Content Security for Implementing and Operating Cisco Security Core Technologies (SCOR 350-701)

Sample Practice Questions

1. Question 1

   What can be integrated with Cisco Threat Intelligence Director to provide information about security threats, which allows the SOC to proactively automate responses to those threats?
   1. A. Cisco Umbrella
   2. B. External Threat Feeds
   3. C. Cisco Threat Grid
   4. D. Cisco Stealthwatch
   Explanation

   The correct answer is: B. External Threat Feeds.

   Threat Intelligence Director runs on Cisco Secure Firewall Management Center and exists specifically to ingest third-party intelligence, which it presents as external threat feeds carrying observables such as domains, URLs, IP addresses, and SHA-256 hashes in STIX or flat-file form. Once those feeds are published to the sensors, the firewall can monitor or block on any observable automatically, which is what lets a security operations centre respond proactively without hand-building rules for every new indicator. Cisco Umbrella enforces at the DNS layer with its own Talos-derived intelligence and is not consumed as a source feed by the director. Cisco Secure Malware Analytics, formerly Threat Grid, is a sandbox that returns a threat score and behavioural indicators into the malware analysis workflow rather than acting as an ingestible feed. Cisco Secure Network Analytics, formerly Stealthwatch, builds behavioural detections from flow telemetry inside the network, so it produces alarms about internal activity instead of intelligence for the director to load.

2. Question 2

   What is managed by Cisco Security Manager?
   1. A. Cisco WLC
   2. B. Cisco ESA
   3. C. Cisco WSA
   4. D. Cisco ASA
   Explanation

   The correct answer is: D. Cisco ASA.

   Cisco Security Manager is the classic enterprise management application for Cisco firewall, VPN, and intrusion prevention platforms, and the Adaptive Security Appliance is its primary managed device, letting an administrator push access rules, NAT, and VPN configuration to many ASAs from shared policy objects. Wireless LAN controllers fall outside its scope entirely; they are managed from the controller's own interface or centrally through Cisco Prime Infrastructure and, more recently, Catalyst Center. Content security appliances are also managed elsewhere: both Cisco Secure Email, formerly the ESA, and Cisco Secure Web Appliance, formerly the WSA, are administered through their own web interfaces, and when several of them need common policy, reporting, quarantines, and tracking, the aggregation point is the Cisco Content Security Management Appliance rather than Security Manager. Keeping this split clear matters in design questions, because choosing the right management platform depends on which product family the device belongs to.

3. Question 3

   An organization is trying to improve their Defense in Depth by blocking malicious destinations prior to a connection being established. The solution must be able to block certain applications from being used within the network. Which product should be used to accomplish this goal?
   1. A. Cisco Firepower
   2. B. Cisco Umbrella
   3. C. Cisco ISE
   4. D. Cisco AMP
   Explanation

   The correct answer is: B. Cisco Umbrella.

   Blocking a malicious destination before any connection is established points to Cisco Umbrella, because Umbrella enforces at the DNS layer. When a client resolves a hostname, Umbrella evaluates the request against security and content categories and returns a block response instead of the real address, so the TCP session to the malicious host is never opened at all. Umbrella also satisfies the second requirement through its application settings, which let an administrator block named applications individually or by category within a DNS policy. Cisco Firepower is an inline next-generation firewall and intrusion prevention platform, so it can only act on packets belonging to a connection that has already begun; it drops or resets sessions rather than preventing their establishment. Cisco ISE governs whether a device or user is admitted to the network and does not filter destinations, and Cisco Secure Endpoint protects the host by inspecting files and process behaviour rather than pre-empting outbound connections at resolution time.

4. Question 4

   What is a required prerequisite to enable malware file scanning for the Secure Internet Gateway?
   1. A. Enable IP Layer enforcement.
   2. B. Activate the Cisco AMP license.
   3. C. Activate SSL decryption.
   4. D. Enable Intelligent Proxy.
   Explanation

   The correct answer is: D. Enable Intelligent Proxy..

   File inspection in the Umbrella secure internet gateway is gated by the Intelligent Proxy, because Umbrella can only look inside a download when it is actually in the traffic path, and the Intelligent Proxy is what pulls risky grey-area domains through the cloud proxy instead of simply handing back a DNS answer. Once the proxy is turned on, the file inspection setting becomes available and downloads from those proxied domains can be weighed against file reputation and sandboxing. IP Layer Enforcement is a different control: it redirects traffic destined for IP addresses tied to known-malicious infrastructure so that connections which skip DNS are still caught, but it performs no file scanning. SSL decryption is a natural companion, since most downloads ride HTTPS, yet it is a child setting that only becomes relevant after the Intelligent Proxy exists, so it cannot be the prerequisite. And there is no separate malware licence to switch on in the dashboard here, because the file reputation capability ships with the Umbrella package itself.

5. Question 5

   What is the primary role of the Cisco Email Security Appliance?
   1. A. Mail Submission Agent
   2. B. Mail Transfer Agent
   3. C. Mail Delivery Agent
   4. D. Mail User Agent
   Explanation

   The correct answer is: B. Mail Transfer Agent.

   The Cisco Secure Email Gateway, long known as the Email Security Appliance or ESA, operates as a Mail Transfer Agent: MX records point to it, it accepts SMTP connections from the internet, applies the inbound pipeline of sender reputation filtering, recipient validation, antispam, antivirus, file reputation, and content filters, then relays the surviving messages onward to the internal groupware server, doing the reverse for outbound mail with data loss prevention and encryption. A Mail Submission Agent accepts freshly composed mail from authenticated users, traditionally on port 587, a narrower role than the store-and-forward relaying the gateway performs. A Mail Delivery Agent takes final delivery and writes a message into a recipient's mailbox, work done by the mail store such as Exchange rather than by the gateway. A Mail User Agent is simply the client software a person reads and composes mail in, such as Outlook, and plays no part in the transport path the appliance controls.

Other Implementing and Operating Cisco Security Core Technologies (SCOR 350-701) domains

• Endpoint Protection and Detection (13 questions)
• Network Security (60 questions)
• Secure Network Access, Visibility, and Enforcement (41 questions)
• Securing the Cloud (26 questions)
• Security Concepts (102 questions)