Cisco Certified Network Professional (CCNP) Security — Practice Set 1

Question 1

A developer is reviewing code for a web application. A form field accepts user input and constructs a database query using string concatenation without sanitisation. Which attack type does this vulnerability enable?

Accepted Answer

Constructing SQL queries by directly concatenating unsanitised user input allows an attacker to inject SQL syntax that modifies the query's logic — this is SQL injection. The attacker could bypass authentication, dump database contents, or modify data. XSS injects client-side scripts into web pages. CSRF tricks authenticated users into making unintended requests. Buffer overflow occurs when data written to a buffer exceeds its allocated memory boundary.

Question 2

A security architect is selecting a symmetric cipher for encrypting data at rest. She requires a block cipher with a 256-bit key and a 128-bit block size that is the current NIST standard. Which cipher meets these requirements?

Accepted Answer

AES (Advanced Encryption Standard) is the NIST-standardised symmetric block cipher. AES-256 uses a 256-bit key and a fixed 128-bit block size. It is considered cryptographically strong and is widely used for data at rest and in transit. DES uses a 56-bit key and is considered broken. 3DES applies DES three times and is deprecated. RC4 is a stream cipher (not a block cipher) and has known weaknesses.

Question 3

A security engineer explains Perfect Forward Secrecy (PFS) to a team. Which statement BEST describes what PFS provides in a TLS session?

Accepted Answer

Perfect Forward Secrecy (PFS) is provided by cipher suites using ephemeral Diffie-Hellman (DHE or ECDHE) key exchange. A unique session key is generated for each session and is never derived from or stored as a function of the server's long-term private key. Therefore, even if an attacker later obtains the server's private key (e.g., via compromise), they cannot decrypt previously recorded encrypted sessions. This is the 'forward secrecy' property. PFS does not affect handshake round trips, key size, or replay prevention directly.

Question 4

An organisation adopts a Zero Trust security model. Which core principle differentiates Zero Trust from a traditional perimeter security model?

Accepted Answer

Zero Trust operates on the principle of 'never trust, always verify'. Unlike the traditional perimeter model that implicitly trusts traffic inside the corporate network, Zero Trust treats every access request — regardless of source — as untrusted until verified by identity, device health, and context. This limits lateral movement and reduces insider threat risk. Zero Trust does not eliminate firewalls and can be applied to on-premises, cloud, and hybrid environments.

Question 5

A security engineer is reviewing a threat intelligence report. The report contains MD5 hashes of known malicious files, malicious IP addresses, and domain names associated with a threat actor. In the IOC taxonomy, what type of IOCs are these?

Accepted Answer

File hashes, IP addresses, and domain names are technical Indicators of Compromise (IOCs) — machine-readable artefacts that indicate a system has been or is being attacked. They are the most perishable type of intelligence (attackers change IPs and domains easily) but can be directly imported into security tools for automated detection and blocking. Strategic intelligence describes attacker motivations and goals. Operational intelligence supports specific operations or campaigns. Behavioural TTPs (tactics, techniques, and procedures) describe how attackers operate and are more durable than IOCs.

Question 6

A security architect is designing network segmentation to reduce lateral movement risk. She creates separate network zones for servers, workstations, OT/SCADA devices, and a DMZ for public services. Which security design principle does this architecture implement?

Accepted Answer

Network segmentation divides a network into distinct zones, each with its own security controls and access policies. This limits lateral movement — if an attacker compromises a workstation, they face additional barriers before reaching servers or OT devices. Combined with inter-zone firewall rules, it implements defence-in-depth. Single point of failure elimination is a high-availability concept. DLP prevents data exfiltration. Identity federation enables cross-domain single sign-on.

Question 7

A network engineer is configuring a Cisco ASA in single-context routed mode. She applies an ACL to restrict inbound traffic on the outside interface. Which command syntax correctly creates an access list named OUTSIDE_IN that denies all TCP traffic from any host to the inside host 10.1.1.10 on port 22, and permits all other IP traffic?

Accepted Answer

Cisco ASA ACL syntax uses 'access-list [port]'. The correct form is: 'access-list OUTSIDE_IN deny tcp any host 10.1.1.10 eq 22' followed by 'access-list OUTSIDE_IN permit ip any any'. Option B uses IOS extended ACL syntax (ip access-list extended), which is not valid ASA syntax. Option C uses incorrect keywords ('ssh', 'all'). Option D is not a valid Cisco command.

Question 8

A security engineer is configuring a site-to-site IKEv1 VPN on a Cisco ASA. He has configured the ISAKMP policy and the IPsec transform set. Which commands correctly define the crypto map to bind the transform set, peer, and interesting traffic ACL, and apply it to the outside interface?

Accepted Answer

On a Cisco ASA, a site-to-site IKEv1 VPN crypto map is configured with these commands: 'crypto map ipsec-isakmp' declares the entry; 'set peer' specifies the remote VPN gateway; 'set transform-set' references the IPsec transform set; 'match address' specifies the crypto ACL defining interesting traffic; 'crypto map interface ' applies the map to the interface. Option D shows tunnel-group configuration (which defines IKE authentication parameters) but is not the crypto map step.

Question 9

A network engineer is comparing Cisco ASA with Cisco Secure Firewall Threat Defense (FTD). Which statement correctly describes a key architectural difference between them?

Accepted Answer

Cisco Secure Firewall Threat Defense (FTD) is a unified software image that merges the ASA stateful firewall and VPN capability with the Snort-based NGIPS (Next-Generation IPS) and URL/Application visibility engines. It is managed via Cisco Secure Firewall Management Center (FMC) for full feature access, or via Cisco Secure Firewall Device Manager (FDM) for smaller deployments. The ASA runs on ASDM or CLI and can add IPS through a separate ASA FirePOWER service module. They do not share identical CLI syntax.

Question 10

A security engineer deploys a Cisco Secure IPS sensor in inline mode between a core switch and the internet router. What is the key operational difference between inline and promiscuous (out-of-band) IPS deployment modes?

Accepted Answer

In inline mode, the IPS sensor sits in the physical path of traffic (bump-in-the-wire), allowing it to inspect and drop or modify packets in real time before they reach the destination. In promiscuous mode, the sensor receives a mirrored copy of traffic (via a SPAN port or tap) and generates alerts, but traffic has already passed to its destination — the sensor cannot block inline. Promiscuous mode requires the SPAN port; inline mode does not.

Question 11

A network engineer configures DMVPN Phase 3 with IPsec on Cisco IOS routers. The hub router uses NHRP and mGRE. What is the primary advantage of DMVPN Phase 3 over Phase 2?

Accepted Answer

DMVPN Phase 3 improves upon Phase 2 by using NHRP redirect and shortcut switching. In Phase 2, the hub must advertise individual spoke subnet routes (no summarisation). In Phase 3, the hub can advertise a summary route, and when a spoke needs to reach another spoke, the hub sends an NHRP Redirect to the initiating spoke and an NHRP Resolution Request to the target spoke, enabling them to build a dynamic direct (spoke-to-spoke) IPsec/GRE tunnel without requiring the hub to forward the data traffic. This reduces hub load and allows route summarisation.

Question 12

A network engineer is configuring 802.1X port-based authentication on a Cisco switch with Cisco ISE as the RADIUS server. When a supplicant (endpoint) connects to the switch port, in which order do the 802.1X authentication components interact?

Accepted Answer

802.1X defines three roles: the Supplicant (the endpoint device requesting access), the Authenticator (the network device — here the Cisco switch — that controls port access and forwards EAP messages), and the Authentication Server (Cisco ISE, which validates credentials and returns access decisions via RADIUS). The flow is: the supplicant sends EAP messages to the authenticator (switch), which encapsulates them in RADIUS and forwards them to the authentication server (ISE). ISE returns a RADIUS Access-Accept or Access-Reject, and the switch opens or blocks the port accordingly.

Question 13

Under the shared responsibility model for cloud security, which security responsibility does the cloud service provider retain for Infrastructure as a Service (IaaS)?

Accepted Answer

In the IaaS shared responsibility model, the cloud provider secures the physical data centres, hardware, hypervisor layer, and global network infrastructure. The customer is responsible for: the guest OS and its patching, security configuration of virtual networks and firewall rules, application code, and data protection (encryption). In PaaS and SaaS, the provider assumes more of the stack, but even in IaaS the physical infrastructure is always the provider's responsibility.

Question 14

A company deploys Cisco Umbrella to protect roaming laptops that are off the corporate network. Cisco Umbrella inspects DNS queries before the connection is established and blocks requests to malicious domains. Which security function does Cisco Umbrella provide in this scenario?

Accepted Answer

Cisco Umbrella operates as a cloud-delivered DNS-layer security service. When a device queries a domain, Umbrella evaluates the request against its threat intelligence database (Cisco Talos and Umbrella's own intelligence). If the domain is classified as malicious, Umbrella blocks the DNS response before any connection is established to the malicious destination. This protection works for all ports and protocols, not just HTTP, and covers devices anywhere — including remote workers without a VPN.

Question 15

An organisation uses multiple SaaS applications (Office 365, Salesforce, Box) and wants visibility into shadow IT — unsanctioned cloud services being accessed by employees. Which technology provides this discovery and control capability?

Accepted Answer

A Cloud Access Security Broker (CASB) sits between users and cloud services to provide visibility, compliance, data security, and threat protection. CASBs can discover all cloud services in use (including shadow IT), classify them by risk, enforce DLP policies on data moving to cloud services, and provide user behaviour analytics. A traditional proxy inspects HTTP/HTTPS but lacks CASB-level cloud application intelligence. A network IDS detects attacks but does not provide SaaS visibility or data control. Endpoint antivirus focuses on malware, not cloud access.

Question 16

A security architect is designing a cloud environment and needs to restrict east-west traffic between workloads in the same VPC so that a compromised workload cannot directly access other workloads. Which technique achieves this at the workload level, beyond just VPC-level security groups?

Accepted Answer

Micro-segmentation applies granular security policies at the individual workload level (per virtual machine or container), controlling east-west (lateral) traffic even between workloads in the same network segment or VPC. This is in contrast to traditional perimeter-based security that only controls north-south (ingress/egress) traffic. Tools like Cisco Secure Workload (formerly Tetration) provide micro-segmentation by enforcing host-based policies derived from application dependency mapping. A permissive intra-VPC security group would allow lateral movement. DNS-layer filtering and encryption at rest do not address lateral movement between workloads.

Question 17

An organisation deploys Cisco Secure Email (formerly Cisco Email Security Appliance — ESA). Which email authentication mechanism allows the receiving mail server to verify that the sending domain has published a DNS record authorising the sending IP address?

Accepted Answer

SPF (Sender Policy Framework, RFC 7208) allows a domain owner to publish a DNS TXT record listing the IP addresses authorised to send email on behalf of that domain. The receiving mail server checks whether the sending IP appears in the sender domain's SPF record. DKIM uses cryptographic signatures to verify that a message was not altered in transit and came from an authorised sender, but uses a DNS-published public key rather than IP addresses. DMARC builds on SPF and DKIM to define a policy for handling failures. S/MIME provides end-to-end message encryption and signing.

Question 18

A company uses Cisco Secure Web Appliance (formerly WSA) to inspect employee web traffic. Users can access HTTPS sites, and the security team wants to inspect the encrypted content for malware and DLP violations. Which WSA feature enables inspection of HTTPS traffic?

Accepted Answer

Cisco Secure Web Appliance's HTTPS inspection feature performs SSL/TLS man-in-the-middle decryption: it terminates the client's TLS connection, inspects the plaintext content for malware signatures, DLP violations, and policy compliance, then re-encrypts and forwards the traffic to the destination. The appliance uses a corporate root CA certificate (deployed to clients via Group Policy) to issue on-the-fly certificates. URL category filtering classifies URLs but does not decrypt content. Anti-spam is an email function. Talos IP reputation is used for blocking by reputation but does not decrypt traffic.

Question 19

A DMARC record for a domain is set to 'p=quarantine'. An email claiming to be from that domain fails both SPF and DKIM checks. What action will a compliant receiving mail server take?

Accepted Answer

DMARC policy 'p=quarantine' instructs receiving mail servers to treat messages that fail DMARC alignment (both SPF and DKIM checks fail) as suspicious — typically by placing them in the recipient's spam or junk folder rather than the inbox. A DMARC policy of 'p=none' takes no action (monitor only). A policy of 'p=reject' causes the receiving server to reject the message outright and send a non-delivery report. DMARC does not route emails to the domain owner for manual review.

Question 20

A security team is reviewing Cisco Talos threat intelligence integration in the Cisco Secure Email appliance. Which BEST describes what Cisco Talos provides to the email security inspection pipeline?

Accepted Answer

Cisco Talos is Cisco's threat intelligence and research organisation. Its real-time reputation feeds are integrated directly into Cisco Secure Email (ESA), Cisco Secure Web Appliance (WSA), and other Cisco security products. For email security, Talos provides sender IP reputation (to block emails from known-malicious sending IPs), URL reputation (to block or warn on emails containing malicious URLs), and file reputation/sandboxing intelligence (via integration with Cisco Secure Malware Analytics). Talos does not handle SMTP delivery, is not limited to network-layer threats, and does not patch appliance firmware.

Question 21

A security administrator is configuring Cisco Secure Endpoint (formerly AMP for Endpoints) in a new deployment. She sets the policy to 'Audit' mode. What does Audit mode do?

Accepted Answer

Cisco Secure Endpoint conviction modes from least to most aggressive are: Audit → Passive → Active → Aggressive. In Audit mode, the connector monitors and logs file events and threat detections but does not take any blocking or quarantine action. This allows administrators to assess the impact of policies and tune detections before moving to a more aggressive mode that would block files. Aggressive mode would block and quarantine all files with a malicious or unknown disposition.

Question 22

In Cisco Secure Endpoint, a security analyst uses the 'File Trajectory' feature. What does File Trajectory show?

Accepted Answer

File Trajectory in Cisco Secure Endpoint provides a historical view of how a specific file (identified by its SHA-256 hash) has propagated across the organisation's endpoint population. It shows every managed device that has seen the file, whether it was executed, and the timestamps. This is invaluable during incident response for determining the scope of an infection — how many devices are affected and when the file first appeared. Device Trajectory (a separate feature) shows all activity on a single device over time.

Question 23

A security engineer explains two OS-level exploit prevention mechanisms. Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP/NX bit) are enabled on all Windows servers. How do these two mechanisms complement each other against memory-based exploits?

Accepted Answer

ASLR and DEP/NX are complementary memory protection mechanisms. ASLR randomises the virtual memory addresses of the executable, stack, heap, and loaded libraries each time a process starts, making it difficult for an attacker to predict addresses needed for return-oriented programming or code-reuse attacks. DEP (Data Execution Prevention, also known as NX — No-Execute bit) marks memory regions that contain data (stack, heap) as non-executable, so even if an attacker injects shellcode into a data region, the CPU will refuse to execute it. Together, they significantly raise the bar for successful memory exploitation.

Question 24

A security engineer is configuring Cisco ISE for BYOD (Bring Your Own Device) onboarding. An employee connects a personal iPhone to the corporate Wi-Fi. ISE must verify the device's compliance posture (OS version, encryption enabled) before granting access. Which ISE capability performs this device health check?

Accepted Answer

Cisco ISE Posture Assessment (formerly NAC Agent) checks whether an endpoint meets defined security requirements (e.g., AV installed and up to date, OS patch level, disk encryption enabled) before granting full network access. Non-compliant devices can be redirected to a remediation VLAN. ISE Profiling identifies the type of device (iPhone, Windows laptop, IP phone) but does not check health compliance. pxGrid is an API for sharing session context with partner security products. TrustSec SGTs are security group tags used for policy enforcement after authentication.

Question 25

A network security engineer is reviewing Cisco Secure Network Analytics (formerly StealthWatch) alerts. The system flags an internal server as generating an anomalous volume of outbound connections to 200 unique external IP addresses over 10 minutes — behaviour outside the server's established baseline. Which Cisco Secure Network Analytics capability detected this?

Accepted Answer

Cisco Secure Network Analytics (formerly Stealthwatch) uses NetFlow, IPFIX, and other flow telemetry ingested from routers and switches to build behavioural baselines for every host. It detects deviations from those baselines — such as a server suddenly initiating connections to hundreds of unique external IPs (indicative of a port scan, C2 beaconing to multiple IPs, or data exfiltration) — using behavioural analytics and machine learning. This is distinct from signature-based detection. Posture assessment, file trajectory, and email DLP are ISE, Secure Endpoint, and Secure Email functions respectively.

350-701 SCOR — Cisco Certified Network Professional (CCNP) Security