Cisco CCNP Security SCOR 350-701 Exam 2026: Professional
Certification Practice Test — Network Security, Secure Access,
VPNs, Cloud Security, Endpoint Protection & Security Monitoring —
190 Multiple-Choice Questions with Answers & Detailed Rationales
SECTION 1: SECURITY CONCEPTS (Questions 1–48)
Question 1
A security architect is designing a defense-in-depth strategy for a hybrid cloud environment.
The organization requires protection against data breaches, insecure APIs, and compromised
credentials. Which security control framework should the architect reference to align with
Cisco's validated design principles?
A. NIST Cybersecurity Framework
B. Cisco SAFE
C. ISO/IEC 27001
D. MITRE ATT&CK
Correct Answer: B
Explanation: Cisco SAFE is Cisco's security architecture framework that provides validated
design guidance for defense-in-depth across on-premises, cloud, and hybrid environments,
directly addressing business use cases and threat vectors.
Question 2
A threat intelligence analyst is consuming STIX/TAXII feeds to enhance the organization's
security posture. The analyst needs to ensure that indicators of compromise (IOCs) are
automatically shared with Cisco Secure Firewall and Umbrella. Which platform facilitates this
authoring, sharing, and consumption of security intelligence?
,A. Cisco Threat Response
B. Cisco Umbrella Investigate
C. Cisco SecureX
D. Cisco Talos
Correct Answer: C
Explanation: Cisco SecureX is the platform that integrates threat intelligence across Cisco
security products, enabling automated consumption and sharing of STIX/TAXII feeds for
enhanced detection and response.
Question 3
A penetration tester discovers that an application accepts user input directly into SQL
queries without parameterization. The tester successfully extracts the entire user database
by appending ' OR '1'='1 to the login form. Which OWASP Top 10 vulnerability category does
this exploit represent?
A. Broken Access Control
B. Injection
C. Cryptographic Failures
D. Security Misconfiguration
Correct Answer: B
Explanation: SQL injection falls under the Injection category in OWASP Top 10, where
untrusted data is sent to an interpreter as part of a command or query, allowing
unauthorized data extraction.
,Question 4
A security engineer is implementing post-quantum cryptography (PQC) readiness for a long-
lived VPN infrastructure. The organization wants to protect against "harvest now, decrypt
later" attacks. Which cryptographic approach best addresses this threat?
A. Increasing RSA key length to 8192 bits
B. Migrating to elliptic curve cryptography (ECC)
C. Implementing hybrid key exchange with PQC algorithms
D. Deploying SHA-3 for message integrity
Correct Answer: C
Explanation: Hybrid key exchange combines classical and post-quantum algorithms,
protecting against both current threats and future quantum computer decryption
capabilities while maintaining backward compatibility.
Question 5
A large language model (LLM) application is vulnerable to manipulation where attackers
insert hidden instructions into user prompts to override system behavior. Which
vulnerability category does this represent?
A. Training data poisoning
B. Prompt injection
C. Model inversion
D. Adversarial examples
Correct Answer: B
, Explanation: Prompt injection occurs when malicious input manipulates an LLM to ignore its
system prompt and execute unintended instructions, a critical AI/LLM vulnerability in the
SCOR v2.0 blueprint.
Question 6
A security operations center receives alerts about a rootkit infection on a critical server. The
rootkit is hiding its presence by intercepting system calls and modifying kernel structures.
Which defense-in-depth layer is most effective at detecting this type of threat?
A. Network-based intrusion prevention
B. Host-based integrity monitoring
C. Perimeter firewall logging
D. DNS sinkholing
Correct Answer: B
Explanation: Host-based integrity monitoring (HIM) detects kernel-level modifications and
system call interception that rootkits employ, as network controls cannot see encrypted or
local-only malicious activity.
Question 7
An organization is deploying a zero-trust architecture. The security team wants to ensure
that access decisions are made dynamically based on user identity, device posture, and
context. Which Cisco solution provides this policy enforcement capability?
A. Cisco Umbrella
B. Cisco Identity Services Engine (ISE)
C. Cisco Secure Email Gateway
Certification Practice Test — Network Security, Secure Access,
VPNs, Cloud Security, Endpoint Protection & Security Monitoring —
190 Multiple-Choice Questions with Answers & Detailed Rationales
SECTION 1: SECURITY CONCEPTS (Questions 1–48)
Question 1
A security architect is designing a defense-in-depth strategy for a hybrid cloud environment.
The organization requires protection against data breaches, insecure APIs, and compromised
credentials. Which security control framework should the architect reference to align with
Cisco's validated design principles?
A. NIST Cybersecurity Framework
B. Cisco SAFE
C. ISO/IEC 27001
D. MITRE ATT&CK
Correct Answer: B
Explanation: Cisco SAFE is Cisco's security architecture framework that provides validated
design guidance for defense-in-depth across on-premises, cloud, and hybrid environments,
directly addressing business use cases and threat vectors.
Question 2
A threat intelligence analyst is consuming STIX/TAXII feeds to enhance the organization's
security posture. The analyst needs to ensure that indicators of compromise (IOCs) are
automatically shared with Cisco Secure Firewall and Umbrella. Which platform facilitates this
authoring, sharing, and consumption of security intelligence?
,A. Cisco Threat Response
B. Cisco Umbrella Investigate
C. Cisco SecureX
D. Cisco Talos
Correct Answer: C
Explanation: Cisco SecureX is the platform that integrates threat intelligence across Cisco
security products, enabling automated consumption and sharing of STIX/TAXII feeds for
enhanced detection and response.
Question 3
A penetration tester discovers that an application accepts user input directly into SQL
queries without parameterization. The tester successfully extracts the entire user database
by appending ' OR '1'='1 to the login form. Which OWASP Top 10 vulnerability category does
this exploit represent?
A. Broken Access Control
B. Injection
C. Cryptographic Failures
D. Security Misconfiguration
Correct Answer: B
Explanation: SQL injection falls under the Injection category in OWASP Top 10, where
untrusted data is sent to an interpreter as part of a command or query, allowing
unauthorized data extraction.
,Question 4
A security engineer is implementing post-quantum cryptography (PQC) readiness for a long-
lived VPN infrastructure. The organization wants to protect against "harvest now, decrypt
later" attacks. Which cryptographic approach best addresses this threat?
A. Increasing RSA key length to 8192 bits
B. Migrating to elliptic curve cryptography (ECC)
C. Implementing hybrid key exchange with PQC algorithms
D. Deploying SHA-3 for message integrity
Correct Answer: C
Explanation: Hybrid key exchange combines classical and post-quantum algorithms,
protecting against both current threats and future quantum computer decryption
capabilities while maintaining backward compatibility.
Question 5
A large language model (LLM) application is vulnerable to manipulation where attackers
insert hidden instructions into user prompts to override system behavior. Which
vulnerability category does this represent?
A. Training data poisoning
B. Prompt injection
C. Model inversion
D. Adversarial examples
Correct Answer: B
, Explanation: Prompt injection occurs when malicious input manipulates an LLM to ignore its
system prompt and execute unintended instructions, a critical AI/LLM vulnerability in the
SCOR v2.0 blueprint.
Question 6
A security operations center receives alerts about a rootkit infection on a critical server. The
rootkit is hiding its presence by intercepting system calls and modifying kernel structures.
Which defense-in-depth layer is most effective at detecting this type of threat?
A. Network-based intrusion prevention
B. Host-based integrity monitoring
C. Perimeter firewall logging
D. DNS sinkholing
Correct Answer: B
Explanation: Host-based integrity monitoring (HIM) detects kernel-level modifications and
system call interception that rootkits employ, as network controls cannot see encrypted or
local-only malicious activity.
Question 7
An organization is deploying a zero-trust architecture. The security team wants to ensure
that access decisions are made dynamically based on user identity, device posture, and
context. Which Cisco solution provides this policy enforcement capability?
A. Cisco Umbrella
B. Cisco Identity Services Engine (ISE)
C. Cisco Secure Email Gateway
