Free SCOR Practice Questions

Question 1

An FTD 7.6 appliance receives a new plaintext TCP connection from 10.44.8.25 to 10.60.4.10:8080. Prefiltering sends it for analysis. The deployed access control rules are ordered as follows:

1. Monitor: 10.44.8.0/24 to 10.60.4.10, TCP/8080
2. Trust: 10.44.0.0/16 to 10.60.0.0/16, any port
3. Allow: 10.44.8.0/24 to 10.60.4.10, TCP/8080, intrusion policy attached

The connection succeeds, but rule 3 records no hits. How can the engineer apply intrusion inspection to this application without changing how other connections are handled?

Accepted Answer

Move rule 3 above rule 2, retaining its match conditions and intrusion policy.

Answer

Move rule 1 below rule 3, leaving Trust above Allow.

Answer

Enable connection logging on rule 2 so its matched traffic reaches the intrusion policy.

Answer

Change rule 2 from Trust to Allow without attaching an intrusion policy to that rule.

Question 2

An engineering assistant uses retrieval-augmented generation to answer questions for two customer tenants. Users authenticate successfully, and every document in the shared vector store retains its tenant label. Nevertheless, a Tenant A user receives passages from Tenant B: the retrieval service searches all documents by similarity when building the model context. Each customer must continue receiving answers from its own documents. Where does the missing security check belong?

Accepted Answer

During retrieval, by excluding documents the requesting user is not authorized to access.

Answer

In the system prompt, by prohibiting disclosure of foreign-tenant content.

Answer

At storage, by encrypting vector records while retaining the shared scope of retrieval queries.

Answer

At sign-in, by requiring a second authentication factor before permitting users to retrieve documents.

Question 3

Live Cisco Secure Endpoint telemetry shows a credential-stealing process uploading data from one employee workstation to a confirmed attacker-controlled address. The connector is online, isolation is enabled, and the communication paths needed for remote investigation have been tested under isolation. No other host shows related activity. Select the immediate response that contains the confirmed compromise and preserves remote investigation.

Accepted Answer

Isolate the workstation through Secure Endpoint and confirm isolation before investigating persistence and exposure.

Answer

Quarantine the executable, keeping the workstation connected to check whether uploads stop.

Answer

Block the destination at the perimeter and leave the workstation connected while collecting additional endpoint evidence.

Answer

Disconnect the workstation's entire access VLAN and restore individual hosts after completing a subnet-wide investigation.

Question 4

Remote HR users intermittently lose access to payroll through Cisco Secure Access. Successful and failed attempts have the same identity, posture result, and matching Private Access Allow rule. Both members of the resource connector group report healthy and resolve payroll.hr.example to the same address. Connector C1 completes TCP 443 connections to that address; C2 sends SYN packets but receives no response. The group must remain redundant. What is the appropriate repair?

Accepted Answer

Repair the private network path between C2 and the payroll service on TCP 443.

Answer

Add a higher-priority Allow rule covering all private resources for the HR group.

Answer

Renew the payroll TLS certificate and redistribute it to both connector hosts.

Answer

Remove C2 permanently and operate the application through the remaining connector.

Question 5

Only one patch can be deployed before tonight's maintenance window closes. Both fixes have passed testing and require comparable downtime. An internet-facing VPN gateway has a CVSS v4.0 Base score of 8.2 and provides access to a production administration network; the vendor confirms active exploitation of its vulnerability. A training-lab service has a Base score of 9.4, is isolated from production, and has no observed exploitation. What should the team prioritize, and why?

Accepted Answer

Prioritize the VPN despite its High base severity, given active exploitation and production exposure.

Answer

Patch the lab first; its Critical base severity determines remediation order.

Answer

Defer both patches; complete Threat and Environmental scoring before committing to a remediation order for these vulnerabilities.

Answer

Prioritize the VPN; its current exposure requires increasing the vendor's published Base severity from High to Critical.

Question 6

A Kubernetes payments pod has labels app=payments and quarantine=yes. The cluster enforces NetworkPolicy, and these are the only policies selecting this pod:

allow-frontend: selects app=payments; permits ingress on TCP 8443 from role=frontend pods in the same namespace.
quarantine: selects quarantine=yes; policyTypes=[Ingress]; ingress=[].

Both policies are active, yet a frontend pod can still establish new TCP 8443 connections to the quarantined pod. Neither uses host networking. Which policy change closes that path while preserving frontend access to the other payments replicas?

Accepted Answer

Exclude quarantined pods from the destination selector of allow-frontend while retaining its existing source and port conditions.

Answer

Recreate quarantine after allow-frontend so that the quarantine policy takes precedence over the earlier policy.

Answer

Add another policy selecting the quarantined pod that permits ingress only from incident-response pods on TCP 8443.

Answer

Broaden quarantine's destination selector to app=payments while retaining its empty ingress list.

Question 7

A switch port carries separate authenticated sessions for an IP phone and a workstation connected through it. The workstation has completed ISE posture remediation and now needs its authorized application access restored. The revised authorization changes only its downloadable ACL; its VLAN and IP address stay the same. The phone is carrying a call, and the switch supports session-specific reauthentication. Which CoA operation fits these constraints?

Accepted Answer

Reauthenticate the workstation's session so its authorization is reevaluated without cycling the shared physical port.

Answer

Bounce the physical switch port so both attached devices receive fresh authorization.

Answer

Terminate both sessions and allow the phone and workstation to authenticate again before restoring their network access.

Answer

Leave the existing authorization in place until the next scheduled authentication cycle to avoid sending CoA during the call.

Question 8

A policy-based site-to-site VPN on FTD 7.7 has an established IKEv2 SA and an installed Child SA for local 10.24.0.0/24 and remote 10.91.0.0/24. Fresh connections from 10.24.0.40 to 10.91.0.25 fail, and the local IPsec encapsulation counter does not increase. Packet-tracer reports:

Route: correct outside interface
Access control: allow
NAT: source 10.24.0.40 translated to outside address 198.51.100.14

The intended identity-NAT rule has zero hits and follows the matching broad manual PAT rule in the same NAT section. Which correction fits these results?

Accepted Answer

Move the subnet-specific identity-NAT rule before PAT, then verify encryption of the untranslated flow.

Answer

Permit UDP/4500 on the peer path to carry the inner private addresses through NAT traversal.

Answer

Clear the IKEv2 and Child SAs so renegotiation selects the identity-NAT rule for new traffic.

Answer

Change the local VPN selector to 198.51.100.14 so it matches the source after PAT translation.

Question 9

A manufacturer distributes firmware to gateways administered by different customers. Each gateway must verify the publisher and detect tampering. Compromising one gateway must not give an attacker the credentials needed to approve altered firmware for the others. Image confidentiality is unnecessary, and every gateway supports the listed mechanisms. What should the manufacturer deploy for quantum-resistant publisher authentication?

Accepted Answer

Sign the image with ML-DSA and provision the publisher's public verification key.

Answer

Encrypt the image with AES-256 and provision the fleet's shared decryption key.

Answer

Authenticate the image with HMAC-SHA-256 and provision one key across the fleet.

Answer

Publish the image with its SHA-256 digest and retrieve both from the same mirror.

Question 10

Authorized phishing simulations from drills@training.example are being quarantined by a matching Cisco Secure Email Threat Defense policy exception. Adding that address to Microsoft Safe Senders did not help. Reclassifying and restoring one test message also left subsequent tests quarantined. Security has approved leaving future simulation messages from this exact sender in recipients' inboxes while retaining the current handling of other phishing messages. Which policy edit implements that exception?

Accepted Answer

Place a higher-ranked incoming exception for drills@training.example that leaves its Phishing-verdict messages in the inbox.

Answer

Add training.example to Microsoft Safe Senders, retaining the existing Email Threat Defense policy.

Answer

Stop remediating incoming phishing messages generally and retain the existing quarantine exception for messages matching its conditions.

Answer

Reclassify all stored simulation messages as neutral and retain the current exception rules to handle subsequent simulation deliveries.

Free SCOR Practice Questions

Domain 1: Security Concepts 20% of exam

Question 1

Question 2

Question 3

Domain 2: Network Security 25% of exam

Question 4

Question 5

Domain 3: Cloud Security 15% of exam

Question 6

Domain 4: Secure Service Edge 10% of exam

Question 7

Domain 5: Endpoint Protection and Detection 15% of exam

Question 8

Question 9

Domain 6: Network Access, Visibility, and Enforcement 15% of exam

Question 10

That's 10 of 1,030