Cisco CCNP Security SCOR (350-701) Practice Exam

What the Cisco CCNP Security SCOR (350-701) exam covers

• Security Concepts196 questions
• Network Security236 questions
• Cloud Security156 questions
• Secure Service Edge141 questions
• Endpoint Protection and Detection129 questions
• Network Access, Visibility, and Enforcement142 questions

Free Cisco CCNP Security SCOR (350-701) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,000.

1. Question 1Security Concepts

   Which model assumes no implicit trust and verifies every access request?

   • AZero trustCorrect
   • BImplicit internal trust
   • CPerimeter-only trust
   • DOpen access
   ✓ Correct answer: A

   Zero trust is a security model that treats every user, device, and network segment as untrusted by default, requiring explicit verification of identity and context before granting access. Coined by Forrester and implemented in frameworks like Cisco's Zero Trust Architecture, it enforces continuous validation rather than relying on network location (inside vs. outside the perimeter) as a trust indicator.

   Why the other options are wrong

   • BImplicit internal trust is the opposite of zero trust - it assumes insiders are safe without verification, which zero trust explicitly rejects.
   • CPerimeter-only trust focuses security controls solely at the network edge, leaving internal lateral movement unchecked - a design flaw zero trust was created to address.
   • DOpen access implies no authentication or authorization controls at all, providing no security posture whatsoever.
2. Question 2Network Security

   Which interface command on a Cisco switch enables BPDU Guard so the port shuts down if a BPDU is received?

   • ASpanning-tree portfast
   • BSpanning-tree bpdufilter enable
   • CSpanning-tree bpduguard enableCorrect
   • DSpanning-tree guard root
   ✓ Correct answer: C

   BPDU Guard protects PortFast-enabled access ports from unauthorized switches being connected to the network. The interface command 'spanning-tree bpduguard enable' puts the port into err-disabled state the moment any BPDU is received, preventing an attacker or accidentally connected switch from influencing the Spanning Tree topology.

   Why the other options are wrong

   • Aspanning-tree portfast enables PortFast mode so the port transitions directly to forwarding without going through the STP listening/learning states, but it does not shut the port down on BPDU receipt - that protection requires BPDU Guard.
   • Bspanning-tree bpdufilter enable suppresses the sending and receiving of BPDUs on the port entirely, which prevents STP participation but does not err-disable the port when a BPDU arrives.
   • Dspanning-tree guard root enables Root Guard on the port, preventing the port from becoming a root port if a superior BPDU is received - it does not err-disable on any BPDU, only on superior BPDUs.
3. Question 3Network Security

   On Cisco Secure Firewall (FTD) managed by FMC, where are connection and intrusion events centrally viewed?

   • AIn the DHCP server's lease file
   • BIn the switch's MAC address table
   • CIn the FMC event viewer/analysis dashboardsCorrect
   • DIn the NTP peer list
   ✓ Correct answer: C

   Cisco Firepower Management Center (FMC) is the centralized management and analysis platform for FTD devices. All connection events, intrusion events, file and malware events, and security intelligence events generated by managed FTD sensors are forwarded to and stored on the FMC. Security analysts use the FMC's Analysis menu, dashboards, and event tables to search, filter, and correlate events across all managed devices, making it the single pane of glass for firewall and IPS visibility in an FTD deployment.

   Why the other options are wrong

   • AThe DHCP server's lease file records IP address assignment history for endpoints; it is an infrastructure log that contains no firewall connection events or intrusion detection data.
   • BThe switch's MAC address table maps Layer 2 MAC addresses to switch ports for frame forwarding; it is a dynamic forwarding table with no role in storing or displaying security events.
   • DThe NTP peer list shows the time sources a device is synchronized with; it is a clock management data structure that has no relevance to security event logging or analysis.
4. Question 4Security Concepts

   Which type of threat actor is typically motivated by financial gain and operates for-profit criminal organizations, often deploying ransomware or conducting payment-card theft?

   • AHacktivist
   • BNation-state actor
   • CCybercriminalCorrect
   • DInsider threat
   ✓ Correct answer: C

   Cybercriminals are threat actors primarily motivated by financial gain. They commonly use ransomware, banking trojans, phishing, and payment-card skimming operations. They are organized into criminal enterprises and sell access or stolen data on dark-web markets. Hacktivists are politically or ideologically motivated; nation-state actors pursue espionage or geopolitical objectives; insider threats originate from within the organization and may be malicious or accidental.

   Why the other options are wrong

   • AHacktivists are driven by political or ideological motives, not financial profit.
   • BNation-state actors focus on espionage, sabotage, or strategic objectives rather than direct financial crime.
   • DInsider threats involve current or former employees or contractors with legitimate access, a different attack vector from organized cybercrime.
5. Question 5Secure Service Edge

   A company wants to implement email encryption so that sensitive messages can be read only by the intended recipient using a web-based portal without requiring the recipient to install software. Which Cisco technology meets this requirement?

   • AS/MIME with certificate exchange
   • BCisco Registered Envelope Service (CRES) / Cisco Email EncryptionCorrect
   • CTLS-required delivery enforced via destination controls
   • DPGP key-based encryption with public key server
   ✓ Correct answer: B

   Cisco Email Encryption, powered by the Cisco Registered Envelope Service (CRES), wraps sensitive messages in an encrypted envelope and delivers a notification to the recipient. The recipient clicks a link to access the message through a secure CRES web portal, where they authenticate (registering a password on first use) and read the decrypted content. This approach requires no pre-installed software, certificate exchange, or key management by the recipient - making it suitable for communicating sensitive content to external parties such as customers, partners, or patients who do not have enterprise email security tooling. Encryption is triggered by content filters or DLP policies on the Cisco Secure Email Gateway.

   Why the other options are wrong

   • AS/MIME requires both the sender and recipient to have digital certificates installed in their email clients and to exchange public keys in advance - this creates administrative overhead and requires the recipient to install and configure certificates.
   • CTLS-required delivery (configured in destination controls on the ESA) encrypts the SMTP transport session between mail servers in transit, but it does not encrypt the message itself at rest or prevent the recipient's mail server administrator from reading the content.
   • DPGP key-based encryption requires the recipient to generate a PGP key pair, share their public key with the sender, and install PGP-capable software to decrypt messages - this is not a zero-installation web portal solution.
6. Question 6Network Security

   What is the main advantage of using IKEv2 FlexVPN for remote-access VPN compared to a legacy IKEv1 EzVPN deployment on Cisco IOS?

   • AFlexVPN provides a unified IKEv2-based framework supporting site-to-site, hub-and-spoke, and remote access with a single configuration modelCorrect
   • BFlexVPN replaces per-peer crypto maps with GRE-only tunnels that carry traffic without IPsec encapsulation
   • CFlexVPN supports only clientless SSL VPN access that is delivered to users through a standard web browser session
   • DFlexVPN requires that every spoke terminate on a separate physical hub because it cannot use dynamic tunnel interfaces
   ✓ Correct answer: A

   FlexVPN is built on IKEv2 and provides a consistent set of CLI constructs that scale across remote access, site-to-site, and dynamic hub-and-spoke (including spoke-to-spoke) topologies. This contrasts with the fragmented IKEv1 EzVPN/DMVPN/crypto-map approaches.

   Why the other options are wrong

   • BFlexVPN uses IPsec/IKEv2 for encryption over its tunnel interfaces; it does not replace crypto maps with unencrypted GRE-only tunnels.
   • CFlexVPN is an IKEv2 IPsec framework, not a clientless SSL VPN, which is a different remote-access model.
   • DFlexVPN uses dynamic virtual tunnel interfaces so many spokes terminate on one hub; it does not require a separate physical hub per spoke.
7. Question 7Cloud SecuritySelect all that apply

   A security team is designing logging for forensic readiness in a multi-account AWS organization. Which TWO practices best preserve log integrity and availability for investigations? (Choose TWO)

   • AAggregate CloudTrail logs into a dedicated, locked-down logging account separate from workload accountsCorrect
   • BEnable S3 Object Lock / log file validation on the centralized log bucketCorrect
   • CAllow each workload account's administrators full delete access to their own trails
   • DStore logs only on the same instances that generate them
   ✓ Correct answer: A, B

   A separate logging account isolates audit data from compromised workload accounts, while Object Lock (WORM) and CloudTrail log file validation prevent deletion or modification. Together they ensure forensic data survives an attacker who gains workload-account access.

   Why the other options are wrong

   • CGiving workload admins delete access to trails lets an attacker erase their tracks.
   • DStoring logs only on the generating instances means a compromised or terminated instance destroys the evidence.
8. Question 8Security Concepts

   A web application accepts a search parameter and returns a record. A penetration tester submits input that closes the intended query and appends a UNION clause, causing the backend database to return rows from an unrelated table containing password hashes. Which class of attack is demonstrated, and which control most directly prevents it at the application layer?

   • ASQL injection, prevented most directly by parameterized queries / prepared statementsCorrect
   • BCross-site scripting, prevented most directly by output encoding in the browser
   • CCross-site request forgery, prevented most directly by anti-CSRF tokens
   • DServer-side request forgery, prevented most directly by egress allow-lists
   ✓ Correct answer: A

   The attacker is breaking out of the intended SQL statement and adding their own clause, the defining behavior of SQL injection. Using parameterized queries or prepared statements ensures user input is always treated as data rather than executable SQL, which structurally prevents the injection. Input validation and least-privilege database accounts add defense in depth but do not address the root cause as directly.

   Why the other options are wrong

   • BXSS injects script that executes in a victim's browser; it does not manipulate backend SQL queries to read database tables.
   • CCSRF forces an authenticated user's browser to send unwanted requests; it does not extract data through query manipulation.
   • DSSRF coerces the server into making requests to other systems; it is unrelated to UNION-based database extraction.
9. Question 9Cloud Security

   During a design review, an architect must place four Cisco cloud security products against four needs: pre-connection domain filtering, SaaS data governance, public-cloud flow-based threat detection, and east-west workload segmentation. Which mapping is correct?

   • AUmbrella - segmentation; Cloudlock - flow detection; Secure Cloud Analytics - DNS filtering; Secure Workload - SaaS DLP
   • BUmbrella - DNS filtering; Cloudlock - SaaS data governance; Secure Cloud Analytics - flow detection; Secure Workload - segmentationCorrect
   • CUmbrella - SaaS DLP; Cloudlock - segmentation; Secure Cloud Analytics - DNS filtering; Secure Workload - flow detection
   • DUmbrella - flow detection; Cloudlock - DNS filtering; Secure Cloud Analytics - segmentation; Secure Workload - SaaS data governance
   ✓ Correct answer: B

   Each product has a distinct primary role: Umbrella filters at the DNS and internet-gateway layer, Cloudlock is an API-based CASB for SaaS data and OAuth app governance, Secure Cloud Analytics detects threats from cloud flow telemetry, and Secure Workload enforces workload microsegmentation. Only option B aligns each product with its correct function.

   Why the other options are wrong

   • AThis option scrambles every mapping, assigning each product a role it does not perform.
   • CThis option incorrectly assigns SaaS DLP to Umbrella and segmentation to Cloudlock.
   • DThis option mismatches all four, giving Umbrella flow detection and Cloudlock DNS filtering.
10. Question 10Network Access, Visibility, and Enforcement

    A wireless guest is authenticated via CWA. ISE must assign the guest into TrustSec SGT 'Guest' for downstream SGACL enforcement. The WLC supports SGT assignment via RADIUS. Which ISE authorization profile element conveys the SGT to the session?

    • BThe Security Group assignment in the authorization profile, returned via the cisco-av-pair carrying the SGTCorrect
    • AA downloadable ACL named Guest returned in the authorization profile to gate the guest's traffic
    • CA VLAN assignment in the profile that the WLC automatically translates into the matching SGT
    • DA reauthentication timer in the profile that periodically refreshes the guest's assigned security tag
    ✓ Correct answer: B

    TrustSec classification via ISE is done by selecting a Security Group in the authorization result; the NAD receives the SGT and tags the endpoint's traffic for SGACL enforcement downstream. A dACL or VLAN does not by itself carry an SGT, and ISE does not automatically derive SGTs from VLAN assignments.

    Why the other options are wrong

    • AA dACL applies ACEs to the session but does not convey a TrustSec SGT for downstream SGACL enforcement.
    • CA VLAN assignment does not automatically map to an SGT; the SGT must be explicitly returned via the Security Group assignment.
    • DA reauthentication timer only controls how often the session reauthenticates and carries no SGT information to the WLC.

Related Cisco resources

• Cisco CCNP Security SCOR (350-701) study guideKey concepts
• Cisco practice examsAll Cisco
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Cisco CCST Cybersecurity (100-160) practice examRelated
• Cisco Cybersecurity Associate (200-201 CBROPS) practice examRelated
• Cisco CCNA Automation (200-901 CCNAAUTO) practice examRelated

Cisco CCNP Security SCOR (350-701) practice exam FAQ