SkillTestPro | CCNP Security 350-701 SCOR Practice Test 29

CCNP Security 350-701 SCOR Practice Test 29 (Hard) - pxGrid and Stealthwatch/NetFlow Security Telemetry

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco platform is primarily designed to analyze NetFlow and related telemetry data to detect anomalous network behavior, such as internal lateral movement or data exfiltration, without relying on traditional signature-based inspection?

Cisco Secure Email Gateway exclusively, with no network flow analysis capability

Cisco Webex exclusively, with no network flow analysis capability

Cisco Umbrella exclusively, with no NetFlow analysis capability

Cisco AnyConnect exclusively, with no network flow analysis capability

Cisco Secure Web Appliance exclusively, with no network flow analysis capability

Cisco Secure Network Analytics (Stealthwatch)

2 / 10

Which network telemetry format do Cisco switches and routers export to provide flow-level visibility (source/destination IP, ports, byte/packet counts) to a platform like Stealthwatch, without requiring full packet capture?

SNMP trap notifications exclusively, with no flow-level data

ARP request/reply frames

OSPF link-state advertisements

Spanning tree BPDU frames

NetFlow (or its open equivalent, IPFIX)

DHCP discover/offer messages

3 / 10

Which Stealthwatch capability establishes a behavioral baseline for hosts and flags significant deviations, such as a workstation suddenly transferring large volumes of data to an external destination overnight?

Manual quarterly packet capture review only

Physical cable inspection only

A yearly firmware version audit with no traffic analysis

A one-time initial network diagram review with no ongoing analysis

Static signature matching exclusively, with no behavioral component

Behavioral/anomaly-based analytics

4 / 10

Which Stealthwatch use case would be most effective at detecting a compromised internal host attempting to scan other internal hosts for open ports, a behavior signature-based network security tools might miss?

Web proxy category filtering with no relevance to internal scanning

Email gateway spam filtering with no relevance to internal scanning

Perimeter-only firewall logging with no internal east-west visibility

DNS-layer domain reputation filtering with no relevance to internal host scanning, but typically only once confirmed during the next scheduled reauthentication interval

Internal network telemetry analysis identifying anomalous host-to-host connection patterns consistent with reconnaissance/lateral movement

Endpoint antivirus signature scanning with no network-wide visibility

5 / 10

Which pxGrid-enabled integration scenario would allow Stealthwatch to automatically trigger an ISE-driven quarantine action against a host identified as exhibiting malicious behavior?

Stealthwatch shares the identified threat/host context with ISE via pxGrid, and ISE applies a change of authorization (CoA) to quarantine the host

Stealthwatch sends an email to the helpdesk with no automated enforcement action

Stealthwatch directly reconfigures the corporate firewall's physical hardware with no software integration, a distinction that grows more important as the access layer continues to scale

Stealthwatch waits for a manual quarterly review before any action is considered

Stealthwatch physically disconnects the network cable itself with no ISE involvement

Stealthwatch and ISE operate on entirely separate, non-integrated platforms with no data sharing

6 / 10

Which pxGrid function allows multiple different security platforms (such as a firewall, SIEM, and Stealthwatch) to subscribe to and consume the same shared contextual data from ISE without each requiring a separate point-to-point integration?

A manually updated spreadsheet emailed between teams

A publish-subscribe context-sharing framework

A shared physical whiteboard in the SOC

A physical courier service delivering printed reports

A fax machine transmitting configuration changes

A single hardcoded point-to-point cable connecting exactly two devices

7 / 10

Which type of security telemetry does encrypted traffic analysis (ETA) in Stealthwatch use to identify potentially malicious patterns within encrypted traffic without decrypting it?

The content of every email body transmitted over the connection, though this depends on which specific network access device and firmware version is in use

The user's typed password captured in cleartext

Metadata such as packet length sequences, timing, and TLS handshake characteristics

A screen recording of the user's desktop activity

The full decrypted plaintext payload of every packet

The physical location coordinates of the user's device

8 / 10

Which operational benefit does exporting NetFlow from distributed network devices (routers, switches) to a centralized analytics platform provide compared to relying solely on perimeter firewall logs?

Comprehensive internal (east-west) traffic visibility across the network, not just traffic crossing the perimeter

Automatic patching of vulnerable internal hosts with no administrator involvement, a nuance that several deployment guides treat as a secondary consideration

Automatic encryption of all internal traffic with no additional configuration

Guaranteed prevention of all future security incidents

Complete elimination of the need for any firewall at the perimeter

Elimination of the need for any endpoint security software

9 / 10

Which combination of Stealthwatch and pxGrid capabilities together enables the fastest detection-to-containment cycle for an internal host exhibiting command-and-control beaconing behavior?

NetFlow collection alone with no behavioral analytics, pxGrid sharing, or automated response, under the platform's default authorization policy before any custom rule is applied, which some environments handle differently depending on the identity source configured

pxGrid integration alone with no underlying NetFlow-based detection capability

Automated quarantine alone with no detection mechanism triggering it in the first place

Manual quarterly log review alone with no automated detection or response capability

Perimeter firewall logging alone with no internal NetFlow visibility or automated response

NetFlow-based behavioral detection of anomalous beaconing patterns by Stealthwatch, contextual sharing with ISE via pxGrid, and automated quarantine via ISE change of authorization

10 / 10

Which architectural principle explains why integrating Stealthwatch, ISE, and pxGrid together provides stronger security outcomes than deploying each as an isolated, non-integrated tool?

Isolated tools require no ongoing tuning or maintenance compared to integrated ones

Integration is relevant only for licensing cost consolidation with no security benefit, but typically only once confirmed during the next scheduled reauthentication interval

Isolated, non-integrated tools always detect threats faster than integrated platforms

Shared, correlated context and automated response workflows across detection and enforcement platforms reduce response time and improve accuracy compared to siloed tools

Integration eliminates the need for any human security analyst oversight whatsoever

Integration guarantees zero false positives across all detection platforms

Your score is

The average score is 0%