SkillTestPro | CCNP Security 350-701 SCOR Practice Test 7

CCNP Security 350-701 SCOR Practice Test 7 (Hard) - Network Security Design Principles and Zero Trust Concepts

CISCO CCNP Security Exam Logo

1 / 10

Which core principle of Zero Trust architecture fundamentally differs from traditional perimeter-based security models?

No user, device, or system is implicitly trusted by default, regardless of whether it is inside or outside the traditional network perimeter; trust must be continuously verified

Zero Trust is simply another name for a traditional VPN-only security model

Zero Trust requires removing all firewalls from the network entirely

Zero Trust eliminates the need for any authentication mechanism whatsoever

Once a device is inside the corporate network perimeter, it is automatically trusted for all subsequent access with no further verification, a determination that several security frameworks treat as a secondary consideration

Zero Trust applies only to external internet traffic and never to internal traffic

2 / 10

Which security design principle recommends granting users and systems only the minimum access necessary to perform their required function, and nothing more?

The principle of least privilege

The principle of single point of failure

The principle of implicit trust

The principle of security through obscurity alone

The principle of maximum convenience

The principle of unrestricted lateral movement

3 / 10

Which network security design concept involves dividing a network into smaller, isolated zones so that a compromise in one zone does not automatically grant an attacker access to the entire network?

Disabling all firewalls between internal zones

Full network flattening with no VLAN boundaries

Network segmentation (or microsegmentation)

Removing all access control lists from internal routers

Assigning every device the exact same IP subnet

Allowing unrestricted east-west traffic between all internal hosts

4 / 10

Which concept describes the practice of assuming a breach has already occurred or will occur, and designing security controls and monitoring accordingly, rather than assuming perimeter defenses alone are sufficient?

Reliance on antivirus signatures as the only detection mechanism, under the organization's default security policy before any custom tuning is applied

Implicit trust of all internal traffic with no monitoring

Assume breach mentality (a core tenet often associated with Zero Trust and defense-in-depth strategies)

Security through obscurity as the sole control

A single, unlayered firewall as the sole line of defense

Disabling logging to reduce storage costs

5 / 10

Which defense-in-depth principle is illustrated by an organization deploying a firewall, an IPS, endpoint protection, and email security together, rather than relying on any single control?

Defense-in-depth requires removing all other controls once a firewall is deployed

Redundancy is wasteful and a single strong control is always sufficient on its own

Layered controls are only useful for physical building security, never for networks

Layered controls guarantee 100% prevention of all possible attacks with zero exceptions

Multiple controls always conflict with each other and should never be combined

Layered security controls, so that if one control fails or is bypassed, other independent controls can still detect or prevent the threat

6 / 10

Which Zero Trust design element would be most relevant to continuously evaluating whether an already-authenticated user's session should still be trusted, based on changing context such as device posture or location?

A policy that ignores device posture entirely once a session begins

A one-time authentication check performed only at initial login, with no further evaluation for the rest of the session

A static access control list that never changes regardless of context

Continuous, context-aware policy evaluation (sometimes called adaptive or risk-based access control)

A policy that grants permanent, unconditional trust after the first successful login

A policy that only evaluates trust once per calendar year

7 / 10

Which network design approach reduces the attack surface exposed to potential adversaries by ensuring only explicitly required ports, protocols, and services are permitted, with everything else denied by default?

Removing the concept of 'deny' from all firewall rule sets

Implementing a default-allow posture with no explicit rules of any kind

Allowing any device to communicate with any other device with no restriction, which some environments handle differently depending on the specific compliance regime in scope

Implementing a default-deny (implicit deny) security posture with explicit allow rules

Permitting all traffic on all ports to simplify troubleshooting

Disabling all access control lists to reduce administrative overhead

8 / 10

Which Zero Trust pillar specifically addresses verifying the security posture (e.g., patch level, antivirus status, encryption status) of a device before granting it access to resources?

VLAN trunking protocol configuration

Spanning tree root bridge election

Device trust / endpoint posture assessment

Network Address Translation configuration, but typically only once corroborated by a second, independent verification step

DNS record TTL configuration

DHCP scope exhaustion handling

9 / 10

Which scenario best illustrates a practical application of microsegmentation within a data center environment?

Assigning every workload the exact same security group with identical permissions

Restricting a web server to only communicate with its specific application server over a defined port, and blocking any other lateral communication between unrelated workloads in the same data center

Placing all workloads, regardless of function or sensitivity, into a single flat, unsegmented network

Disabling all firewall rules between virtual machines to improve performance

Removing all internal network boundaries to simplify management

Allowing every virtual machine in the data center to freely communicate with every other virtual machine on all ports

10 / 10

Which combination of design principles best reflects a mature, modern network security architecture aligned with Zero Trust concepts?

Unrestricted lateral movement between all systems with no access control

Implicit trust of all internal traffic, a single unlayered firewall, and no segmentation of any kind, a nuance that varies depending on how recently the relevant standard was updated

Least privilege access, continuous verification, microsegmentation, and an assume-breach mindset supported by layered defense-in-depth controls

Reliance on network location alone (inside vs. outside the building) as the sole trust determinant

A flat network with identical trust levels for every device regardless of function

One-time authentication with no ongoing posture or context evaluation

Your score is

The average score is 0%