CertArea
All Cisco exams

Free 350-701 practice test: 30 questions with answers

30 original questions for Implementing and Operating Cisco Security Core Technologies (SCOR), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions
Real exam
120 min

350-701 exam guide: topics, cost and format

All 30 350-701 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Network Security (5 questions)

  1. Question 1

    A firewall administrator needs to allow outbound web traffic only from the internal user subnet to approved destinations and block all other outbound traffic from that subnet. Which approach fits best?

    1. AAn access control policy that permits the subnet to approved destinations and denies the rest of the subnet's outbound traffic
    2. BMoving the internal user subnet to a publicly routable address range so hosts reach the internet directly, bypassing policy
    3. CA permit rule with a source and destination of 0.0.0.0/0 and an unrestricted service, placed above the deny entries
    4. DDisabling stateful inspection on the firewall so return traffic and session tracking are no longer validated against the connection table
    Show answer and explanation
    Correct answer: A

    A specific permit for approved destinations followed by a deny for the rest enforces least privilege on outbound traffic. Allow-all rules and disabling inspection weaken protection.

  2. Question 2

    Which Cisco technology provides next-generation firewall capabilities such as application visibility, intrusion prevention, and URL filtering in one platform?

    1. ACisco Catalyst 9300 PoE access switch
    2. BCisco IP Phone 8851 conference unit
    3. CCisco Meraki MR46 wireless access point
    4. DCisco Secure Firewall (formerly Firepower)
    Show answer and explanation
    Correct answer: D

    Cisco Secure Firewall combines application control, intrusion prevention and URL filtering. The switch, access point and IP phone do not provide those firewall functions.

  3. Question 3

    An intrusion prevention system detects a known exploit attempt against a web server. What is the most effective response if the policy is set to prevention?

    1. AAllowing the traffic to pass inline while generating a passive log entry
    2. BBlocking the malicious traffic inline and generating an alert
    3. CIgnoring the event because the signature matches a known exploit
    4. DDisabling the inline sensor's prevention engine until the next review
    Show answer and explanation
    Correct answer: B

    In prevention mode, an IPS blocks the traffic inline and alerts the team. Passive logging, ignoring events and disabling sensors leave the server exposed.

  4. Question 4

    Which technology protects against network-based attacks by inspecting traffic at a Layer 7 level for web-specific threats such as SQL injection?

    1. ADHCP snooping with IP source guard enabled on access switches
    2. BWeb application firewall or application-layer inspection
    3. CRapid Spanning Tree Protocol root guard on distribution switches
    4. DPort security with sticky MAC addresses and violation shutdown
    Show answer and explanation
    Correct answer: B

    Web application firewalls and application inspection analyze HTTP content for attacks such as SQL injection. Spanning tree, DHCP snooping and port security operate at lower layers.

  5. Question 5

    Which feature in a Cisco firewall helps prevent unauthorized devices from reaching internal servers by applying policy based on user identity rather than only IP address?

    1. AJumbo frames with a larger maximum transmission unit on the data center uplink interfaces
    2. BLACP link aggregation on trunk ports to both upstream core switches
    3. CStatic NAT mappings translating internal server addresses to public IPs
    4. DIdentity-based access control policy integrated with directory or identity services
    Show answer and explanation
    Correct answer: D

    Identity-based policies apply access controls based on users or groups, which is more precise than IP rules alone. NAT, jumbo frames and link aggregation do not provide identity-based control.

Security Concepts (5 questions)

  1. Question 6

    An attacker sends a crafted email that appears to come from the CEO and asks the finance team to wire funds. Which attack type is this?

    1. ABusiness email compromise phishing
    2. BStored cross-site scripting in web apps
    3. CVolumetric UDP denial of service floods
    4. DTime-based SQL injection in login forms
    Show answer and explanation
    Correct answer: A

    A spoofed executive email requesting funds is a business email compromise style phishing attack. DoS floods services, and SQL injection and XSS target applications rather than people.

  2. Question 7

    Which security principle requires that users and systems have only the access needed to perform their tasks?

    1. ASecurity through obscurity
    2. BLeast privilege
    3. CDefense in depth with open defaults
    4. DAvailability first
    Show answer and explanation
    Correct answer: B

    Least privilege limits access to the minimum required. Obscurity and open defaults weaken security, and availability is a separate goal.

  3. Question 8

    Which cryptographic technique verifies that a message was not altered in transit and came from the holder of a private key?

    1. AA digital signature
    2. BA hash with no key
    3. CA symmetric cipher with a shared key only
    4. DA random number generator
    Show answer and explanation
    Correct answer: A

    A digital signature proves origin and integrity using asymmetric keys. A plain hash alone does not prove origin, and a shared-key cipher does not provide non-repudiation. Random numbers are not verification methods.

  4. Question 9

    Which term describes a vulnerability that is exploited by attackers before a vendor releases a fix?

    1. APatch window
    2. BBaseline configuration
    3. CZero-day vulnerability
    4. DKnown error database entry
    Show answer and explanation
    Correct answer: C

    A zero-day vulnerability is exploited before a fix is available. A known error entry, a patch window and a baseline describe other concepts.

  5. Question 10

    Which two controls reduce the risk from a compromised user password? (Choose two.)

    1. ASharing the password with the team
    2. BUsing the same password on every system
    3. CDisabling account lockout for convenience
    4. DMultifactor authentication
    5. ESingle sign-on with conditional access policies
    Show answer and explanation
    Correct answer: D, E

    MFA and conditional access reduce the usefulness of a stolen password. Sharing, password reuse and disabled lockout all increase the risk.

Securing Cloud (4 questions)

  1. Question 11

    A company moves an application to a public cloud and wants visibility into misconfigurations and threats across cloud workloads. Which Cisco capability provides this?

    1. ACisco 9800 wireless LAN controller for managing access point radios and clients
    2. BCisco Secure Cloud Analytics or a cloud security posture solution
    3. CCisco IP phone fleet management with firmware and call profile provisioning
    4. DCisco Webex Calling Standard license with voicemail included
    Show answer and explanation
    Correct answer: B

    Cloud analytics and posture management identify threats and misconfigurations in cloud environments. Phone management, wireless controllers and calling plans do not secure cloud workloads.

  2. Question 12

    Which concept describes the shared responsibility model for cloud security?

    1. AThe provider secures customer data by default, including application logic and access policies
    2. BResponsibility for cloud security is not assigned to either party, since each side assumes the other covers it
    3. CThe customer secures the full stack, including the physical data center facility, cooling, and power supply
    4. DThe provider secures the underlying infrastructure while the customer secures its data, identities, and configuration
    Show answer and explanation
    Correct answer: D

    The provider handles infrastructure and the customer handles data, identities and configuration in the cloud. The other statements misassign responsibility.

  3. Question 13

    A cloud workload must be protected from unauthorized network access, with rules applied at the workload level regardless of its IP address. Which approach fits?

    1. AAssigning a single shared IP address to the workloads in a subnet so they can be addressed identically
    2. BDisabling the cloud-native firewall on the virtual interfaces of each workload so that traffic is unfiltered
    3. CPort forwarding from the internet directly to each instance's public address on ports 22, 3389, and 445
    4. DCloud-native security groups or micro-segmentation policies tied to workload identity or tags
    Show answer and explanation
    Correct answer: D

    Workload-level policies based on tags or identity follow workloads even as IP addresses change. Shared addresses, direct port forwarding and disabled firewalls weaken control.

  4. Question 14

    A team wants to detect unusual behavior in a cloud environment that is not visible in on-premises logs. Which data source is most useful?

    1. AThe cloud provider's quarterly product marketing newsletter
    2. BThe company intranet homepage with holiday schedules and parking notices
    3. CCloud audit logs and flow logs collected centrally for analysis
    4. DPrinter toner and paper status reports from the print servers
    Show answer and explanation
    Correct answer: C

    Cloud audit and flow logs record API activity and network flows that reveal unusual behavior. Newsletters, intranet pages and printer reports do not reveal cloud threats.

Endpoint Protection and Detection (4 questions)

  1. Question 15

    An endpoint is compromised by malware that moves laterally. Which capability on the endpoint helps detect and respond to the behavior?

    1. AA desktop wallpaper policy enforced through group policy
    2. BA printer driver firmware update for the networked printers
    3. CA screensaver lock timeout of ten minutes with password on resume
    4. DEndpoint detection and response with behavioral analytics and isolation
    Show answer and explanation
    Correct answer: D

    EDR detects suspicious behaviors and can isolate the endpoint to contain spread. Screensavers, wallpapers and printer updates do not detect malicious behavior.

  2. Question 16

    A security analyst wants to know which process on an endpoint made an unexpected network connection. Which data source provides this?

    1. AThe printer's configuration page, print job history, and firmware version
    2. BEndpoint telemetry that links processes to network connections
    3. CThe corporate directory's current employee contact list
    4. DThe firewall's NAT translation table and static port mappings for servers
    Show answer and explanation
    Correct answer: B

    Endpoint telemetry ties processes to their connections, which identifies the responsible program. The directory, NAT tables and printer configuration do not show process activity.

  3. Question 17

    Which two actions help contain an endpoint suspected of ransomware activity? (Choose two.)

    1. ABlocking the malicious process and disabling the compromised account
    2. BRestarting the endpoint repeatedly to clear the malware
    3. CDeleting the endpoint's logs to free space
    4. DSharing the endpoint's files publicly for analysis
    5. EIsolating the endpoint from the network while preserving evidence
    Show answer and explanation
    Correct answer: A, E

    Isolation and blocking the process and account stop spread while evidence is preserved. Repeated restarts, deleting logs and public sharing hinder investigation and can expose data.

  4. Question 18

    Which endpoint capability helps reduce the impact of a zero-day exploit that antivirus signatures do not yet detect?

    1. ABehavioral detection that flags suspicious process activity such as unexpected child processes
    2. BAllowing every script and macro to run without restriction, regardless of its source or signature
    3. CRelying on antivirus signature updates applied once per month across the endpoint fleet
    4. DDisabling endpoint telemetry and local event logging to reduce disk usage
    Show answer and explanation
    Correct answer: A

    Behavioral detection flags suspicious actions even without a known signature. Monthly signature updates, removed logs and unrestricted scripts leave the endpoint vulnerable.

Content Security (4 questions)

  1. Question 19

    A company wants to block malware downloads and phishing links for all users browsing the internet, regardless of their location. Which Cisco capability enforces this?

    1. ACloud-delivered secure web gateway or DNS-layer security
    2. BCisco Catalyst access point band steering with dual-band radios
    3. CCisco IP phone voicemail with message waiting indicator lamp and PIN
    4. DCisco Catalyst switch port security with 802.1X on access interfaces
    Show answer and explanation
    Correct answer: A

    A cloud secure web gateway or DNS-layer security filters content and blocks malicious destinations for remote users too. Voicemail, switch port security and band steering do not inspect web content.

  2. Question 20

    Which email security control checks messages for malicious attachments and suspicious links before they reach the user's inbox?

    1. AEmail security gateway with attachment sandboxing and link protection
    2. BEthernet framing with preamble, MAC addressing, and frame check sequence fields
    3. CDHCP snooping binding table with IP source guard and ARP inspection on access ports
    4. DNetFlow exporter on the core switch uplinks with flow records
    Show answer and explanation
    Correct answer: A

    An email security gateway uses attachment sandboxing and URL protection to block threats before delivery. The other technologies do not inspect email content.

  3. Question 21

    A proxy must inspect HTTPS traffic to detect malware, and the organization wants to limit inspection to appropriate categories for privacy. Which approach fits?

    1. ADecrypting TLS traffic for each category without exceptions, including banking and healthcare portals
    2. BDisabling HTTPS inspection so that web sessions are passed through without TLS termination or certificate checks
    3. CSelective TLS decryption based on policy categories, excluding sensitive sites such as banking
    4. DAllowing encrypted sessions to bypass the proxy without inspection of payloads or certificates on port 443
    Show answer and explanation
    Correct answer: C

    Selective decryption applies inspection where needed and excludes sensitive categories to respect privacy and legal constraints. Blanket decryption, disabling HTTPS and uninspected encryption each miss this balance.

  4. Question 22

    Which web filtering approach blocks access to categories such as gambling or malware domains based on the requested domain name before the connection is established?

    1. ADNS-layer filtering
    2. BPhysical access control
    3. CApplication layer port blocking only
    4. DFiber optic cable inspection
    Show answer and explanation
    Correct answer: A

    DNS-layer filtering prevents resolution of blocked domains, which stops connections early. Port blocking alone misses web categories, and physical controls do not filter domains.

Secure Network Access (4 questions)

  1. Question 23

    A company wants to permit access to a database only from managed devices that are in a compliant state and used by specific groups. Which policy combination best achieves this?

    1. AAllowing access from unrestricted IP ranges across the corporate network
    2. BHard-coded MAC address allowlists on the switch port without user checks
    3. CIdentity and device posture conditions combined in one authorization policy
    4. DA shared guest account mapped to a common VLAN for contractors
    Show answer and explanation
    Correct answer: C

    Authorization policies that combine identity and posture conditions enforce both who and what device is allowed. Shared guests, open IP access and MAC-only rules are weaker or incomplete.

  2. Question 24

    Which Cisco product provides device profiling so that the network can identify unknown devices and apply appropriate policies?

    1. AIdentity Services Engine profiling
    2. BCisco Video Surveillance Manager storage
    3. CCisco Webex meeting room scheduling tool
    4. DCisco Catalyst licensing portal for orders
    Show answer and explanation
    Correct answer: A

    ISE profiling identifies device types and applies policies based on the profile. Webex, licensing and video surveillance tools are not profiling services.

  3. Question 25

    An administrator wants to quarantine a device that fails a posture check, while allowing it to reach remediation resources. Which feature supports this?

    1. AQuarantine VLAN or restricted access policy with a remediation path
    2. BGranting the device full access until the issue is fully fixed
    3. CRemoving the device computer object from the Active Directory domain controller
    4. DPermitting the device to reach public internet sites without remediation
    Show answer and explanation
    Correct answer: A

    A quarantine policy with a remediation path restricts the device while allowing fixes. Full access, directory removal and internet-only access without remediation do not follow the requirement.

  4. Question 26

    An administrator wants employees to authenticate with their corporate identity when connecting to the Wi-Fi network instead of using a shared password. Which method does this?

    1. AA shared WPA2-PSK passphrase printed on the wall
    2. BOpen system authentication with no encryption
    3. C802.1X with enterprise authentication through RADIUS
    4. DDisabling SSID broadcast on the wireless controller for guests
    Show answer and explanation
    Correct answer: C

    802.1X with enterprise authentication ties access to individual identities. A shared passphrase, open networks and hidden SSIDs do not provide individual identity-based access.

Visibility and Enforcement (4 questions)

  1. Question 27

    Which two items should a security team review when investigating a suspicious login? (Choose two.)

    1. AAuthentication logs showing MFA challenges and results
    2. BThe user's preferred font in the email client
    3. CThe printer queue on the user's floor
    4. DThe color theme of the monitoring dashboard
    5. EThe login source location, device, and time compared with the user's normal pattern
    Show answer and explanation
    Correct answer: A, E

    Source, device and timing compared with normal behavior, plus MFA results, reveal whether a login is suspicious. Fonts, print queues and dashboard themes are unrelated to the investigation.

  2. Question 28

    An administrator must verify that firewall logs are sent to the SIEM in near real time. Which check is most direct?

    1. AChecking the firewall's management console color scheme and the default dashboard theme each quarter
    2. BConfirming the log forwarding configuration and checking recent events arriving in the SIEM
    3. CReading the firewall's marketing brochure and the vendor's product datasheet for logging features
    4. DCounting the number of firewall rules in each policy set and recording the total for the annual audit report
    Show answer and explanation
    Correct answer: B

    Verifying forwarding configuration and recent events in the SIEM directly confirms delivery. Brochures, rule counts and color schemes do not verify log flow.

  3. Question 29

    Which type of report helps leadership understand the effectiveness of security controls over time?

    1. AA list of packets captured last year from the perimeter sensors
    2. BA list of employee birthdays and work anniversaries for HR this year
    3. CThe office seating plan showing desk assignments, floor layouts, and the cafeteria menu
    4. DTrend reports showing blocked threats, detection times, and policy compliance
    Show answer and explanation
    Correct answer: D

    Trend reports summarize detections, response and compliance over time, which supports decisions. Raw packets, seating plans and birthdays do not measure control effectiveness.

  4. Question 30

    Which two data points are useful when building a timeline of a network intrusion? (Choose two.)

    1. ATimestamps from firewall, endpoint, and authentication logs
    2. BSource and destination addresses with ports from flow records
    3. CThe brand of the monitor used by the analyst
    4. DThe number of coffee cups in the break room
    5. EThe office lunch schedule
    Show answer and explanation
    Correct answer: A, B

    Timestamps and flow records with addresses and ports let analysts sequence and link events. Monitor brands, coffee counts and lunch schedules are unrelated.