Implementing and Operating Cisco Security Core Technologies (SCOR)654 questions across 66 pages are complete and free, with no account or card.
654 questions in this bank
Free access · progress saved on this device
What is a feature of Cisco NetFlow Secure Event Logging for Cisco ASAs?
Answer: A
A is the answer. While events can be delayed they are not delayed by default. The flow-create event is exported as soon as the flow is created if the flow-export delay flow-create command is not configured.
Source: Adapted from community discussion — Reece_S
What is a key difference between Cisco Firepower and Cisco ASA?
Answer: D
Cisco Firepower and Cisco ASA are both network security products offered by Cisco, but they have different capabilities and are typically used for different purposes. Cisco ASA (Adaptive Security Appliance) is a firewall and VPN device that provides perimeter security for networks. It can be used to control access to resources, block unauthorized traffic, and create secure VPN connections. ASA does not provide intrusion prevention capabilities, it is focused on network perimeter security. Cisco Firepower, on the other hand, is a more advanced security product that provides both firewall and intrusion prevention capabilities. It is designed to protect networks from advanced threats, such as malware and zero-day attacks. Firepower uses a combination of technologies, such as threat intelligence and machine learning, to detect and block malicious traffic. Firepower includes features such as advanced malware protection, threat hunting, and incident response capabilities.
Source: Adapted from community discussion — sull3y
Which two mechanisms are used to control phishing attacks? (Choose two.)
Answer: AE
A. Enable browser alerts for fraudulent websites. E. Implement email filtering techniques. Phishing attacks are attempts to trick individuals into providing sensitive information such as passwords or credit card numbers by disguising as a trustworthy entity. Two common mechanisms used to control phishing attacks are: Enable browser alerts for fraudulent websites: Some web browsers have built-in phishing filters that can detect and warn users when they visit a potentially fraudulent website. Implement email filtering techniques: Email filters can help to identify and block phishing emails from reaching the inbox by using techniques such as keyword filtering, bayesian filtering, and sender reputation analysis.
Source: Adapted from community discussion — sull3y
DRAG DROP - Drag and drop the suspicious patterns for the Cisco Tetration platform from the left onto the correct definitions on the right. Select and Place:
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
Privilege escalation: Watches for privilege changes from a lower privilege to a higher privilege in the process lineage tree. User login suspicious behavior: Cisco Secure Workload platform watches user login failures and user login methods. Interesting file access: Cisco Secure Workload platform can be armed to look at sensitive files. File access from a different user: Cisco Secure Workload platform learns the normal behavior of which file is accessed by which user. https://www.cisco.com/c/en/us/products/collateral/data-center-analytics/tetration-analytics/white-paper-c11-740380.html
Source: Adapted from community discussion — Kyle1776
What is a benefit of using Cisco FMC over Cisco ASDM?
Answer: B
Let's not complicate the question. Main questions is "what is the benefit". FMC does provide centralized management of FTDs/FirePOWER service(note that FMC cannot manage ASA) while ASDM can only manage one ASA w/ FirePOWER service at a time.
Source: Adapted from community discussion — pr0fectus
Which product allows Cisco FMC to push security intelligence observable to its sensors from other products?
Answer: A
How does it work? As shown in the image, on the FMC you have to configure sources from where you would like to download threat intelligence information. The FMC then pushes that information (observables) to sensors. When the traffic matches the observables, the incidents appear in the FMC user interface (GUI). https://www.cisco.com/c/en/us/support/docs/storage-networking/security/214859-configure-and-troubleshoot-cisco-threat.html
Source: Adapted from community discussion — freddycisco
A Cisco FirePower administrator needs to configure a rule to allow a new application that has never been seen on the network. Which two actions should be selected to allow the traffic to pass without inspection? (Choose two.)
Answer: DE
D & E Rule 1: Monitor evaluates traffic first. Monitor rules track and log network traffic. The system continues to match traffic against additional rules to determine whether to permit or deny it. (However, see an important exception and caveat at Access Control Rule Monitor Action.) Rule 2: Trust evaluates traffic next. Matching traffic is allowed to pass to its destination without further inspection, though it is still subject to identity requirements and rate limiting. Traffic that does not match continues to the next rule. Rule 3: Block evaluates traffic third. Matching traffic is blocked without further inspection. Traffic that does not match continues to the final rule. Rule 4: Allow is the final rule. For this rule, matching traffic is allowed; however, prohibited files, malware, intrusions, and exploits within that traffic are detected and blocked. Remaining non-prohibited, non-malicious traffic is allowed to its destination, though it is still subject to identity requirements and rate limiting. You can configure Allow rules that perform only file inspection, or only intrusion inspection, or neither.
Source: Adapted from community discussion — Jayde
What is a characteristic of a bridge group in a Cisco ASA Firewall running in transparent mode?
Answer: C
A bridge group is a group of interfaces that the ASA bridges instead of routes. Bridge groups are only supported in Transparent Firewall Mode. Like any other firewall interfaces, access control between interfaces is controlled, and all of the usual firewall checks are in place. Each bridge group includes a Bridge Virtual Interface (BVI). The ASA uses the BVI IP address as the source address for packets originating from the bridge group. The BVI IP address must be on the same subnet as the bridge group member interfaces. The BVI does not support traffic on secondary networks; only traffic on the same network as the BVI IP address is supported. Only bridge group member interfaces are named and can be used with interface-based features. https://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/cli/general/asa-94-general-config/intro-fw.html#ID-2106-00000012 While we can use BVIs for Firewall Management purposes, it isn't ONLY used for management. Answer C seems correct
Source: Adapted from community discussion — getafix
While using Cisco Firepower's Security Intelligence policies, which two criteria is blocking based upon? (Choose two.)
Answer: AB
"Block specific IP addresses, URLs, or domain names using a manually-created list or feed (for IP addresses, you can also use network objects or groups.)" Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/security_intelligence_blacklisting.html#ID-2192-0000002b
Source: Adapted from community discussion — idto
What features does Cisco FTDv provide over Cisco ASAv?
Answer: D
Reference: https://www.ciscolive.com/c/dam/r/ciscolive/apjc/docs/2018/pdf/BRKSEC-2064.pdf
Source: Adapted from community discussion — sull3y
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
350-701 practice, question 11. 654 questions available.
Version 1.0.0. How we source questions