350-701 SCOR: Implementing and Operating Cisco Security Core TechnologiesDemo

Cisco Cloudlock is Cisco’s cloud-native cloud access security broker (CASB) and cloud cybersecurity platform, designed to protect cloud users, data, and applications.

Cisco WSA configures AVC application controls in Access Policy groups, where individual applications, application types, and supported application behaviors can be allowed or blocked. Cisco Secure Web Appliance User Guide: Managing Access to Web Applications

Cisco ISE’s Profiler function uses network probes to collect endpoint attributes and provide them to the Profiler analyzer for endpoint classification. These probes can collect information through sources such as DHCP, RADIUS, HTTP, SNMP, and NetFlow.

The redirect ACL matches traffic originating from the inside subnet, 192.168.100.0/24, and from the DMZ subnet, 172.16.10.0/24, because that DMZ subnet is contained within 172.16.0.0/16. The globally applied service policy redirects traffic that matches either ACL entry.

Application Visibility and Control uses deep packet inspection to identify and classify applications in network traffic, enabling application-level visibility and traffic-control policies.

Inbound and outbound email traffic is segregated by configuring two separate listeners on two physically separate interfaces, with two logical IPv4 addresses and two IPv6 addresses—one IPv4 and one IPv6 address assigned to each listener.

A device must be registered with Firepower Management Center using a unique alphanumeric registration key configured on both the device and the management center. Cisco documentation states that this key is always required for registration.

Cisco Secure Web Appliance caches the authenticated username and group memberships. Consequently, an Active Directory group-membership change is not applied to an already authenticated session; the session continues under the permissions established at login until the session/cache is refreshed or cleared.

Unencrypted network links transmit traffic without confidentiality protection, allowing an attacker who intercepts the traffic to read passwords sent in clear text.

A next-generation firewall supports application-aware policy enforcement: it identifies applications from their inherent characteristics rather than relying only on ports and protocols, then applies granular security policies to allow or deny the associated traffic. Palo Alto Networks: Use Application Objects in Policy

Web Cache Communication Protocol (WCCP) transparently redirects selected traffic from a router to a Cisco Secure Web Appliance, where services such as URL filtering and inspection can be applied.

Cisco ASA split tunneling can use a tunnel-specified policy and network list to send traffic for only the specified corporate network through the VPN tunnel. Configuring 10.0.0.0/24 as that network keeps non-corporate, internet-bound traffic off the ASA headend while retaining VPN access to HQ resources.

DNS tunneling encodes stolen data into DNS-query fields, typically subdomains, and transmits it in small chunks through DNS requests. The receiving attacker-controlled DNS infrastructure can reassemble those chunks into the exfiltrated payload. MITRE ATT&CK documents exfiltration by encoding data in DNS subdomains and prepending it to an attacker-controlled domain.

DHCP snooping rate-limits DHCP traffic and requires the interface connected to a legitimate DHCP server to be configured as trusted. Trusted server-facing interfaces allow valid DHCP server messages to pass, whereas untrusted interfaces are subject to filtering and rate limiting.

For SNMPv3 notifications, the snmp-server host command specifies version 3 followed by the SNMPv3 username. andy is the configured user, while myv3 is that user’s group name; the host command must reference andy.

BYOD onboarding (via Cisco ISE) is the workflow that provisions a personal/mobile device for network access: the Native Supplicant Provisioning flow (Network Setup Assistant) generates and installs a client certificate and automatically configures the device's 802.1X supplicant. MAC Authentication Bypass (B) is for endpoints that cannot run a supplicant. Client provisioning (C) delivers the posture agent, not the certificate/supplicant onboarding. SCEP (D) is only the underlying protocol used to enroll certificates and does not by itself configure the supplicant. So A is correct.

GRE provides tunneling and packet encapsulation but no native encryption or authentication, so it requires IPsec when used as a secure VPN solution. L2TP is a tunneling protocol that can operate independently, although it is commonly paired with IPsec for security. Microsoft documents GRE as IP protocol 47 and L2TP as UDP port 1701.

3DES is a symmetric encryption algorithm that encrypts and decrypts data or traffic using the DES cipher operation three times.

A cloud data breach involves private or sensitive information being exposed, disclosed, or leaked without authorization.

Cisco Umbrella destination lists contain custom internet destinations, such as domains and URLs, that can be explicitly blocked or allowed by policy.

Two-factor authentication strengthens SaaS account access by requiring an additional verification factor beyond a password, reducing the risk that compromised credentials alone can be used to access the application.

For a file with insufficient reputation information to receive a definitive verdict, Cisco ESA uses its reputation score. The configured mail-policy action is applied only when that score meets or exceeds the configured reputation threshold; a score below the threshold is not dropped.

Cisco WSA transparent user identification with Active Directory requires an NTLM or Kerberos authentication realm with transparent identification enabled. It also uses a separate Active Directory agent, such as Cisco Context Directory Agent, to query Active Directory security-event logs and provide IP-address-to-user mappings. Cisco’s newer guidance notes that CDA is no longer supported and recommends ISE/ISE-PIC for that function.