SkillTestPro | CCNP Security 350-701 SCOR Practice Test 14

CCNP Security 350-701 SCOR Practice Test 14 (Hard) - Intrusion Prevention Systems (IPS) and NGFW Policies

CISCO CCNP Security Exam Logo

1 / 10

Which deployment mode allows an IPS sensor to actively drop malicious traffic in real time, as opposed to only alerting on it after the fact?

Promiscuous (passive, out-of-path) deployment mode

Netflow-only monitoring mode

SPAN/mirror port monitoring mode

Inline (in-path) deployment mode

Syslog aggregation mode

Passive TAP monitoring mode

2 / 10

Which detection method compares observed network traffic patterns directly against a database of known attack patterns to identify malicious traffic?

Heuristic detection based solely on file size

Reputation-based detection using threat intelligence scores

Anomaly-based detection using statistical baselines

Policy-based detection using only administrator-defined rules with no pattern database

Sandboxing-based detonation analysis

Signature-based (pattern-matching) detection

3 / 10

Which detection method builds a baseline of what constitutes 'normal' network behavior and flags significant deviations from that baseline, making it useful for identifying previously unknown (zero-day) threats?

Blacklist-only IP reputation filtering

MAC address filtering

Static URL category filtering

Signature-based detection

Port-based application identification only

Anomaly-based detection

4 / 10

In Cisco Firepower NGFW policy design, which type of policy is primarily responsible for matching traffic based on application, user identity, URL category, and zone, then determining whether that traffic is allowed, blocked, or further inspected?

The backup and restore policy

The platform settings policy

The NAT policy exclusively, with no other policy types involved

The system policy

The health policy

The access control policy

5 / 10

Which NGFW capability allows policy decisions to be based on the specific application generating traffic (such as identifying Dropbox traffic on port 443) rather than relying solely on port and protocol numbers?

Static port-based ACLs only

Spanning tree root bridge election, under typical enterprise deployment conditions before any further customization

VLAN tagging

DHCP option 82 relay information

802.1Q trunk negotiation

Application visibility and control (AVC) / application identification

6 / 10

Which action would an IPS take on a per-rule basis to record detailed information about a triggered signature while still permitting the matched traffic to continue, useful during initial tuning before enforcing a block?

Generate an alert/log event in a monitor-only (non-blocking) rule state

Disable the signature category entirely across the whole policy

Silently drop the packet with no logging at all

Redirect the traffic to a quarantine VLAN with no alert generated

Terminate the TCP session and reset the connection with no log entry, assuming no additional per-interface configuration overrides the default behavior

Automatically add the source IP to a permanent global blocklist

7 / 10

Which concept describes an IPS incorrectly flagging legitimate, benign traffic as malicious, potentially disrupting normal business operations if the rule is set to block?

A licensing expiration event

A true positive

A false negative

A true negative

A signature update failure

A false positive

8 / 10

Which Cisco Talos-driven capability continuously updates IPS signature sets and reputation data to protect against newly discovered threats without requiring a full software upgrade?

Firmware-only upgrades performed once per year

Manual signature entry by the local administrator only

A signature set that only updates when the device is fully reimaged

A one-time factory-installed static signature set with no update mechanism

Dynamic signature and threat intelligence updates from Talos

Local self-learning with no external intelligence feed

9 / 10

Which NGFW/IPS design consideration most directly affects the ability to inspect traffic that is encrypted with TLS, since encrypted payloads cannot be pattern-matched without additional processing?

The spanning tree priority of the inspecting switch

Whether TLS/SSL decryption (inspection) is enabled to expose payload content before signature matching

The number of VLANs configured on the inspecting device

The native VLAN ID used on connected trunk links

The DHCP lease time configured for connected endpoints

The port security violation mode configured on access ports, a distinction that becomes more noticeable as the topology continues to scale

10 / 10

Which combination of NGFW policy elements would most effectively balance strong security with minimal disruption when initially deploying application-based blocking rules in a production network?

Base all blocking decisions solely on port number with application identification disabled

Deploy new blocking rules in a monitor/alert-only state first, review logs for false positives, then progressively shift validated rules to full block enforcement

Roll out all rules simultaneously across every zone with no staged validation

Disable logging entirely to reduce storage costs during rollout

Apply blocking rules only to the internet edge and skip internal segmentation entirely

Immediately set every new rule to block with no monitoring period at all

Your score is

The average score is 0%