Cisco 350-701 Practice Test

350-701 practice test: what's covered

• CCNP Security Core
• SCOR 350-701

Free 350-701 sample questions

1. A finance user receives an email that appears to be from the CEO requesting an urgent wire transfer to a new vendor. The email passed SPF and DKIM because the attacker used a look-alike domain (ceo@c0mpany.com vs ceo@company.com). Which attack BEST describes this technique?

   • A. Spear phishing with cousin-domain spoofing (BEC)
   • B. Pharming via DNS cache poisoning
   • C. Whaling using DMARC bypass
   • D. Smishing with SIM-swap
   Show answer

   Correct: A. Business Email Compromise (BEC) using a cousin/look-alike domain registers a similar-looking domain — SPF/DKIM pass because the attacker controls the cousin domain legitimately. Whaling targets execs but here the exec is impersonated, not targeted. Pharming requires DNS-level redirection. The defense is DMARC enforcement on your own domain plus user training and visual indicators on first-time-sender mail.

2. A penetration test report flags that an internal HR application returns full database error stack traces when an attacker injects a quote in the URL parameter. Which OWASP Top 10 category does this MOST directly map to?

   • A. A03:2021 Injection
   • B. A05:2021 Security Misconfiguration (verbose errors revealing internals)
   • C. A01:2021 Broken Access Control
   • D. A07:2021 Identification and Authentication Failures
   Show answer

   Correct: B. Verbose error pages exposing stack traces, DB names, and table structures are a classic Security Misconfiguration (A05). Although the quote may indicate a possible injection vector, the *finding* in the report is the information leakage. Students often pick A03 because a quote is involved, but the actual leakage is configuration-level — turn off debug mode in production.

3. Which THREE properties define the goals of the Zero Trust Architecture according to NIST SP 800-207? (Choose 3)

   • A. Never trust, always verify — every request authenticated and authorized
   • B. Assume breach; minimize blast radius via micro-segmentation
   • C. Trust the internal network because it is behind the firewall
   • D. Verify explicitly with strong identity and device posture signals
   • E. Provide implicit trust to executives to reduce friction
   • F. Place all critical resources on a flat VLAN for performance
   Show answer

   Correct: A and B and D. NIST 800-207 Zero Trust principles: never trust/always verify, assume breach, verify explicitly. The other options are *opposite* of Zero Trust — implicit trust based on network location, role, or convenience is exactly what ZTA replaces. Cisco maps this to ISE + Duo + SD-Access + Umbrella SSE.

4. An attacker sends crafted gratuitous ARP replies announcing the attacker MAC as the IP of the default gateway. Endpoints update their ARP caches and route traffic through the attacker. Which Layer-2 attack is this and which feature stops it on a Cisco switch?

   • A. DHCP starvation — mitigated by port-security
   • B. ARP spoofing — mitigated by Dynamic ARP Inspection (DAI) with DHCP snooping binding
   • C. MAC flooding — mitigated by storm-control
   • D. VLAN hopping — mitigated by disabling DTP
   Show answer

   Correct: B. ARP spoofing/poisoning is countered by DAI, which validates ARP packets against the DHCP snooping binding table. Port-security caps MAC addresses but does not validate ARP content. MAC flooding overwhelms the CAM table — different attack. VLAN hopping uses tagged frames against DTP. DAI must run *with* DHCP snooping enabled for the binding table to exist.

5. A red team performs a CAM-table overflow attack by sending thousands of frames with random source MACs, causing the switch to flood unicast frames out all ports. Which feature on a Cisco access switch prevents this?

   • A. BPDU Guard
   • B. Port Security with a maximum MAC limit and violation action
   • C. Root Guard
   • D. IP Source Guard
   Show answer

   Correct: B. Port-security caps the number of source MACs learned per port (default 1) and applies an action (restrict/shutdown) on violation, preventing CAM overflow. BPDU Guard blocks rogue STP BPDUs on PortFast edges. Root Guard prevents a downstream switch becoming root. IP Source Guard stops IP spoofing using DHCP snooping bindings.

Last updated: 2026-10-19

350-701 practice test FAQ

Related practice tests

• CCIE Security Written practice
• 200-301 practice test
• 350-401 practice test