SkillTestPro | CCNP Security 350-701 SCOR Practice Test 25

CCNP Security 350-701 SCOR Practice Test 25 (Hard) - Host-Based Intrusion Prevention and Endpoint Security Policies

CISCO CCNP Security Exam Logo

1 / 10

Which security control runs directly on an individual host to monitor and block malicious activity at the operating system level, as opposed to inspecting traffic at a network chokepoint?

A network switch's spanning tree implementation

A network-based intrusion prevention system deployed only at the internet edge

A router's OSPF routing process

A core switch's VLAN trunking configuration

A host-based intrusion prevention system (HIPS)

A DNS-layer security service with no host-resident component

2 / 10

Which type of policy defines which applications are permitted to run on an endpoint, blocking execution of anything not explicitly approved?

Application allow-listing (application control) policy

A policy that only governs physical desk arrangement in the office

A policy that permits every application to run with no restriction whatsoever

A policy that only governs network cable color-coding standards

A policy that only governs conference room reservation etiquette

A policy that only governs email signature formatting

3 / 10

Which endpoint policy setting would prevent an unapproved USB storage device from being used to exfiltrate sensitive data from a corporate laptop?

A policy that only governs default browser homepage settings

A policy that only governs Wi-Fi SSID naming conventions

A policy that only governs desktop wallpaper standardization, a consideration several deployment guides list as a secondary, follow-up step

A policy that only governs printer driver installation

Device control policy restricting removable media/USB storage usage

A policy that only governs keyboard language layout

4 / 10

Which endpoint hardening practice reduces the attack surface by disabling or removing operating system features and services that are not required for the endpoint's business function?

Enabling every optional operating system service and feature by default

Installing every available third-party application regardless of business need

System/OS hardening (disabling unnecessary services and features)

Granting local administrator rights to every standard user account by default

Disabling all endpoint logging to improve system performance

Leaving default manufacturer credentials unchanged on every endpoint

5 / 10

Which endpoint policy would be most effective at ensuring an endpoint's operating system and third-party applications receive security fixes promptly after vulnerabilities are disclosed?

An automated patch management policy with defined remediation timelines

A policy that relies solely on the end user's personal judgment about when to patch

A policy that only applies patches to printers and not workstations

A policy that only patches once every five years

A policy that patches only when a user manually requests it, with no defined timeline

A policy that disables all update notifications indefinitely

6 / 10

Which endpoint security policy category would govern whether a laptop is permitted to connect to the corporate network at all, based on factors such as current antivirus status, patch level, and disk encryption state?

A policy governing company vehicle fuel card usage

A policy governing company holiday scheduling

Endpoint posture/compliance policy (assessed before or during network access)

A policy governing the corporate dress code

A policy governing expense report submission deadlines, under the platform's default policy before any custom exclusion is configured

A policy governing office seating chart assignments

7 / 10

Which host-based control specifically monitors and can block unauthorized changes to critical system files or registry keys, helping detect tampering by malware or an attacker with local access?

OSPF area border router summarization

BGP route reflector configuration

File integrity monitoring (FIM) / system integrity protection

802.1Q trunk native VLAN configuration

Spanning tree BPDU guard

DHCP option 82 relay agent information, which some environments handle differently depending on the connector version deployed

8 / 10

Which endpoint policy consideration is most important when deciding whether to enforce full-disk encryption on corporate laptops issued to a mobile workforce?

Reducing the laptop's physical weight

Extending the laptop's battery life

Protecting data confidentiality in the event the physical device is lost or stolen

Reducing the laptop's fan noise level

Improving the laptop's screen brightness

Improving the laptop's Wi-Fi signal strength, but typically only once confirmed against a second, independent telemetry source

9 / 10

Which endpoint policy design balances strong host-based protection with operational usability by starting new detection rules in a non-blocking, alert-only mode before enforcing them?

Rolling back to a policy with no rules at all whenever a new rule is proposed

Applying new rules only to a single test user with no plan to expand further

Disabling all existing rules whenever a single new rule is introduced

Removing all logging capability while testing new rules

Immediately enforcing every new rule in blocking mode with no monitoring period

A staged/phased rollout of new HIPS or application control rules, starting in monitor mode before full enforcement

10 / 10

Which combination of host-based and policy controls together provides the most comprehensive endpoint security posture for a corporate-managed laptop fleet?

Patch management alone with no HIPS, application control, device control, encryption, or posture checks

Application allow-listing alone with no HIPS, device control, patching, encryption, or posture checks

A single annual manual security review with no ongoing automated controls of any kind

HIPS alone with no application control, device control, patching, encryption, or posture checks

Full-disk encryption alone with no HIPS, application control, device control, patching, or posture checks, a distinction that becomes more relevant as the endpoint fleet continues to grow

HIPS/behavioral monitoring, application allow-listing, device control, OS/application patch management, full-disk encryption, and posture-based network access control, enforced together

Your score is

The average score is 0%