing it. This ensures that a failure does not inadvertently expose resources. Fail open is the opposite, high availability focuses on uptime, and fault tolerance is about continuing operation despite failures.

Question 34Security Concepts

Which Cisco ISE feature allows an organization to enforce endpoint compliance by checking for antivirus, patch level, and other posture conditions before granting network access?

  1. BYOD onboarding
  2. Profiling
  3. Posture assessment Correct answer.
  4. Guest access

Explanation

Posture assessment in Cisco ISE evaluates the security state of endpoints, such as whether antivirus is running and patches are current, and can restrict access until conditions are met. Profiling identifies device types, guest access provides limited access for visitors, and BYOD onboarding automates device registration. Posture is the specific feature for compliance checks.

Question 35Security Concepts

A network administrator wants to ensure that only company-issued laptops with up-to-date antivirus can access the corporate wireless network. Which combination of Cisco ISE features should be used?

  1. MAC authentication bypass with profiling
  2. Web authentication with device registration
  3. 802.1X authentication with posture assessment Correct answer.
  4. Guest portal with sponsor approval

Explanation

802.1X provides identity-based authentication, and posture assessment checks the endpoint's compliance with antivirus and other policies. Together they ensure that only authenticated and compliant devices gain access. MAB with profiling is less secure and does not enforce posture, guest portal is for visitors, and web authentication does not assess posture.

Question 36Security Concepts

Which statement accurately describes the role of the Cisco Identity Services Engine (ISE) in a network?

  1. It provides secure web gateway services for web filtering.
  2. It functions as a firewall that inspects traffic and blocks intrusions.
  3. It acts as a policy decision point that evaluates identity and context to enforce access policies. Correct answer.
  4. It is a SIEM platform that correlates logs from multiple sources.

Explanation

Cisco ISE is a policy decision point (PDP) that uses identity, device posture, and other context to make authorization decisions, which are enforced by network devices (policy enforcement points). It is not a firewall, web gateway, or SIEM. This distinction is fundamental to understanding NAC architectures.

Question 37Security Concepts

Which protocol is used by Cisco TrustSec to carry security group tags (SGTs) within a packet?

  1. 802.1Q
  2. Cisco Metadata (CMD) Correct answer.
  3. GRE
  4. IPsec

Explanation

Cisco TrustSec uses Cisco Metadata (CMD) to embed the SGT and other metadata into packets, allowing enforcement devices to apply policies based on the tag. 802.1Q is for VLAN tagging, GRE is a tunneling protocol, and IPsec provides encryption. CMD is the specific encapsulation for SGT propagation.

Question 38Security Concepts

In a Cisco SD-WAN deployment, which component is responsible for enforcing security policies at the branch and can include features like intrusion prevention and URL filtering?

  1. Cisco vBond
  2. Cisco IOS XE SD-WAN Security Correct answer.
  3. Cisco vSmart
  4. Cisco vManage

Explanation

Cisco IOS XE SD-WAN Security provides integrated security features such as IPS, URL filtering, and advanced malware protection directly on the WAN edge routers. vManage is the management plane, vSmart is the control plane, and vBond is the orchestration plane. Security enforcement happens at the data plane with the IOS XE security stack.

Question 39Security Concepts

Which cloud security model places the responsibility for securing the physical infrastructure, hypervisor, and underlying network on the cloud provider, while the customer is responsible for securing the guest operating system and applications?

  1. Infrastructure as a Service (IaaS) Correct answer.
  2. Function as a Service (FaaS)
  3. Software as a Service (SaaS)
  4. Platform as a Service (PaaS)

Explanation

In IaaS, the cloud provider manages the physical infrastructure, hypervisor, and network, while the customer manages the guest OS, middleware, and applications. In PaaS, the provider also manages the OS and runtime, and in SaaS, the provider manages nearly everything. FaaS is a subset of PaaS. The question describes the IaaS shared responsibility model.

Question 40Security Concepts

Which Cisco security product provides visibility into network traffic and uses behavioral analysis to detect threats such as command-and-control communication and data exfiltration?

  1. Cisco ISE
  2. Cisco AMP for Endpoints
  3. Cisco Umbrella
  4. Cisco Stealthwatch Correct answer.

Explanation

Cisco Stealthwatch (now part of Cisco Secure Network Analytics) collects NetFlow and other telemetry to detect anomalous behavior like C2 traffic and data exfiltration. Umbrella provides DNS and web security, ISE provides identity-based access control, and AMP for Endpoints protects endpoints. Stealthwatch is the network traffic analysis tool.

Question 41Security Concepts

Which type of attack involves an attacker attempting to guess or crack passwords by trying many possible combinations rapidly?

  1. Cross-site scripting
  2. Brute-force attack Correct answer.
  3. Phishing
  4. SQL injection

Explanation

A brute-force attack systematically tries many passwords or passphrases with the hope of eventually guessing correctly. Phishing is a social engineering attack, SQL injection targets databases, and cross-site scripting targets web applications. Brute force is specifically about password guessing.

Question 42Security Concepts

Which security control is designed to detect and block malicious traffic by analyzing packet contents and comparing them against known attack signatures?

  1. Stateful firewall
  2. Virtual private network (VPN)
  3. Access control list (ACL)
  4. Intrusion prevention system (IPS) Correct answer.

Explanation

An IPS inspects packet payloads and compares them to signatures of known attacks, and can block malicious traffic in real time. A stateful firewall tracks connections but does not deeply inspect payloads for signatures. VPNs provide secure tunnels, and ACLs filter based on IP addresses and ports. IPS is the signature-based detection and prevention technology.

Question 43Security Concepts

Which Cisco solution provides endpoint protection by continuously monitoring for malicious behavior and offering retrospective security to detect stealthy threats?

  1. Cisco AMP for Endpoints Correct answer.
  2. Cisco TrustSec
  3. Cisco Umbrella
  4. Cisco Firepower

Explanation

Cisco AMP for Endpoints (now part of Cisco Secure Endpoint) provides continuous monitoring, behavioral analysis, and retrospective security to identify and contain advanced threats. Umbrella is a cloud security gateway, Firepower is an NGFW, and TrustSec is for segmentation. AMP is the endpoint-focused solution.

Question 44Security Concepts

Which security concept involves dividing a network into smaller segments to limit the spread of an attack and reduce the attack surface?

  1. Network address translation
  2. Quality of service
  3. Load balancing
  4. Network segmentation Correct answer.

Explanation

Network segmentation divides a network into isolated segments, often based on function or trust level, to contain breaches and limit lateral movement. NAT translates IP addresses, QoS prioritizes traffic, and load balancing distributes traffic. Segmentation is a key defense-in-depth strategy.

Question 45Security Concepts

Which Cisco security architecture provides a framework for designing and deploying security controls across the entire network, including the edge, branch, data center, and cloud?

  1. Cisco Zero Trust
  2. Cisco TrustSec
  3. Cisco SAFE Correct answer.
  4. Cisco SecureX

Explanation

Cisco SAFE is a security reference architecture that provides design guidance for securing all parts of the network, from branch to data center to cloud. TrustSec is a segmentation technology, Zero Trust is a principle, and SecureX is an integration platform. SAFE is the comprehensive architecture framework.

Question 46Security Concepts

An organization wants to implement a solution that provides secure internet access for remote users by enforcing DNS-layer security, URL filtering, and cloud firewall policies without requiring hardware appliances. Which Cisco solution should they choose?

  1. Cisco Firepower
  2. Cisco Umbrella Correct answer.
  3. Cisco Stealthwatch
  4. Cisco ISE

Explanation

Cisco Umbrella is a cloud-delivered security service that provides DNS-layer security, URL filtering, and cloud firewall capabilities, making it ideal for securing remote users without on-premises hardware. Firepower is an NGFW appliance, ISE is for identity-based access control, and Stealthwatch is for network traffic analysis. Umbrella is the cloud-native secure web gateway.

Question 47Security Concepts

Which security control is most effective at preventing unauthorized access to a data center by verifying the identity of users and devices before allowing connections?

  1. Data loss prevention
  2. Intrusion detection system
  3. 802.1X authentication Correct answer.
  4. Security information and event management

Explanation

802.1X is a port-based network access control standard that authenticates users and devices before granting network access, effectively preventing unauthorized access at the edge. IDS detects intrusions but does not prevent access, SIEM aggregates logs, and DLP prevents data exfiltration. 802.1X is the preventive access control.

Question 48Security Concepts

Which statement best describes the difference between symmetric and asymmetric encryption?

  1. Asymmetric encryption is faster than symmetric encryption and is used for bulk data encryption.
  2. Symmetric encryption uses the same key for encryption and decryption, while asymmetric encryption uses a public and private key pair. Correct answer.
  3. Symmetric encryption uses a public and private key pair, while asymmetric encryption uses the same key for encryption and decryption.
  4. Symmetric encryption is always more secure than asymmetric encryption.

Explanation

Symmetric encryption uses a single shared key for both encryption and decryption, making it fast and suitable for bulk data. Asymmetric encryption uses a public key to encrypt and a private key to decrypt, enabling secure key exchange and digital signatures. The other options misstate the definitions or performance characteristics.

Question 49Security Concepts

Which Cisco security technology enables the sharing of threat intelligence across multiple security products to accelerate detection and response?

  1. Cisco SecureX Correct answer.
  2. Cisco Umbrella
  3. Cisco TrustSec
  4. Cisco ISE

Explanation

Cisco SecureX is a cloud-native platform that integrates Cisco and third-party security products, enabling centralized visibility and automated threat response through shared threat intelligence. TrustSec is for segmentation, Umbrella is for DNS/web security, and ISE is for access control. SecureX is the integration and orchestration platform.

Question 50Security Concepts

In a Zero Trust architecture, which component is responsible for making dynamic access decisions based on context such as user identity, device health, and location?

  1. Identity provider (IdP)
  2. Policy decision point (PDP) Correct answer.
  3. Security operations center (SOC)
  4. Policy enforcement point (PEP)

Explanation

The policy decision point (PDP) evaluates context and makes the access decision, which is then enforced by the policy enforcement point (PEP). The IdP authenticates users but does not make authorization decisions, and the SOC monitors and responds to incidents. The PDP is the brain of the Zero Trust access decision.