Free 350-701 Practice Test Questions and Answers (2026)

Distributed Denial of Service (DDoS) attacks are broadly classified into three main categories based on the network layer they target. Volume-based (or volumetric) attacks aim to consume all available bandwidth between the target and the internet. Protocol attacks focus on consuming the processing capacity of network infrastructure components like firewalls or load balancers by exploiting vulnerabilities in Layer 3 and Layer 4 protocols. The third category, not listed as an option, is application-layer attacks, which target specific application vulnerabilities.

A. sequential: This term describes a pattern or order of events, not a recognized category of DDoS attacks.

C. database: A database is a potential target of an application-layer DDoS attack, but it is not a fundamental attack category itself.

E. screen-based: This is not a standard term used in the classification of network security attacks like DDoS.

1. Cisco. (n.d.). What Is a Distributed Denial-of-Service (DDoS) Attack? Cisco. Retrieved from Cisco's public documentation. In the section "Common types of DDoS attacks

" the document explicitly lists the three main categories: "The most common types of DDoS attacks are: Volumetric attacks... Protocol attacks... Application layer attacks." This directly supports the selection of 'volume-based' and 'protocol' as correct categories.

2. Radware. (2013). DDoS Attack Types. In The Ultimate Guide to DDoS Attack Types

Motivations

and Mitigation Methods (p. 4). Radware Security. This document

often referenced in security curricula

outlines the three primary attack vectors: "Volume Based Attacks

" "Protocol Attacks

" and "Application Layer Attacks."

3. MIT OpenCourseWare. (2014). Lecture 15: Network Security & Denial of Service. In 6.858 Computer Systems Security

Fall 2014. Massachusetts Institute of Technology. The lecture notes discuss various DoS attacks that fall into the protocol (e.g.

SYN flooding) and volumetric (e.g.

amplification attacks) categories

establishing these as fundamental classifications in an academic context.

:

Multifactor authentication (MFA) is an authentication method that requires the user to provide two

or more verification factors to gain access to a resource such as an application, online account, or a

VPN1. MFA is a core component of a strong identity and access management (IAM) policy. MFA can

help prevent an attacker from stealing usernames and passwords of users within an organization by

adding an extra layer of security beyond the traditional username and password. For example, a user

may need to enter a one-time code sent to their phone or email, scan their fingerprint, or use a

hardware token to prove their identity. This way, even if an attacker obtains the user’s credentials,

they cannot access the resource without the second factor2.

The other options are not technologies that can help prevent an attacker from stealing usernames

and passwords of users within an organization. RADIUS-based REAP is a protocol that allows wireless

clients to authenticate with a RADIUS server, but it does not provide MFA3. Fingerprinting is a

technique that identifies the operating system or application of a device based on its network

characteristics, but it does not provide MFA4. Dynamic ARP Inspection is a security feature that

prevents ARP spoofing attacks by validating ARP packets, but it does not provide MFA5.

Reference := 1: What is Multi-Factor Authentication (MFA)? |

OneLogin(https://www.onelogin.com/learn/what-is-mfa) 2: What is: Multifactor Authentication -

Microsoft Support(https://support.microsoft.com/en-us/topic/what-is-multifactor-authenticatione5e39437-121c-be60-d123-eda06bddf661) 3: Implementing and Operating Cisco Security Core

Technologies (SCOR) v1.0, Module 3: Securing the Network, Lesson 3.3: Secure Wireless Connectivity,

Topic 3.3.1: Wireless Security Protocols, page 3-40. 4: Implementing and Operating Cisco Security

Core Technologies (SCOR) v1.0, Module 2: Securing the Cloud, Lesson 2.2: Cloud Security

Assessment, Topic 2.2.1: Cloud Security Concepts, page 2-13. 5: Implementing and Operating Cisco

Security Core Technologies (SCOR) v1.0, Module 3: Securing the Network, Lesson 3.2: Secure

Network Access, Topic 3.2.2: Layer 2 Security Features, page 3-19.

According to the NIST 800-145 guide1, a community cloud is a cloud infrastructure that is provisioned

for exclusive use by a specific community of consumers from organizations that have shared concerns

(e.g., mission, security requirements, policy, and compliance considerations). It may be owned,

managed, and operated by one or more of the organizations in the community, a third party, or some

combination of them, and it may exist on or off premises. A community cloud differs from a private

cloud, which is provisioned for exclusive use by a single organization, and a public cloud, which is

provisioned for open use by the general public. A hybrid cloud is a composition of two or more

distinct cloud infrastructures (private, community, or public) that remain unique entities, but are

bound together by standardized or proprietary technology that enables data and application

portability (e.g., cloud bursting for load balancing between clouds). Reference := 1: NIST SP 800-145,

The NIST Definition of Cloud Computing, page 3.

Asymmetric encryption, also known as public-key cryptography, is a type of encryption that uses a

pair of keys to encrypt and decrypt data. The pair of keys includes a public key, which can be shared

with anyone, and a private key, which is kept secret by the owner. In asymmetric encryption, the

sender uses the recipient’s public key to encrypt the data. The recipient then uses their private key to

decrypt the data. This approach allows for secure communication between two parties without the

need for both parties to have the same secret key. RSA is one of the most commonly used

asymmetric encryption algorithms. It is based on the mathematical problem of factoring large

numbers, which is believed to be hard to solve. RSA stands for Rivest-Shamir-Adleman, the names of

the three inventors of the algorithm. RSA can be used for both encryption and digital signatures. To

generate an RSA key pair, the following steps are performed:

Choose two large prime numbers, p and q, and compute their product, n = pq. This is called the

modulus.

Choose a small number, e, that is relatively prime to (p-1)(q-1). This is called the public exponent.

Compute a number, d, that satisfies the equation ed ≡ 1 (mod (p-1)(q-1)). This is called the private

exponent.

The public key is (n, e) and the private key is (n, d).

To encrypt a message, m, with the public key (n, e), the following formula is used:

c = m^e mod n

To decrypt a ciphertext, c, with the private key (n, d), the following formula is used:

m = c^d mod n

Reference :=

[Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0], Module 3: VPN

Technologies, Lesson 3.1: Site-to-Site VPNs, Topic 3.1.2: IPsec VPNs

What is Asymmetric Encryption? - GeeksforGeeks

What is asymmetric encryption? | Asymmetric vs. symmetric … - Cloudflare

Cisco Container Platform (CCP) is a security product that enables administrators to deploy

Kubernetes clusters in air-gapped sites without needing Internet access. CCP tenant images contain

all the necessary binaries and don’t need internet access to function. CCP also supports offline

installation and updates of the platform components. CCP is designed to simplify the deployment

and management of containerized applications across hybrid cloud environments, while ensuring

security and compliance. CCP integrates with Cisco security solutions such as Cisco Tetration and

Cisco Stealthwatch Cloud to provide visibility and protection for Kubernetes clusters and workloads.

CCP also leverages Cisco Intersight, a cloud-based management platform, to provide centralized

monitoring and automation for CCP clusters. Reference:

Cisco Container Platform

350-701 SCOR Cisco CCNP Security Updated Questions in April

SHA-1 (Secure Hash Algorithm 1) is a hashing algorithm used to generate a unique digest of a message. In VPNs (specifically IPsec), it is used within HMAC to verify that data has not been altered during transit, ensuring data integrity.

ISAKMP (Internet Security Association and Key Management Protocol) provides the framework for authentication and key exchange. It defines the procedures and packet formats to establish, negotiate, modify, and delete Security Associations (SAs), effectively defining IKE SAs.

AES (Advanced Encryption Standard) is a symmetric key encryption algorithm. It encrypts the data payload, rendering it unreadable to unauthorized users, which ensures data confidentiality.

RSA (Rivest-Shamir-Adleman) is an asymmetric algorithm often used for digital signatures. In the IKE phase, peers use RSA signatures to prove their identities to one another, providing authentication.

IETF RFC 2408, Internet Security Association and Key Management Protocol (ISAKMP), Section 1: "ISAKMP defines the procedures for authenticating a communicating peer, creation and management of Security Associations, key generation techniques, and threat mitigation."

NIST Special Publication 800-77 Rev. 1, Guide to IPsec VPNs, Section 2.2.1: Discusses how encryption algorithms like AES provide confidentiality. Section 2.2.2: Describes how hash functions (e.g., SHA) are used to provide data integrity.

Cisco Systems, IPsec Configuration Guide, "IKEv1 and IKEv2 Packet Exchange": Details the use of RSA signatures for the authentication method during IKE phase 1 negotiations.

Stallings, W., Cryptography and Network Security: Principles and Practice, 7th Edition, Pearson. Chapter 19 (IP Security): Explains the role of ISAKMP in defining the SA management and the use of HMAC-SHA for integrity.

Cisco Identity Services Engine (ISE) is a comprehensive identity and access control policy platform. It is specifically designed to provide centralized Authentication, Authorization, and Accounting (AAA) services. ISE meets all the requirements by functioning as a TACACS+ server for device administration (controlling access to network devices like routers and switches) and as a RADIUS server to enforce network access policies for users and endpoints using protocols such as 802.1X, MAC Authentication Bypass (MAB), and Web Authentication (WebAuth) for both wired and wireless networks.

A. Cisco Prime Infrastructure: This is a network management platform for monitoring and configuration, not a policy enforcement engine for AAA services like TACACS+ or 802.1X.

C. Cisco Stealthwatch: Now called Cisco Secure Network Analytics, this tool provides network visibility and threat detection using telemetry like NetFlow. It does not perform AAA functions.

D. Cisco AMP for Endpoints: Now called Cisco Secure Endpoint, this is an endpoint protection (EPP) and detection/response (EDR) solution focused on malware. It does not provide network access control.

---

1. Cisco Identity Services Engine (ISE) Data Sheet. Cisco. "Cisco ISE is a centralized solution that automates and simplifies secure access control... It provides: [...] Device administration (via TACACS+)

[...] IEEE 802.1X

MAC Authentication Bypass (MAB)

web authentication". This document explicitly lists both core functionalities required by the question.

Source: Cisco Identity Services Engine (ISE) Data Sheet

"Features and benefits" table.

2. Cisco Identity Services Engine Administrator Guide

Release 3.2. Cisco. "Device administration access service provides a policy framework for controlling access to the network devices... Cisco ISE uses the TACACS+ protocol for device administration." This confirms the TACACS+ capability. The guide also extensively covers configuring authentication and authorization policies for 802.1X

MAB

and WebAuth.

Source: Chapter: "Device Administration"

Section: "Device Administration Access Service" and Chapter: "Authentication"

Section: "Authentication Policies".

3. SCOR 350-701 Official Cert Guide. Cisco Press. "ISE is the Cisco solution for network access control (NAC) and is the main product that implements AAA for users and devices connecting to a network... ISE also supports TACACS+ for device administration."

Source: Chapter 21

"Cisco Identity Services Engine (ISE)"

Section: "ISE Fundamentals".

Advanced Malware Protection (AMP) is specifically designed to detect, block, and remediate malware, including zero-day attacks, through continuous analysis. Full Context Awareness aggregates data on users, devices, applications, and operating systems, providing the visibility necessary to create and enforce granular security policies. Collective Security Intelligence (powered by Cisco Talos) provides the system with real-time updates on global threat intelligence (IP, URL, and domain reputation) to block attacks proactively. Finally, the Next-Generation Intrusion Prevention System (NGIPS) utilizes this context and intelligence to provide comprehensive threat prevention and mitigation against both known exploits and unknown vulnerabilities.

Cisco Systems. (2015). Cisco ASA with Firepower Services Data Sheet. Retrieved from Cisco.com. (Section: "Features and Benefits", specifically Table 1 which maps features like "Full Context Awareness" to visibility/policy enforcement and "AMP" to malware remediation).

Cisco Systems. Cisco Firepower Management Center Configuration Guide, Version 6.0. "Chapter: Security Intelligence and Content Blocking". (Discusses the role of Collective Security Intelligence in real-time threat blocking).

Cisco Systems. Cisco ASA with Firepower Services - At-a-Glance. (Explicitly links NGIPS to comprehensive threat prevention and AMP to malware remediation).

Next Generation Intrusion Prevention System (NGIPS): Cisco defines its NGIPS capabilities as providing "superior threat prevention and mitigation" by leveraging contextual awareness to detect both known exploits and unknown (zero-day) threats.

Advanced Malware Protection (AMP): AMP is distinguished by its "retrospective security" capabilities. The keywords "tracking," "analysis," and "remediation" (specifically the ability to fix issues after a file enters the network) are unique to AMP's "before, during, and after" attack continuum.

Application Control and URL Filtering: This technology (often part of AVC) operates at the "application-layer," allowing administrators to enforce policies on specific "custom applications and URLs" rather than just ports or IP addresses.

Cisco Web Security Appliance (WSA): The WSA is a dedicated "web protection" gateway. The description "combined integrated solution... of web protection" directly describes the WSA's role in securing web traffic with visibility and control.

Cisco Systems. (2015). Cisco ASA with Firepower Services Data Sheet. Cisco.com. (Section: "Product Overview", Table 1 features the exact phrase "Superior threat prevention and mitigation for known and unknown threats" and "Detection, blocking, tracking, analysis, and remediation" for AMP).

Cisco Systems. (2020). Cisco Web Security Appliance Data Sheet. Cisco.com. (Describes the WSA as an "all-in-one web security gateway" providing defense, visibility, and control).

Cisco Systems. Firepower Management Center Configuration Guide, Version 6.0. (Chapter: "Access Control Policies", specifically discussing "Application Visibility and Control (AVC)" and "URL Filtering" for application-layer enforcement).

Posture assessment is a feature of Cisco ISE that allows you to check the compliance of endpoints

with corporate security policies before allowing them to access the network1. Posture assessment

can detect missing patches on endpoints and help with remediation by applying the appropriate

posture policy and requirement2. Posture assessment can also check for the presence and status of

security software, such as antivirus, antispyware, firewall, and so on3. Posture assessment is one of

the core security technologies covered in the Implementing and Operating Cisco Security Core

Technologies (SCOR) course4, which prepares you for the Cisco CCNP Security and CCIE Security

certifications and for senior-level security roles. Reference: 1: Posture Service 2: Configure Posture

Policies 3: Posture Conditions 4: Implementing and Operating Cisco Security Core Technologies

(SCOR) v1.0

The scenario describes a need to dynamically assess and act on a sudden influx of SPAM. The Cisco Email Security Appliance (ESA) is the designated solution for email-based threats. The ESA's Outbreak Filters feature is specifically designed for this purpose. It analyzes aggregated traffic data and message attributes in real-time to identify emerging threats like spam campaigns before traditional signatures are available. Based on this dynamic analysis of traffic, Outbreak Filters can modify the policy action for suspicious messages, such as quarantining them for further inspection, thus fulfilling the requirement to "take action" and "modify policies based on the traffic seen."

A. The Cisco Web Security Appliance (WSA) is designed to secure web traffic and is not the appropriate tool for managing email-based SPAM threats.

B. While the ESA does receive real-time updates from Talos, this option only describes the reception of intelligence, not the dynamic policy action based on traffic analysis.

C. The Cisco Web Security Appliance (WSA) is not the primary solution for handling SPAM; its focus is on web security, not email security.

---

1. Cisco Secure Email and Web Manager Configuration Guide

14.2

Chapter: Fighting Viruses and Malware

Section: About Outbreak Filters.

"Outbreak Filters protects your network from large-scale outbreaks and other virus and blended attacks... When a message is identified as a possible threat

Outbreak Filters can temporarily quarantine the message for further analysis... Outbreak Filters uses data from the Cisco Talos Security Intelligence and Research Group (Talos) and other sources to determine a 'threat level' for a particular message." This document confirms that the ESA (managed via the Secure Email and Web Manager) uses Outbreak Filters to dynamically analyze and take action (quarantine) on messages based on threat levels derived from traffic analysis.

2. Cisco Email Security Appliance (ESA) Data Sheet.

Under the "Advanced Malware Protection" and "Spam Protection" sections

the data sheet describes the multi-layered defense approach. It states

"Cisco Advanced Malware Protection (AMP) is included... It provides... file reputation

and file sandboxing... Outbreak Filters provide a critical first layer of defense against new threats." This confirms the ESA is the correct product and Outbreak Filters is a key feature for handling new

dynamic threats like a sudden SPAM wave.

3. Cisco Talos Intelligence Group

"What is Talos?".

"Talos underpins the entire Cisco Security portfolio

providing industry-leading visibility

context

and analysis... This intelligence is fed back into our products

protecting customers against the latest threats." This source verifies that Talos provides the intelligence

but the appliance (in this case

the ESA) is what must be configured to use that intelligence to take action on traffic.

A well-established patching solution is critical for remediating software vulnerabilities on endpoints. Without one, systems remain susceptible to known security flaws. Attackers create exploits, which are programs or code snippets designed specifically to take advantage of these unpatched vulnerabilities to gain control of a system. Once an exploit is successful, it is commonly used as a delivery mechanism for malware, such as ransomware, spyware, or viruses. Therefore, failing to patch endpoints directly exposes a company to the risks of being compromised by exploits and infected with malware.

B. ARP spoofing: This is a Layer 2 network-based attack that manipulates ARP tables. It is not directly prevented by applying software patches to an endpoint's operating system or applications.

C. denial-of-service attacks: While some vulnerabilities can lead to a DoS condition (e.g., a system crash), the primary and most common risks from unpatched systems are system compromise and data theft via exploits and malware.

E. eavesdropping: This is a passive network attack involving sniffing traffic. It is mitigated by network segmentation and encryption (e.g., TLS/SSL), not by endpoint software patching.

1. National Institute of Standards and Technology (NIST) Special Publication 800-40 Revision 3

Guide to Enterprise Patch Management Technologies:

Section 2.1

"The Need for Patch Management

" Page 6: "Flaw remediation is the most critical part of vulnerability management... Malicious parties can reverse engineer patches to create exploit code for the newly discovered vulnerability. Organizations that do not apply the patch promptly are vulnerable to attacks using the exploit code." This directly links the failure to patch with vulnerability to exploits.

2. Cisco

Cisco Annual Cybersecurity Report:

The 2018 report

for example

highlights the connection between unpatched systems and security incidents. Chapter 2

"Adversary Playbook

" Page 16: "Attackers continue to leverage well-known

unpatched vulnerabilities to infiltrate systems... They also continue to rely on malware as a primary tool for carrying out their campaigns." This establishes the direct relationship between unpatched vulnerabilities and malware infections.

3. Carnegie Mellon University

Software Engineering Institute (SEI)

Common Sense Guide to Mitigating Insider Threats

5th Edition:

Practice 17: "Implement a Patch Management Program

" Page 129: "Unpatched systems are vulnerable to a variety of attacks

including worms

viruses

and other types of malware... Attackers can also use unpatched vulnerabilities to gain unauthorized access to systems and data." This source confirms that a lack of patching leads to malware and unauthorized access (via exploits).

:

Cisco Stealthwatch is a security solution that uses NetFlow to provide visibility across the network,

data center, branch offices, and cloud. NetFlow is a protocol that collects and exports statistics on

network traffic flows from routers, switches, firewalls, and other devices. NetFlow data can be used

to monitor network performance, troubleshoot issues, detect anomalies, and identify security

threats. Cisco Stealthwatch analyzes NetFlow data from various sources and correlates it with other

contextual information, such as identity, device, location, and threat intelligence. Cisco Stealthwatch

then applies advanced behavioral analytics and machine learning to detect and respond to malicious

activities, such as data exfiltration, malware infection, insider threats, and denial-of-service attacks.

Cisco Stealthwatch also provides comprehensive network visibility and security across hybrid

environments, including public cloud, private cloud, and on-premises networks. Cisco Stealthwatch

can integrate with other Cisco security solutions, such as Cisco Identity Services Engine (ISE), Cisco

Firepower, Cisco Umbrella, and Cisco Advanced Malware Protection (AMP), to enhance network

security and incident response capabilities. Reference:

Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0, Module 8: Cloud and

Virtual Network Security, Lesson 8.2: Cisco Stealthwatch Cloud

Cisco Stealthwatch

NetFlow for Cybersecurity and Incident Response

B

Cisco Security Manager (CSM) is an enterprise-class security management application used for the large-scale, centralized management of Cisco security devices. Its primary function is to configure and manage firewall, VPN, and Intrusion Prevention System (IPS) policies. The Cisco Adaptive Security Appliance (ASA) is a core security device that CSM is specifically designed to manage, providing a scalable solution for administering security policies across numerous ASA firewalls from a single interface.

A. access point: Cisco access points are managed by platforms like Cisco DNA Center, Cisco Prime Infrastructure, or Meraki cloud dashboard, not Cisco Security Manager.

B. WSA: The Cisco Web Security Appliance (WSA) is typically managed via its own graphical user interface or centrally through the Cisco Security Management Appliance (SMA).

D. ESA: The Cisco Email Security Appliance (ESA) is managed through its own interface or centrally via the Cisco Security Management Appliance (SMA), not CSM.

1. Cisco. (2020). Cisco Security Manager 4.22 Data Sheet. C78-732335-07. "Cisco Security Manager supports a wide range of Cisco security devices

including Cisco ASA 5500 and 5500-X Series Adaptive Security Appliances...". Retrieved from https://www.cisco.com/c/en/us/products/collateral/security/security-manager/datasheetc78-732335.html

2. Cisco. (2021). Supported Devices and Software Versions for Cisco Security Manager 4.22. "Supported Cisco ASA

PIX

and FWSM Devices" section. This document explicitly lists various models of the Cisco ASA as supported devices for management by CSM. Retrieved from https://www.cisco.com/c/en/us/td/docs/security/securitymanagement/ciscosecuritymanager/securitymanager/4-22/supporteddevices/CSM-supported-devices-4-22.html#pgfId-1130059

3. Cisco. (n.d.). Cisco Content Security Management Appliance Data Sheet. "Centralized Management" section. This document states that the Security Management Appliance (SMA) is used to centrally manage Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA). Retrieved from https://www.cisco.com/c/en/us/products/collateral/security/content-security-management-appliance/datasheet-c78-739113.html

aaa new-model: This command must be entered first to enable the AAA (Authentication, Authorization, and Accounting) subsystem on the Cisco device. Without this, no other AAA commands (like defining servers or method lists) will be available or functional.

tacacs-server host 10.1.1.10: This defines the specific external TACACS+ server IP address (10.1.1.10) as required by the scenario.

tacacs-server key: This configures the shared secret key used to encrypt traffic between the switch and the TACACS+ server. (Note: While global key and host commands can often be entered in either order, defining the host and its associated key is the logical setup phase).

aaa authentication ppp test group tacacs+ local: This creates the authentication method list named "test" for PPP. The group tacacs+ local syntax specifically satisfies the requirement to try the TACACS+ server first and fall back to the local database if the server is unreachable.

Cisco Systems, Inc., "Authentication, Authorization, and Accounting Configuration Guide, Cisco IOS Release 15M&T" - Configuring Authentication.

Reference: "The aaa new-model command enables the AAA access control model."

Cisco Systems, Inc., "Security Command Reference: Commands A to C, Cisco IOS XE Release 3S" - aaa authentication ppp.

Reference: Syntax description: aaa authentication ppp {default | list-name} method1 [method2...]. The keyword group tacacs+ specifies the TACACS+ server group, and local specifies the local username database.

Cisco Systems, Inc., "Cisco IOS Security Configuration Guide: Securing User Services, Release 12.2" - Configuring TACACS+.

Reference: Details the usage of tacacs-server host to specify the IP and tacacs-server key to specify the authentication key.

Cisco Cloudlock is a Cloud Access Security Broker (CASB) that operates as an API-based broker to secure cloud environments. It integrates directly with Software-as-a-Service (SaaS), Infrastructure-as-a-Service (IaaS), and Platform-as-a-Service (PaaS) applications via their APIs. This allows Cloudlock to discover and control cloud applications, monitor user behavior for anomalies, and enforce data loss prevention (DLP) policies to protect sensitive data. Its core function is to reduce application risks and prevent data breaches in cloud services, which are by definition "not on-premise."

B. Cisco Umbrella: This is a Secure Internet Gateway (SIG) that provides DNS-layer security and a secure web gateway; it is not primarily an API-based broker for cloud application security.

C. Cisco AMP: Now called Cisco Secure Endpoint, this is an endpoint protection (EPP) and detection/response (EDR) solution focused on protecting devices like laptops and servers from malware.

D. Cisco AppDynamics: This is an Application Performance Monitoring (APM) and observability platform used to monitor the health and performance of applications, not primarily for security enforcement.

1. Cisco Cloudlock At-a-Glance: "Cisco Cloudlock is a cloud-native Cloud Access Security Broker (CASB) that helps accelerate your safe cloud adoption. Cloudlock secures your cloud users

data

and applications..." It further explains its API-based approach for protecting platforms like Office 365

G Suite

and Salesforce. (Cisco

"Cisco Cloudlock At-a-Glance

" Document C45-737222-04

Page 1).

2. Cisco Cloudlock Data Sheet: "As a cloud-native CASB

Cloudlock has a 100 percent cloud-based

API-driven architecture that provides fast

flexible

and easy deployment." This statement directly confirms its identity as an API-based broker for cloud environments. (Cisco

"Cisco Cloudlock Data Sheet

" Document C78-737221-07

Page 2

"Product architecture" section).

3. Cisco SAFE for Cloud Security Reference Guide: This guide positions the different Cisco security products. It describes Cloudlock's role: "Cisco Cloudlock (CASB) provides visibility and control over user activity and sensitive data in cloud applications." It contrasts this with Umbrella's role in securing internet access and AMP's role in endpoint protection. (Cisco

"SAFE for Cloud Security Reference Guide

" Version 2.0

Page 11

"Cloud Security Capabilities" section).

Distributed PortScan: Defined as a many-to-one attack where multiple hosts coordinate to scan a single target, making detection harder for simple threshold-based systems.

Decoy PortScan: Involves a one-to-one scan where the attacker mixes spoofed source IP addresses with their real IP to obscure the actual origin of the scan.

Port Sweep: Characterized as a one-to-many scan where an attacker sweeps across multiple target hosts looking for a specific open service (single port).

PortScan Detection: Refers to the standard one-to-one vertical scan where a single host scans a single target for multiple ports to find available services.

Cisco Systems. (2016). Firepower Management Center Configuration Guide, Version 6.0. "Chapter: Intrusion Prevention," Section: "Detecting Port Scans."

Cisco Systems. (2018). Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.3.0. "Configuring Port Scan Detection." Retrieved from Cisco.com

Roesch, M., et al. (2014). Snort Users Manual 2.9.7. "Chapter 2: Configuring Snort," Section 2.4.2: "Port Scan Detection." (Note: Cisco Firepower NGIPS core detection engine is based on Snort technology).

To configure SCP log pushing (push-based retrieval) on a Cisco Secure Web Appliance, the process follows a specific logical order enforced by the system wizard (CLI or GUI):

1. Set SCP as the desired log subscription: The engineer initiates the configuration by editing a log subscription and selecting "SCP" as the retrieval method.
2. Add the SSH public host key of the remote server: Once the remote hostname is defined, the appliance attempts to verify the remote server. The engineer must accept/add the remote server's host key to the appliance's known_hosts list to establish trust.
3. Add keys to the remote system: The appliance then generates or displays its own SSH public key. The engineer must copy this key and add it to the remote server's authorized_keys file to allow the appliance to authenticate without a password.
4. Commit changes: Finally, the changes must be committed to the configuration database to take effect.

Cisco Systems. User Guide for AsyncOS 11.7 for Cisco Web Security Appliances. Chapter: "Logging". Section: "Retrieving Log Files -> SCP (Push to Remote Server)".

Quote: "When you select SCP... The system prompts you to enter the SSH host key of the remote server... The system displays the SSH public key for the appliance. You must add this key to the authorized_keys file on the remote server."

Cisco Systems. Configuration Example: Pushing Logs to a Remote Server via SCP on the ESA/WSA. Document ID: 118237.

Workflow: Lists the logconfig CLI steps: Select method (SCP) -> Enter remote host details -> Accept remote host key -> Copy appliance key to remote server -> Commit.