Cisco Certified Internetwork Expert (CCIE) Security — Practice Set 1

Question 1

A security architect is designing a PKI for an enterprise. The design requires that the root CA private key never be exposed to a network-connected system. Issuing CAs sign end-entity certificates and publish CRLs. The root CA signs only intermediate CA certificates and a single root CRL. Which PKI design pattern is described and what is its primary security benefit?

Accepted Answer

The offline root CA model is the industry-standard enterprise PKI design: the root CA is kept powered off and air-gapped, brought online only to sign subordinate CA certificates and CRLs. Online issuing (subordinate) CAs handle day-to-day certificate issuance. If an issuing CA is compromised, it can be revoked by the root CA and replaced, limiting blast radius to that CA's issued certificates. The root CA's private key is never exposed to network-connected systems, protecting the entire PKI trust anchor. A flat PKI exposes the root to network attacks. Cross-certification and bridge CAs are interoperability architectures.

Question 2

A CCIE candidate is asked to explain the difference between RSA and ECC for key exchange in TLS. An organisation wants to minimise certificate key size while maintaining equivalent security to RSA-2048. Which ECC key size provides approximately equivalent security and why?

Accepted Answer

Elliptic Curve Cryptography (ECC) achieves comparable security to RSA with significantly smaller key sizes because the underlying hard mathematical problem — the Elliptic Curve Discrete Logarithm Problem (ECDLP) — is currently more computationally difficult to solve than RSA's integer factorisation for equivalent key lengths. NIST guidance indicates that a 256-bit ECC key (e.g., P-256 / secp256r1) provides approximately the same security level as a 3072-bit RSA key. A 224-bit ECC key is roughly equivalent to RSA-2048. Smaller ECC keys mean faster handshakes, lower CPU usage, and smaller certificate sizes.

Question 3

A security engineer analyses a CVSS v3.1 vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Which interpretation of this vector is correct?

Accepted Answer

Parsing the CVSS 3.1 vector: AV:N = Attack Vector Network (remotely exploitable); AC:L = Attack Complexity Low (no special conditions); PR:N = Privileges Required None (no authentication); UI:N = User Interaction None (no victim action required); S:C = Scope Changed (vulnerability impacts beyond the vulnerable component's security scope); C:H/I:H/A:H = High impact on Confidentiality, Integrity, and Availability. This combination produces a CVSS base score of 10.0 (Critical) — the maximum possible. This profile describes an unauthenticated, remotely exploitable critical vulnerability with full system impact.

Question 4

A CCIE candidate explains HMAC. A developer implements a REST API and needs to ensure both message integrity and authentication of the API caller without using asymmetric cryptography. Which mechanism is MOST appropriate?

Accepted Answer

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function (SHA-256 here) with a shared secret key to produce an authentication tag. It provides both message integrity (any modification of the body produces a different HMAC) and authentication (only parties with the shared key can produce or verify the correct HMAC). A plain MD5 hash without a key provides no authentication — anyone can recompute it. RSA signatures use asymmetric keys (the question specifically excludes this). Base64 is encoding, not a security mechanism.

Question 5

An advanced attacker performs an ARP spoofing attack on a switched network. She sends gratuitous ARP replies associating her MAC address with the default gateway's IP address. Which statements are true about what the attacker achieves and how this can be mitigated? (Choose 2)

Accepted Answer

ARP spoofing works on Layer 2 switched networks within a VLAN — hosts accept unsolicited ARP replies and update their ARP cache. By associating her MAC address with the gateway IP, the attacker intercepts all traffic destined for the gateway (man-in-the-middle). Dynamic ARP Inspection (DAI) is a Cisco switch feature that intercepts ARP packets on untrusted ports and validates them against the DHCP snooping binding table (which maps IP to MAC to port); forged ARP replies are dropped. STP prevents Layer 2 loops and does not protect against ARP spoofing. MACsec encrypts Ethernet frames but does not prevent ARP spoofing (the ARP frames themselves are still sent and processed).

Question 6

A network engineer reviews a Cisco ASA running configuration and finds the following:

access-list OUTSIDE_IN extended permit tcp any host 198.51.100.10 eq 443
access-list OUTSIDE_IN extended permit tcp any host 198.51.100.10 eq 80
access-list OUTSIDE_IN extended deny ip any any log
access-group OUTSIDE_IN in interface outside

A new requirement adds: permit ICMP echo-reply from any external host to any internal host. Where must the new ACE be inserted and what is the correct syntax?

Accepted Answer

Cisco ASA ACLs are processed top-down and stop at the first match. The 'deny ip any any log' line matches all IP traffic (including ICMP, since ICMP is an IP protocol). Any ACE added after this line will never be reached. The new permit for ICMP echo-reply must be inserted before the deny line. The correct syntax is 'access-list OUTSIDE_IN extended permit icmp any any echo-reply'. Option A is incorrect because 'ip' in 'deny ip any any' matches all Layer 3 protocols including ICMP. Option C is overly permissive (permits all ICMP types). Option D is incorrect — TCP ACEs do not match ICMP.

Question 7

A network engineer runs 'show crypto isakmp sa' on a Cisco ASA and sees the following output:

Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 203.0.113.1
    Type    : L2L             Role    : initiator 
    Rekey   : no              State   : MM_WAIT_MSG4

What does the 'MM_WAIT_MSG4' state indicate about the IKEv1 Phase 1 (Main Mode) negotiation?

Accepted Answer

IKEv1 Main Mode consists of six messages. MM_WAIT_MSG4 means the local device has sent Message 3 (which carries the Diffie-Hellman public value and nonce) and is waiting for the peer's Message 4 (the peer's DH public value and nonce). The DH key exchange (messages 3 and 4) generates the shared secret used to derive the session keys. A stall at MM_WAIT_MSG4 typically indicates a NAT or connectivity issue between the peers preventing Message 4 from arriving, or a mismatched DH group. A successful Phase 1 completion would show state MM_ACTIVE. A policy mismatch would typically appear at MM_WAIT_MSG2.

Question 8

A CCIE candidate must configure IKEv2 site-to-site VPN on a Cisco ASA. IKEv2 replaces IKEv1 Main Mode and Quick Mode with a different exchange structure. Which statement correctly describes IKEv2's exchange sequence compared to IKEv1?

Accepted Answer

IKEv2 (RFC 7296) is more efficient than IKEv1. It replaces the 6-message IKEv1 Main Mode and 3-message Quick Mode (9 messages total for one IPsec SA) with: IKE_SA_INIT (2 messages: algorithm negotiation, DH exchange, nonces) and IKE_AUTH (2 messages: authentication, first Child SA establishment) — 4 messages total. IKEv2 also has built-in NAT traversal, improved reliability (request/response model with retransmission), and supports EAP authentication natively. IKEv2 still uses Diffie-Hellman for key exchange.

Question 9

A network engineer runs 'show crypto ipsec sa' on a Cisco ASA and observes:

#pkts encaps: 1542, #pkts encrypt: 1542, #pkts digest: 1542
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

The remote site reports it can ping the local ASA's inside network but the local inside hosts cannot reach the remote site. What does this output MOST suggest?

Accepted Answer

The 'show crypto ipsec sa' output shows encaps (outbound packets encrypted and sent) = 1542 but decaps (inbound packets decrypted) = 0. This means the local ASA is encrypting and sending traffic, but receiving no encrypted inbound traffic that matches the inbound Security Association (SA). Common causes: (1) the remote peer's proxy ACL (crypto ACL) does not mirror the local ACL, so the remote peer is not encrypting return traffic; (2) the remote peer's SA is not established in the inbound direction; (3) inbound packets arrive but with an SPI that doesn't match the local SA. This is a Phase 2 mismatch or asymmetric tunnel issue. If Phase 1 had expired, encaps would also fail.

Question 10

A Cisco ISE deployment uses TrustSec Security Group Tags (SGTs). A switch port is assigned SGT 10 (Employees). The destination server has SGT 50 (Finance-Servers). An SGACL policy matrix defines: Employees → Finance-Servers = DENY ALL. How does TrustSec enforce this policy between a switch and the server when the switch does not support SGT inline tagging?

Accepted Answer

Cisco TrustSec SGT enforcement requires that devices in the traffic path either support inline SGT tagging (Cisco Meta Data — CMD — header in 802.1AE frames) or use SXP (SGT Exchange Protocol) to propagate IP-to-SGT bindings over TCP to devices that cannot read inline tags. The enforcement device (egress switch, firewall, or router that supports SGACL) uses the SXP-learned binding to apply the correct SGACL policy. This allows TrustSec enforcement in networks with a mix of SGT-capable and non-capable devices. pxGrid shares session context (authentication events) with security ecosystem partners — it does not distribute SGACLs.

Question 11

A network engineer reviews a Cisco Secure Firewall FTD (Firepower Threat Defense) policy managed by Cisco Secure Firewall Management Center (FMC). The FTD is running a Snort 3 intrusion policy. An analyst wants to create a custom Snort 3 rule to detect HTTP requests containing the URI pattern '/admin/config.php' arriving on port 8080. Which Snort 3 rule syntax is correct?

Accepted Answer

In Snort 3, the 'http' protocol keyword directs the rule to HTTP-normalised traffic. The 'http.uri' sticky buffer targets the normalised request URI field specifically, which is more precise and efficient than searching the raw payload. The 'content' keyword then matches the URI string. The rule must include 'msg', 'sid', and 'rev' fields. Option B uses TCP (not HTTP-aware) and does not use the http.uri buffer. Option C uses 'drop' (which would block rather than alert, and omits 'msg' and 'rev'). Option D uses 'ip' protocol and a non-existent 'payload' keyword.

Question 12

A CCIE Security candidate is asked to describe the security responsibilities in a PaaS model compared to IaaS. In a PaaS model, what additional security responsibilities does the cloud provider assume compared to IaaS?

Accepted Answer

In the shared responsibility model: IaaS — provider secures physical hardware, hypervisor, and network; customer secures everything from OS upward. PaaS — provider additionally secures the OS, middleware, runtime, and database layers; customer is responsible for their application code, application-level configuration, and data. SaaS — provider secures nearly everything; customer is responsible mainly for user access management and data classification. The customer's responsibility shrinks as the service model moves from IaaS to PaaS to SaaS.

Question 13

An organisation deploys Cisco Umbrella with the roaming client on all laptops. A DNS query for 'update.legitimate-software.com' is sent from a remote laptop. Umbrella's intelligence classifies the domain as benign. The query resolves to an IP address. The laptop then establishes an HTTPS connection to that IP. Which statement about Umbrella's protection scope is correct?

Accepted Answer

Cisco Umbrella's core DNS-layer security operates at the DNS resolution stage — it allows or blocks domains before a connection is made. If a domain is allowed, the subsequent TCP/TLS connection proceeds directly from the client to the server without additional Umbrella inspection at the packet level. To add content inspection (URL filtering, HTTPS decryption, malware file scanning, and CASB functionality) for allowed domains, the Umbrella Secure Internet Gateway (SIG) proxy feature must be enabled. SIG routes traffic through Umbrella's cloud proxy for full content inspection. Without SIG, Umbrella provides no visibility into the HTTPS session payload.

Question 14

A security architect is evaluating CASB deployment modes. The organisation uses Cisco Umbrella with CASB capabilities and wants to apply DLP policies to corporate data uploaded to unsanctioned cloud storage services. Which CASB deployment mode inspects the traffic inline and can enforce block/allow decisions in real time without requiring API integration with each SaaS provider?

Accepted Answer

CASB deployment modes: (1) API mode — out-of-band, uses cloud provider APIs to scan and remediate content already uploaded; does not block in real time and requires integration with each provider. (2) Reverse proxy — intercepts specific managed-device-to-SaaS traffic but requires DNS or certificate manipulation for specific apps. (3) Forward proxy (inline) — routes all user internet traffic through the CASB proxy, enabling real-time enforcement for any cloud service including shadow IT/unsanctioned apps. Cisco Umbrella's SIG provides forward proxy CASB capabilities. Log collection is a monitoring-only mode with no enforcement.

Question 15

A security administrator reviews the Cisco Secure Email (ESA) mail log and sees: MID 8374 ICID 2891 From: MID 8374 To: MID 8374 SPF: SoftFail MID 8374 DKIM: pass (signature verified) MID 8374 DMARC: fail (p=reject; sp=reject; pct=100) MID 8374 Action: quarantine DMARC policy is 'p=reject' but the email was quarantined instead of rejected. What is the MOST likely reason?

Accepted Answer

DMARC defines three policies: none (monitor only), quarantine, and reject. While p=reject instructs receiving servers to reject failing messages, many email security deployments — including Cisco Secure Email configurations — allow administrators to override the domain owner's DMARC reject policy and apply a local action such as quarantine instead. This is commonly done during initial deployment to prevent legitimate mail from being rejected due to misconfigured SPF/DKIM at the sender. The ESA's DMARC policy handling can be configured to honour, downgrade, or override the published policy. A DKIM pass does not override DMARC — DMARC evaluates alignment, not just pass/fail independently.

Question 16

A security engineer configures the Cisco Secure Web Appliance (SWA) to perform HTTPS inspection for all users. After enabling HTTPS inspection, users browsing to their online banking sites receive certificate errors. What is the cause and the correct remediation?

Accepted Answer

HTTPS inspection on the Cisco SWA involves two issues: (1) The SWA generates replacement certificates signed by its own internal CA. Users' browsers must trust this CA; otherwise they receive untrusted certificate warnings. Solution: deploy the SWA signing CA certificate to all endpoints via Group Policy or MDM. (2) Many financial institutions and applications use certificate/public-key pinning (HPKP or baked-in pins), which causes the browser or application to reject any certificate not matching the pinned value — including SWA-generated ones. Solution: configure decryption policy exceptions for these domains to pass them through without inspection. Both issues must be addressed simultaneously.

Question 17

A security engineer is configuring Cisco Secure Email to protect against Business Email Compromise (BEC) attacks where attackers impersonate the CEO using a display name match but a different domain. Which ESA feature MOST directly mitigates this specific attack vector?

Accepted Answer

Business Email Compromise (BEC) attacks often use a legitimate domain with a display name that matches an executive ('CEO Name' <attacker@gmail.com>). These emails may pass SPF, DKIM, and DMARC checks because the sending domain (gmail.com) is legitimate — the spoofing is only in the display name. Cisco Secure Email includes a Forged Email Detection feature that allows administrators to define a list of executive names; the appliance flags any incoming message where the display name matches a protected name but the sending domain does not match the corporate domain. Anti-spam and outbreak filters target known malicious content patterns, not display name spoofing. DKIM only verifies signing domain alignment.

Question 18

A Cisco Secure Web Appliance (SWA) is deployed in explicit forward proxy mode. A user's browser is configured to send all HTTP and HTTPS requests to the SWA on port 3128. An application on the user's laptop uses a hard-coded IP address instead of a hostname for its cloud connection. The SWA's HTTPS inspection policy is configured to inspect all traffic. What happens to this application's traffic?

Accepted Answer

In explicit proxy mode, each application must be configured to send its traffic to the proxy (via browser proxy settings, PAC file, or system proxy settings). Applications that bypass the system proxy — including those using hard-coded IP addresses — send traffic directly to the internet without going through the SWA. The SWA never sees this traffic. To enforce proxy for all applications including those that bypass proxy settings, a transparent proxy deployment (intercepting traffic at the network layer via WCCP or a PBR policy on a router) or an endpoint agent that enforces proxy for all traffic is required.

Question 19

A CCIE Security candidate reviews a Cisco Secure Endpoint (formerly AMP for Endpoints) console alert. The alert shows 'Threat Detected: Possible Dropper' for a file on a Windows host. The file disposition is 'Unknown' (not in the Cisco cloud reputation database). The connector is in Active mode. Which action does Cisco Secure Endpoint take for an 'Unknown' disposition file in Active mode?

Accepted Answer

Cisco Secure Endpoint conviction modes control response to file dispositions. In Active mode: Clean files are allowed, Malicious files are quarantined. For Unknown files, the connector allows execution but continuously monitors file and process activity. If Cisco's cloud intelligence later reclassifies the file as malicious (retrospective detection), the connector receives an updated verdict and can retroactively quarantine the file and alert the analyst — even if the file was already executed. This retrospective capability is a key differentiator of Cisco Secure Endpoint. Aggressive mode quarantines unknown files proactively, which increases false positives.

Question 20

A SOC analyst investigating a compromised Windows host uses Cisco Secure Endpoint's Device Trajectory feature. The trajectory shows: explorer.exe → cmd.exe → powershell.exe → (network connection to 203.0.113.99:443) → mshta.exe. Which attack technique does this process chain MOST indicate?

Accepted Answer

The Device Trajectory chain explorer.exe → cmd.exe → powershell.exe → (outbound connection) → mshta.exe is a classic living-off-the-land (LotL) attack pattern. Explorer.exe spawning cmd.exe, which spawns PowerShell, which makes an outbound connection to a suspicious external IP, followed by mshta.exe (a signed Windows binary that executes HTML Applications / VBScript, commonly abused for execution and UAC bypass) indicates a multi-stage attack using built-in Windows tools to evade AV detection. Windows Update and user-initiated installs do not produce this process chain.

Question 21

A network engineer runs 'show authentication sessions interface GigabitEthernet0/1 details' on a Cisco Catalyst switch and sees:

Interface:  GigabitEthernet0/1
          IIF-ID:  0x1078C80000055
         IP Address:  10.1.1.105
          User-Name:  00-11-22-33-44-55
           Status:  Authorized
           Domain:  DATA
     Oper host mode:  multi-auth
    Oper control dir:  both
       Session timeout:  N/A
    Acct update time:  0d0h11m26s
 Common Session ID:  0A0101010000000F3C2D8A56
     Acct Session ID:  0x0000000F
              Handle:  0xD6000003
     Current Policy:  POLICY_MAB

Local policies:
        Service Template: DEFAULT_LINKSEC_POLICY_SHOULD_SECURE (priority 150)

Server policies:
           VLAN Group:  Vlan: 20

What does 'POLICY_MAB' and the 'User-Name: 00-11-22-33-44-55' indicate about this authentication session?

Accepted Answer

MAC Authentication Bypass (MAB) is a fallback authentication method used when a device does not support 802.1X (e.g., IP phones, printers, IoT devices). In MAB, the switch sends the device's MAC address as both the RADIUS username and password to ISE. The 'User-Name: 00-11-22-33-44-55' (formatted as the MAC address) and 'Current Policy: POLICY_MAB' confirm this is a MAB session. ISE looks up the MAC address in its endpoint identity store (or an external directory) to determine the authorisation policy. The session is authorised and placed in VLAN 20 per ISE's server policy.

Question 22

A security architect is designing a Cisco ISE policy for BYOD devices. Personal devices that pass posture assessment should receive full corporate access (VLAN 10). Devices that fail posture should be redirected to a remediation portal. Which ISE policy components are required to implement this? (Choose 2)

Accepted Answer

The BYOD posture workflow requires two authorisation policy rules: (1) A rule that matches 'posture status = Compliant' and returns the full access authorisation result (e.g., VLAN 10 and a permissive dACL). (2) A rule that matches 'posture status = NonCompliant' and returns a redirect result (CWA or posture redirect URL + ACL that permits only DNS and HTTPS to ISE/remediation portal). These two rules together implement the compliant-or-redirect behaviour. Device profiling (B) is useful but not required for posture-based access differentiation. pxGrid (D) enables ecosystem sharing, not this specific flow. A Cisco ASA VPN (E) is not part of an 802.1X/MAB BYOD posture flow.

Question 23

A security engineer is investigating an alert from Cisco Secure Network Analytics (formerly StealthWatch). The system reports 'Encrypted Traffic Analytics (ETA) — Malware detected in encrypted flow' for a TLS 1.3 connection from an internal host to an external IP. No decryption occurred. How does Cisco Secure Network Analytics detect malware in an encrypted TLS flow without decrypting it?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA) is a Cisco technology that detects malware communications in encrypted traffic without decryption. It analyses observable metadata: the TLS ClientHello (supported cipher suites, extensions, SNI), the server certificate (subject, issuer, validity period), and NetFlow enrichments (initial data packet length, byte distribution, sequence of packet lengths and inter-arrival times). These features are correlated against Cisco Talos machine learning models trained on known malware C2 communication patterns. ETA does not decrypt traffic, does not use session keys, and does not deploy a proxy. TLS 1.3 is fully encrypted.

Question 24

A network architect is reviewing the pxGrid protocol. Cisco ISE publishes session context (user identity, device type, posture status, SGT) via pxGrid. A third-party SIEM subscribes to pxGrid. When a new endpoint authenticates, the SIEM receives the session context automatically. Which pxGrid capability is being used to push these real-time updates to the SIEM?

Accepted Answer

Cisco pxGrid 2.0 uses a WebSocket-based publish/subscribe model over HTTPS. ISE acts as the pxGrid publisher, pushing session context events (authentication, authorisation, session termination, posture changes) to the pxGrid controller. Third-party security products that subscribe to specific topics (e.g., /topic/com.cisco.ise.session) receive real-time push notifications whenever relevant events occur. This eliminates the need for polling and provides near-real-time context sharing. pxGrid does not use SNMP traps or direct database access.

Question 25

A CCIE Security candidate is asked to design a Cisco ISE deployment for a large enterprise. The design must support 150,000 concurrent endpoints, provide high availability, and distribute authentication load. The candidate proposes a distributed deployment with dedicated Policy Administration Nodes (PAN), Policy Service Nodes (PSN), and Monitoring and Troubleshooting Nodes (MNT). Which statement correctly describes the role of each node type in a distributed ISE deployment?

Accepted Answer

In a Cisco ISE distributed deployment: the Policy Administration Node (PAN) provides the central configuration GUI and policy management (maximum 2 nodes in a Primary/Secondary HA pair; only the Primary is active for config). Policy Service Nodes (PSNs) process all live authentication, authorisation, and accounting requests (RADIUS/TACACS+) from network access devices — multiple PSNs are deployed for scalability and load balancing via RADIUS load-balancing on the network devices or ISE's load-balancer integration. Monitoring and Troubleshooting (MNT) nodes aggregate syslogs and RADIUS accounting data to provide real-time and historical reporting (up to 2 MNT nodes for HA). This node separation allows each tier to scale independently.

350-701 SCOR — Cisco Certified Internetwork Expert (CCIE) Security