Cisco 350-701: Implementing and Operating Cisco Security Core Technologies (SCOR)

Last checked October 22, 2026 against the official Cisco exam page.

1. Question 1Network Security

   A firewall administrator needs to allow outbound web traffic only from the internal user subnet to approved destinations and block all other outbound traffic from that subnet. Which approach fits best?

   1. AAn access control policy that permits the subnet to approved destinations and denies the rest of the subnet's outbound traffic
   2. BMoving the internal user subnet to a publicly routable address range so hosts reach the internet directly, bypassing policy
   3. CA permit rule with a source and destination of 0.0.0.0/0 and an unrestricted service, placed above the deny entries
   4. DDisabling stateful inspection on the firewall so return traffic and session tracking are no longer validated against the connection table
   Show answer and explanationHide answer

   Correct answer: A

   A specific permit for approved destinations followed by a deny for the rest enforces least privilege on outbound traffic. Allow-all rules and disabling inspection weaken protection.

2. Question 2Security Concepts

   An attacker sends a crafted email that appears to come from the CEO and asks the finance team to wire funds. Which attack type is this?

   1. ABusiness email compromise phishing
   2. BStored cross-site scripting in web apps
   3. CVolumetric UDP denial of service floods
   4. DTime-based SQL injection in login forms
   Show answer and explanationHide answer

   Correct answer: A

   A spoofed executive email requesting funds is a business email compromise style phishing attack. DoS floods services, and SQL injection and XSS target applications rather than people.

3. Question 3Securing Cloud

   A company moves an application to a public cloud and wants visibility into misconfigurations and threats across cloud workloads. Which Cisco capability provides this?

   1. ACisco 9800 wireless LAN controller for managing access point radios and clients
   2. BCisco Secure Cloud Analytics or a cloud security posture solution
   3. CCisco IP phone fleet management with firmware and call profile provisioning
   4. DCisco Webex Calling Standard license with voicemail included
   Show answer and explanationHide answer

   Correct answer: B

   Cloud analytics and posture management identify threats and misconfigurations in cloud environments. Phone management, wireless controllers and calling plans do not secure cloud workloads.

4. Question 4Endpoint Protection and Detection

   An endpoint is compromised by malware that moves laterally. Which capability on the endpoint helps detect and respond to the behavior?

   1. AA desktop wallpaper policy enforced through group policy
   2. BA printer driver firmware update for the networked printers
   3. CA screensaver lock timeout of ten minutes with password on resume
   4. DEndpoint detection and response with behavioral analytics and isolation
   Show answer and explanationHide answer

   Correct answer: D

   EDR detects suspicious behaviors and can isolate the endpoint to contain spread. Screensavers, wallpapers and printer updates do not detect malicious behavior.

5. Question 5Content Security

   A company wants to block malware downloads and phishing links for all users browsing the internet, regardless of their location. Which Cisco capability enforces this?

   1. ACloud-delivered secure web gateway or DNS-layer security
   2. BCisco Catalyst access point band steering with dual-band radios
   3. CCisco IP phone voicemail with message waiting indicator lamp and PIN
   4. DCisco Catalyst switch port security with 802.1X on access interfaces
   Show answer and explanationHide answer

   Correct answer: A

   A cloud secure web gateway or DNS-layer security filters content and blocks malicious destinations for remote users too. Voicemail, switch port security and band steering do not inspect web content.