Flashcards
60 cards for SCOR 350-701 v2.0. Answer in your head, flip, then be honest: cards you miss come back today, cards you know wait longer each time.
- 0 new
- 0 box 1
- 0 box 2
- 0 box 3
- 0 box 4
- 0 box 5
space flips the card, 1 2 3 grade it. Progress is saved in this browser only (local storage, never sent anywhere).
All cards
Browse the whole deck. Select a card to see the answer and a link to the notes.
2.1 What is the one deciding question for whether a security device can block traffic?
Is it inline? Only a device the real packet passes through can drop it. Passive (SPAN, TAP, ERSPAN) and inline tap mode can only alert.
review in the notes →2.1 IPS vs. IDS in one line each.
IPS detects and blocks (must be inline). IDS detects and alerts only (usually passive, fed by SPAN or TAP).
review in the notes →2.1 How does a stateful firewall let return traffic in without an ACL for it?
It records each session (e.g. SYN, SYN-ACK, ACK) in its state table and permits packets that match a session your side started. UDP and ICMP get pseudo-state via idle timeouts.
review in the notes →2.1 Stateless ACL vs. stateful firewall?
A stateless ACL judges each packet alone. A stateful firewall judges each packet in the context of its conversation.
review in the notes →2.1 What does an NGFW add on top of a stateful firewall?
Integrated IPS, AVC (application visibility and control), URL filtering, malware defense with sandboxing, user identity (ISE or AD) and Security Intelligence reputation blocking.
review in the notes →2.1 Name the four IPS detection approaches.
Signature (known patterns), anomaly/behavior (deviation from baseline), reputation (bad IPs, URLs, files), and policy (anything that violates a rule, e.g. SMBv1).
review in the notes →2.1 Why does signature-based IPS miss zero-day attacks?
It only matches patterns that already have a signature. Until Talos writes and publishes a rule, a brand-new attack has nothing to match.
review in the notes →2.1 False positive vs. false negative on an IPS: which one is the outage and which is the breach?
False positive = legitimate traffic dropped (business outage). False negative = an attack gets through (breach).
review in the notes →2.1 List the FTD base intrusion policies from least to most aggressive.
Connectivity Over Security, Balanced Security and Connectivity (recommended start), Security Over Connectivity, Maximum Detection (testing only).
review in the notes →2.1 What engine provides IPS on Cisco Secure Firewall, and who writes its rules?
Snort (Snort 3 on current FTD). Rules come from Cisco Talos.
review in the notes →2.1 Where does Security Intelligence sit in FTD processing, and why does that matter?
It's evaluated before deep inspection, so known-bad IPs, URLs and domains are blocked cheaply and early.
review in the notes →2.1 Routed vs. transparent firewall mode?
Routed: a Layer 3 hop, an IP per interface, hosts use it as gateway. Transparent: a Layer 2 bump in the wire using bridge groups (management IP on the BVI), inserted without re-addressing.
review in the notes →2.1 Which FTD IPS interface mode is physically inline but can never block?
Inline set in tap mode. Snort gets a copy and the original packet is forwarded untouched. Use it to tune before going truly inline.
review in the notes →2.1 What is an FTD inline set?
Two interfaces bound together as a pair. Traffic enters one and leaves the other, so Snort can drop bad packets: a true inline IPS. It supports fail-open options and hardware bypass on supported modules.
review in the notes →2.1 When would you use passive ERSPAN instead of passive (SPAN)?
When the sensor is routed hops away. ERSPAN GRE-encapsulates the mirrored traffic so it can cross Layer 3. It's routed mode only and still alert-only.
review in the notes →2.1 TAP vs. SPAN?
A TAP is hardware that copies every frame and never oversubscribes. A SPAN session is free and flexible but can drop frames when busy.
review in the notes →2.1 What HA modes does FTD support, and which ASA-only mode is the trap answer?
FTD: active/standby failover and clustering. Active/active failover exists only on ASA in multiple context mode.
review in the notes →2.1 FTD multi-instance is the counterpart of which ASA feature?
ASA multiple context mode. Both split one box into independent virtual firewalls.
review in the notes →2.1 Fail-open vs. fail-closed?
Fail-open keeps forwarding uninspected traffic when the engine fails (availability wins). Fail-closed stops forwarding (security wins). It's a business decision.
review in the notes →2.1 ASA vs. FTD: where do IPS, AVC, URL and malware features live?
Built into FTD. ASA is stateful firewall + NAT + VPN; its old FirePOWER add-on module is end-of-life.
review in the notes →2.1 FMC vs. FDM vs. Security Cloud Control?
FMC: many FTDs (on-prem or virtual; also cloud-delivered FMC). FDM: one FTD, on-box. Security Cloud Control (formerly CDO): SaaS management across ASA, FTD, Multicloud Defense and more.
review in the notes →2.1 Which Cisco product is the cloud-native firewall/IPS for public cloud workloads?
Cisco Multicloud Defense: SaaS-managed gateways for ingress, egress and east-west traffic across clouds.
review in the notes →2.1 Which Cisco product delivers firewall + IPS to remote users from the cloud?
Cisco Secure Access (SSE): cloud-delivered firewall with IPS, SWG, DNS-layer security, CASB and ZTNA.
review in the notes →2.1 How do you get firewall and IPS in a branch without an extra appliance?
On the IOS XE router: Zone-Based Firewall plus Snort IPS (UTD container). Meraki MX is the cloud-managed alternative.
review in the notes →2.1 What is a hybrid mesh firewall?
Many enforcement points of different form factors (appliance, virtual, cloud-native, cloud-delivered, router-embedded) managed as one policy.
review in the notes →2.1 ZBFW: can an interface in a zone talk to an interface that is in no zone?
No. Zone to no-zone traffic is always dropped. Different zones need a zone-pair policy; the same zone is allowed by default.
review in the notes →2.1 ZBFW actions: inspect vs. pass vs. drop?
inspect is stateful (return traffic allowed automatically). pass is stateless and one-way (needs a mirror rule). drop discards.
review in the notes →2.1 Two ways an NGFW handles malware hidden in TLS?
Decryption policy (Decrypt-Resign outbound, Decrypt-Known Key for your own servers) or the Encrypted Visibility Engine, which fingerprints the TLS handshake without decrypting.
review in the notes →2.1 Where does a firewall do east-west work?
In the data center (and campus): segmentation between app tiers or user groups, stopping lateral movement.
review in the notes →2.2 Why ship logs off the device?
Local logs rotate and overwrite, and attackers delete them to hide. A central, access-controlled copy survives both.
review in the notes →2.2 Why does NTP matter to security monitoring?
Correlating firewall, switch and server logs needs matching timestamps. Authenticate NTP so an attacker can't skew time.
review in the notes →2.2 Syslog severities 0 to 7?
0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, 7 Debugging. Lower number = more severe.
review in the notes →2.2
logging trap 4sends which severities?0 through 4: the configured level and everything more severe.
review in the notes →2.2 Classic syslog transport vs. secure syslog?
Classic: UDP 514, cleartext and unreliable. Secure: TLS on TCP 6514.
review in the notes →2.2 SNMPv3 security levels, and which one to use?
review in the notes →noAuthNoPriv,authNoPriv,authPriv. Use authPriv: authentication (SHA) plus encryption (AES).2.2 SNMP trap vs. inform?
A trap is fire-and-forget. An inform is acknowledged and retransmitted until confirmed.
review in the notes →2.2 MIB vs. OID?
The MIB is the tree (database) of everything a device exposes. An OID is the exact address of one item, e.g.
review in the notes →1.3.6.1.2.1.1.1.0= sysDescr.2.2 SNMP ports?
Polls to the agent on UDP 161. Traps and informs to the manager on UDP 162.
review in the notes →2.2 Is NetFlow a packet capture?
No. It's conversation metadata: key fields (5-tuple, ingress interface, ToS) plus counters (bytes, packets, time). No payload.
review in the notes →2.2 NetFlow v5 vs. v9 vs. IPFIX?
v5: fixed format, IPv4 only. v9: template-based, extensible. IPFIX: the IETF standard based on v9 ("v10"), UDP 4739.
review in the notes →2.2 Flexible NetFlow building blocks?
Flow record (match = key fields, collect = non-key), flow exporter (where to send), flow monitor (record + exporter + cache), applied to an interface.
review in the notes →2.2 What is NSEL?
NetFlow Secure Event Logging: ASA/FTD export firewall connection events (flow-create, flow-teardown, flow-denied) as NetFlow v9.
review in the notes →2.2 SPAN vs. RSPAN vs. ERSPAN?
SPAN: same switch. RSPAN: across L2 switches via an RSPAN VLAN. ERSPAN: GRE-encapsulated across an L3 network.
review in the notes →2.2 Model-driven telemetry: dial-in vs. dial-out?
Dial-in: the collector connects and subscribes (NETCONF, gNMI). Dial-out: the device initiates the stream to a receiver (gRPC).
review in the notes →2.2 Why is streaming telemetry better than SNMP polling at scale?
Devices push structured YANG data periodically or on change: near-real-time, no MIB parsing, more data points, lower device CPU.
review in the notes →2.2 Four FMC event types?
Connection, Security Intelligence, intrusion, and file & malware events.
review in the notes →2.2 How do FMC events reach a SIEM?
Syslog, SNMP traps, eStreamer (high-volume event streaming, used by the Splunk integration) or Cisco Security Analytics and Logging.
review in the notes →2.2 What was Stealthwatch renamed to, and what kind of tool is it?
Cisco Secure Network Analytics: on-prem NDR that turns NetFlow/IPFIX into behavioral detections.
review in the notes →2.2 Secure Network Analytics: Flow Collector vs. Flow Sensor?
Flow Collector receives and stores flow records. Flow Sensor generates flow records from a SPAN/TAP where devices can't export NetFlow.
review in the notes →2.2 What does UDP Director / Cisco Telemetry Broker do?
Receives telemetry once and replicates it to many consumers (SNA, SIEM, others).
review in the notes →2.2 What does Encrypted Traffic Analytics (ETA) do?
Adds handshake-derived fields to flow records so Secure Network Analytics can spot malware in encrypted traffic without decrypting it, and audit crypto in use.
review in the notes →2.2 What extra context does Secure Client NVM add to flow data?
The user, process and device behind each flow, even off-network.
review in the notes →2.2 Where did Secure Cloud Analytics go?
It became part of Cisco XDR.
review in the notes →2.2 ISE vs. pxGrid?
ISE is the context broker (it knows user, device, posture, location). pxGrid is the publish/subscribe fabric that shares that context.
review in the notes →2.2 What is Rapid Threat Containment?
A SIEM, NDR or firewall detects a compromised host and tells ISE over pxGrid; ISE applies an ANC policy via CoA to quarantine it.
review in the notes →2.2 SIEM vs. SOAR?
SIEM ingests, correlates and alerts (the brain). SOAR automates the response with playbooks (the hands).
review in the notes →2.2 EDR vs. NDR vs. XDR?
Endpoint vs. network vs. cross-domain detection and response. Cisco XDR stitches them into one incident.
review in the notes →2.2 Exam stem says "top talkers" or "traffic patterns". NetFlow or telemetry?
NetFlow: it's a record of conversations.
review in the notes →2.2 Exam stem says "real-time, continuous device statistics". NetFlow or telemetry?
Streaming telemetry.
review in the notes →2.2 Sustained, high-volume UDP/53 flow to one external host: what is it likely to be?
DNS tunneling exfiltration (objective 6.5). NetFlow shows it even though it carries no payload.
review in the notes →