CCIE Security Written (350-701) Advanced Practice

350-701 practice test: what's covered

This is an advanced set for the same 350-701 blueprint as the CCNP SCOR practice test. Use the SCOR page for the core exam.

• Network
• cloud
• content
• endpoint
• secure access
• visibility

Free 350-701 sample questions

1. An engineer pushes a new access control policy from FMC to a pair of FTD appliances, but the FMC management interface goes offline during the maintenance window. End users report that traffic is still being filtered correctly. Which statement explains this behavior?

   • A. FTD enforces the last successfully deployed policy locally in its data plane and continues inspecting traffic even while FMC is unreachable
   • B. FTD forwards every packet to FMC for a centralized inspection verdict, so it fails open when FMC is unreachable
   • C. FTD discards its policy whenever the FMC heartbeat is lost and reverts to permitting all traffic by default
   • D. FTD requires a live FMC session to evaluate any access control rule and silently drops all transit traffic
   Show answer

   Correct: A. FMC is the management and policy-authoring plane while FTD owns local data-plane enforcement. Once a policy is deployed, FTD keeps inspecting with the last-known good config, which is why filtering continues. The other answers are incorrect because FTD does not stream packets to FMC for verdicts, does not fail open, and does not drop transit traffic when management connectivity is lost.

2. While planning an upgrade to FTD 7.x, an engineer wants the inspection engine that delivers multi-threaded processing, improved protocol decoding, and easier custom rule authoring with OpenAppID. Which engine should be selected on the device?

   • A. Snort 3, the modern multi-threaded inspection engine that replaces the legacy single-threaded Snort 2
   • B. Snort 2, the legacy single-threaded engine retained as the default for all new 7.x deployments
   • C. Standard Linux iptables operating as the primary deep packet inspection engine on FTD
   • D. Classic Cisco IOS inspection running natively inside the FTD data plane for application visibility
   Show answer

   Correct: A. Snort 3 is the current FTD inspection engine offering higher throughput, better protocol decoding, and simpler rule writing via OpenAppID and the Snort 3 LSP. Snort 2 is incorrect because it is the legacy engine being phased out; iptables and IOS are wrong because FTD inspection is driven by Snort, not by generic Linux netfilter rules or classic IOS code.

3. A security architect is designing TrustSec/SGT-based segmentation enforced on FTD so that policy is expressed as tag-to-tag rules independent of IP addressing. Which mechanisms can deliver IP-to-SGT or SGT mappings to the FTD enforcement point? (Choose TWO)

   • A. SXP (SGT Exchange Protocol) sessions carrying IP-to-SGT bindings learned at the authentication point
   • B. ISE pxGrid integration publishing session and SGT context that FMC subscribes to
   • C. Spanning Tree Protocol BPDUs carrying the SGT value inside the bridge ID field
   • D. DHCP option 82 strings used to transport SGT values inside lease acknowledgements
   • E. HSRP hello packets distributing SGT assignments between active and standby gateways
   Show answer

   Correct: A and B. SXP propagates IP-to-SGT bindings to devices that did not witness the original authentication, and pxGrid lets FMC subscribe to ISE session and SGT context, so both feed FTD enforcement. STP, DHCP option 82, and HSRP are incorrect because those protocols have no role in carrying security group tags and were never designed to transport identity information.

4. An enterprise is sizing a production ISE deployment for 40,000 endpoints across three data centers and needs both administrative resilience and RADIUS scale. Which persona layout best fits this requirement?

   • A. Distributed deployment with redundant Policy Administration Nodes, redundant Monitoring nodes, and multiple Policy Service Nodes spread across sites
   • B. A single all-in-one node running PAN, MnT, and PSN personas for the entire enterprise to simplify operations
   • C. Two Policy Administration Nodes only, with no dedicated Monitoring or Policy Service Nodes deployed anywhere
   • D. Several Monitoring nodes only, relying on each network device to perform its own local RADIUS decisions
   Show answer

   Correct: A. A distributed deployment separates the PAN (admin/config), MnT (logging/reporting), and PSN (RADIUS/TACACS+ processing) personas so each scales and fails over independently, which suits large multi-site designs. The all-in-one and PAN-only options are incorrect because they cannot scale RADIUS load or provide redundancy, and relying on local device decisions defeats the purpose of centralized policy.

5. A wireless client connects to a corporate SSID configured for 802.1X. Trace the RADIUS flow that results in the controller applying a dynamic VLAN and dACL. Which sequence is correct?

   • A. The WLC acting as NAS forwards an Access-Request to an ISE PSN, which evaluates the authorization policy and returns Access-Accept with VLAN, dACL, and SGT attributes for the WLC to apply
   • B. The client sends RADIUS directly to ISE, bypassing the WLC, and ISE programs the access switch port without involving the controller at all
   • C. The WLC makes the full authentication and authorization decision locally and only informs ISE of the result afterward for logging
   • D. ISE pushes a static VLAN to every client identically and never evaluates per-session authorization conditions
   Show answer

   Correct: A. In 802.1X, the WLC is the authenticator/NAS and ISE PSN is the policy decision point; ISE returns authorization attributes in the Access-Accept that the WLC enforces. The other options are incorrect because the client never speaks RADIUS directly, the WLC does not make the authorization decision itself, and ISE evaluates per-session conditions rather than pushing one static VLAN to everyone.

Last updated: 2026-10-19

350-701 practice test FAQ

Related practice tests

• 350-701 SCOR practice test
• 200-301 practice test