CISCO 350-701 Implementing and Operating Cisco Security Core Technologies (SCOR) Free Practice Test — 30 Questions

Question 1

In a cloud environment, a company is implementing an Identity and Access Management (IAM) solution to ensure that only authorized personnel can access sensitive data. The IAM system must support multi-factor authentication (MFA) and role-based access control (RBAC). The company has three user roles: Admin, Developer, and Viewer. Each role has different access levels to various resources. If the Admin role requires access to all resources, the Developer role needs access to development resources only, and the Viewer role should only have read access to specific reports, what would be the most effective way to structure the IAM policies to ensure compliance with the principle of least privilege while maintaining operational efficiency?

Accepted Answer

Implement role-based access control (RBAC) with specific permissions assigned to each role, ensuring that users only have access to the resources necessary for their job functions, and enforce multi-factor authentication (MFA) for all roles.

Question 2

In a recent risk assessment for a financial institution, the security team is tasked with implementing controls based on the NIST SP 800-53 framework. They identify that the organization handles sensitive customer data and is subject to regulatory compliance requirements. The team decides to categorize the data and apply appropriate security controls. Which of the following control families from NIST SP 800-53 would be most critical for ensuring the confidentiality, integrity, and availability of sensitive customer data?

Accepted Answer

Access Control

Question 3

In a corporate environment, a security team is tasked with enhancing perimeter security for their data center. They decide to implement a combination of physical barriers, surveillance systems, and access control measures. The team estimates that the cost of installing a high-security fence is $50 per linear foot, while the installation of a surveillance camera system costs $200 per camera. If the data center perimeter is 1,000 feet long and they plan to install one camera for every 250 feet of the perimeter, what will be the total cost for the fencing and surveillance system combined?

Accepted Answer

$7,000

Question 4

In a corporate environment, a security analyst is tasked with monitoring network traffic to identify potential security incidents. The analyst uses a Security Information and Event Management (SIEM) system that aggregates logs from various sources, including firewalls, intrusion detection systems (IDS), and servers. During the analysis, the analyst notices an unusual spike in outbound traffic from a specific server that is not typically used for external communications. The analyst must determine the most appropriate course of action to investigate this anomaly. What should be the analyst\'s first step in this investigation?

Accepted Answer

Correlate the spike in outbound traffic with user activity logs to identify any unauthorized access attempts.

Question 5

In a forensic investigation involving a compromised server, an analyst discovers a series of log files that indicate unauthorized access attempts. The analyst needs to determine the time of the first unauthorized access attempt and the total number of attempts made within a specific time frame. The logs show the following timestamps for access attempts: 2023-10-01 14:23:45, 2023-10-01 14:25:10, 2023-10-01 14:27:55, 2023-10-01 14:30:00, and 2023-10-01 14:32:30. If the analyst is tasked with identifying the total number of unauthorized access attempts made within a 10-minute window starting from the first attempt, what is the total number of attempts recorded?

Accepted Answer

5

Question 6

During a cybersecurity incident, a security analyst is tasked with managing the incident response lifecycle. After identifying a potential breach, the analyst must determine the next steps to effectively contain the incident. Which of the following actions should the analyst prioritize to ensure a structured and efficient response?

Accepted Answer

Implementing containment strategies to limit the impact of the breach on the network and systems

Question 7

In the context of developing a comprehensive security policy for a multinational corporation, the security team is tasked with addressing the varying regulatory requirements across different countries. The team must ensure that the policy not only complies with local laws but also aligns with the organization\'s overall security objectives. Which approach should the team prioritize to effectively integrate these diverse regulatory requirements into the security policy?

Accepted Answer

Conduct a thorough risk assessment to identify specific regulatory requirements and align them with the organization's risk management framework.

Question 8

A financial institution is assessing its risk management framework to comply with the Basel III guidelines. The institution has identified several risks, including credit risk, market risk, and operational risk. To quantify these risks, the risk management team decides to calculate the Value at Risk (VaR) for its trading portfolio, which has a current market value of $10 million. The team estimates that the portfolio\'s daily returns follow a normal distribution with a mean return of 0.1% and a standard deviation of 2%. What is the 95% Value at Risk (VaR) for this portfolio over a one-day horizon?

Accepted Answer

$392,000

Question 9

A security analyst is tasked with evaluating the effectiveness of a newly implemented intrusion detection system (IDS) in a corporate network. The analyst collects data over a month and finds that the IDS generated 150 alerts, of which 120 were false positives. The organization has a total of 5000 network events logged during this period. To assess the performance of the IDS, the analyst calculates the true positive rate (TPR) and the false positive rate (FPR). What is the correct interpretation of these metrics in the context of the IDS\'s performance?

Accepted Answer

The IDS has a TPR of 0% and an FPR of 80%.

Question 10

In a corporate environment, a security analyst is tasked with implementing internal segmentation to enhance the security posture of the organization. The analyst decides to use VLANs (Virtual Local Area Networks) to separate sensitive data traffic from general user traffic. Given that the organization has 500 employees, and each VLAN can support up to 255 devices, how many VLANs are required to ensure that all employees can be segmented appropriately while adhering to best practices for internal segmentation? Additionally, what considerations should be taken into account regarding the management of these VLANs to ensure effective security policies are enforced?

Accepted Answer

3 VLANs

Question 11

A financial institution is conducting a vulnerability assessment on its network infrastructure, which includes multiple servers, workstations, and network devices. The assessment reveals that several systems are running outdated software versions with known vulnerabilities. The institution has a policy that mandates all systems must be patched within 30 days of a vulnerability being disclosed. Given that the assessment was completed on the 1st of the month, and the disclosed vulnerabilities have a critical severity rating, what should be the institution\'s immediate course of action to comply with its vulnerability management policy?

Accepted Answer

Prioritize patching the critical vulnerabilities on all affected systems within the 30-day window.

Question 12

In a corporate environment, a security analyst is tasked with evaluating the effectiveness of the organization\'s security controls. The analyst decides to conduct a risk assessment to identify vulnerabilities and potential threats to the company\'s assets. During this assessment, the analyst discovers that the organization has implemented a multi-layered security architecture, which includes firewalls, intrusion detection systems (IDS), and regular employee training on security awareness. Given this scenario, which principle of security is primarily being addressed by the implementation of these controls?

Accepted Answer

Defense in Depth

Question 13

In a smart city environment, various IoT devices are deployed to monitor traffic, manage energy consumption, and enhance public safety. Each device collects sensitive data and communicates over a shared network. Considering the IoT Security Frameworks, which approach would best mitigate the risks associated with unauthorized access and data breaches while ensuring compliance with regulations such as GDPR and CCPA?

Accepted Answer

Implementing end-to-end encryption for data in transit and at rest, along with regular security audits and compliance checks.

Question 14

In a corporate environment, a security analyst is tasked with evaluating the effectiveness of the current security measures in place to protect sensitive data. The analyst discovers that the organization employs a combination of firewalls, intrusion detection systems (IDS), and encryption protocols. However, there have been recent incidents of data breaches attributed to social engineering attacks. Considering the layered security approach, which of the following strategies would most effectively enhance the organization\'s security posture against such attacks?

Accepted Answer

Implementing comprehensive security awareness training for all employees to recognize and respond to social engineering tactics.

Question 15

In a corporate environment, a network architect is tasked with designing a secure network for a financial institution that handles sensitive customer data. The architect must ensure that the network adheres to the principles of least privilege and segmentation. Given the following requirements: 1) All internal communications must be encrypted, 2) Access to sensitive data should be restricted based on user roles, and 3) The network must be segmented to isolate different departments (e.g., finance, HR, and IT), which design approach would best meet these criteria while minimizing potential attack vectors?

Accepted Answer

Implement a Zero Trust Architecture with micro-segmentation and role-based access control (RBAC) for all users and services.

Question 16

In a corporate environment implementing a Zero Trust Architecture (ZTA), a security analyst is tasked with evaluating the effectiveness of the identity verification processes in place. The organization uses a combination of multi-factor authentication (MFA), continuous monitoring, and strict access controls. Given a scenario where an employee\'s device is compromised, how should the ZTA principles guide the response to ensure minimal risk to sensitive data while maintaining operational efficiency?

Accepted Answer

Immediately revoke access to all resources for the compromised device and require a full re-authentication process for the user.

Question 17

A financial services company is migrating its infrastructure to a cloud environment. They are particularly concerned about data confidentiality and integrity, especially regarding sensitive customer information. To address these concerns, they decide to implement a cloud security framework that includes encryption, access controls, and continuous monitoring. Which of the following strategies would best enhance their cloud security posture while ensuring compliance with regulations such as GDPR and PCI DSS?

Accepted Answer

Implementing end-to-end encryption for data at rest and in transit, along with role-based access controls and regular security audits.

Question 18

In a healthcare organization, a new policy is being implemented to manage access to patient records based on the roles of the employees. The organization decides to use Role-Based Access Control (RBAC) to ensure that only authorized personnel can access sensitive information. However, they also want to incorporate Attribute-Based Access Control (ABAC) to provide more granular control based on specific attributes such as the employee\'s department, clearance level, and the type of patient data being accessed. Given this scenario, which of the following statements best describes the advantages of combining RBAC and ABAC in this context?

Accepted Answer

The combination allows for both role-based permissions and attribute-based conditions, enhancing security by ensuring that access is granted only when both role and attribute criteria are met.

Question 19

In a recent security assessment, a financial institution utilized the MITRE ATT&CK Framework to analyze their defenses against potential adversarial tactics. They identified that their current detection mechanisms were primarily focused on the initial access and execution phases of the attack lifecycle. However, they noticed a significant gap in their ability to detect lateral movement and credential access techniques. Given this scenario, which of the following strategies would best enhance their security posture against these identified gaps?

Accepted Answer

Implementing network segmentation and monitoring for unusual authentication attempts across different segments.

Question 20

In a smart home environment, various IoT devices are interconnected to enhance user convenience and efficiency. However, this interconnectivity also exposes the network to potential threats. A security analyst is tasked with evaluating the risk posed by a specific IoT device that has been identified as vulnerable to remote exploitation. The device communicates over a wireless protocol and has a known vulnerability that allows unauthorized access to its control interface. Given that the device is responsible for managing critical home functions such as security cameras and door locks, what is the most effective initial step the analyst should take to mitigate the risk associated with this vulnerability?

Accepted Answer

Implement network segmentation to isolate the IoT device from critical systems.

Question 21

A cybersecurity analyst is tasked with evaluating the effectiveness of a threat intelligence platform (TIP) that aggregates data from multiple sources, including open-source intelligence (OSINT), commercial feeds, and internal logs. The analyst needs to determine the overall threat score for a specific IP address that has been flagged for suspicious activity. The threat score is calculated using the formula:

Accepted Answer

ext{Threat Score} = \frac{	ext{OSINT Score} + 	ext{Commercial Feed Score} + 	ext{Internal Log Score}}{3} $$

Question 22

In the context of implementing a security framework within an organization, a security manager is tasked with aligning the security policies with the organization\'s business objectives while ensuring compliance with relevant regulations. The manager decides to adopt the NIST Cybersecurity Framework (CSF) as a guiding principle. Which of the following best describes the primary components of the NIST CSF that the manager should focus on to effectively manage cybersecurity risks?

Accepted Answer

Identify, Protect, Detect, Respond, Recover

Question 23

A financial institution is preparing for an upcoming audit and needs to ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS). The institution has implemented various security measures, including encryption of cardholder data, regular vulnerability scans, and maintaining a firewall. However, they are unsure about the requirements for logging and monitoring access to cardholder data. Which of the following best describes the logging and monitoring requirements under PCI DSS?

Accepted Answer

All access to cardholder data must be logged, and logs must be reviewed regularly to identify any unauthorized access attempts.

Question 24

A financial institution is implementing a new security architecture that includes a combination of firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS). The security team is tasked with ensuring that the network is protected against both external and internal threats while maintaining compliance with industry regulations such as PCI-DSS. They decide to deploy a next-generation firewall (NGFW) that integrates advanced threat protection features. Which of the following statements best describes the primary advantage of using a next-generation firewall in this scenario?

Accepted Answer

It provides deep packet inspection and application awareness to identify and control traffic based on application-level data.

Question 25

A financial institution is conducting a risk assessment to evaluate the potential impact of a data breach on its operations. The assessment identifies three key assets: customer data, transaction records, and proprietary algorithms. The institution estimates the following potential losses in the event of a breach: customer data loss could result in $2 million in fines and reputational damage, transaction records loss could lead to $1 million in direct financial losses, and proprietary algorithms loss could incur $3 million in competitive disadvantage. If the institution assigns a likelihood of occurrence of 0.1 for customer data loss, 0.05 for transaction records loss, and 0.2 for proprietary algorithms loss, what is the total expected monetary loss (EML) from these risks?

Accepted Answer

$1,300,000

Question 26

In a corporate environment, a company is implementing a new data protection strategy to enhance its security posture. The strategy aims to ensure that sensitive customer data remains confidential, is not altered during processing, and is available to authorized personnel when needed. The security team is evaluating various measures to achieve these objectives. Which combination of measures best addresses the principles of the CIA Triad in this scenario?

Accepted Answer

Implementing encryption for data at rest, using checksums for data integrity verification, and establishing redundant systems for high availability.

Question 27

A financial institution is assessing the risk associated with its online banking platform. The institution has identified three primary risks: unauthorized access, data breaches, and service outages. They estimate the potential impact of each risk on their operations as follows: unauthorized access could lead to a loss of $500,000, data breaches could result in a loss of $1,200,000, and service outages could cause a loss of $300,000. The likelihood of each risk occurring is estimated at 10%, 5%, and 15%, respectively. To prioritize their risk management efforts, the institution decides to calculate the expected monetary value (EMV) for each risk. What is the EMV for the risk of data breaches?

Accepted Answer

$60,000

Question 28

A financial institution is evaluating its cloud strategy to enhance data security while maintaining regulatory compliance. The institution has sensitive customer data that must adhere to strict regulations such as GDPR and PCI DSS. They are considering a cloud deployment model that allows them to control their data environment while still leveraging cloud resources for scalability. Which cloud deployment model would best suit their needs?

Accepted Answer

Private Cloud

Question 29

A financial institution has detected unusual activity on its network, indicating a potential data breach. The incident response team is tasked with containing the breach and preventing further data loss. They decide to implement a series of containment strategies. Which of the following strategies should be prioritized first to effectively mitigate the risk of data exfiltration while ensuring minimal disruption to business operations?

Accepted Answer

Isolate the affected systems from the network to prevent further unauthorized access.

Question 30

In a corporate environment, the security team is tasked with developing a comprehensive security policy that addresses both physical and digital security measures. The policy must ensure compliance with industry regulations such as GDPR and HIPAA, while also incorporating best practices for incident response and employee training. Which of the following elements should be prioritized in the policy to effectively mitigate risks associated with data breaches and unauthorized access?

Accepted Answer

A clear incident response plan that outlines roles, responsibilities, and procedures for reporting and managing security incidents.

CISCO 350-701 Implementing and Operating Cisco Security Core Technologies (SCOR) Free Practice Test — 30 Questions

A lot more is already mapped out

About the CISCO 350-701 Implementing and Operating Cisco Security Core Technologies (SCOR) Certification