350-701 questions and answers

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/
Security__Internet_Access__and_Communication_Ports.html

References:
https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/215470-site-to-site-vpn-configuration-on-ftd-ma.html

References:
https://support.umbrella.com/hc/en-us/articles/115004564126-SSL-Decryption-in-the-IntelligentProxy

Two-factor authentication adds a second layer of security to your online accounts. Verifying your identity using asecond factor (like your phone or other mobile device) prevents anyone but you from logging in, even if theyknow your password.Note: Single sign-on (SSO) is a property of identity and access management that enables users to securelyauthenticate with multiple applications and websites by logging in only once with just one set of credentials(username and password). With SSO, the application or website that the user is trying to access relies on atrusted third party to verify that users are who they say they are.

An application that does not validate user input is particularly susceptible to SQL injection attacks. In an SQL injection attack, an attacker can insert or "inject" a SQL query via the input data from the client to the application. Due to the lack of validation, the malicious SQL commands are executed by the database server, leading to unauthorized access or manipulation of the database.

References:
https://www.cisco.com/c/dam/en_us/about/doing_business/legal/service_descriptions/docs/
activethreat- analytics-premier.pdf

Cisco Firepower operates at the network level, providing intrusion prevention before malware reaches the endpoint. It delivers advanced threat prevention and mitigation for both known and unknown threats by analyzing real-time traffic. Additionally, it offers network discovery capabilities, identifying hosts,
applications, and communication paths to support context-aware security policies.

Cisco AMP (Advanced Malware Protection) focuses on endpoint security. It provides detection, blocking, tracking, analysis, and remediation to protect against persistent malware threats. AMP offers outbreak control through custom detection rules and can determine the root cause of an attack based on indicators of compromise. Its retrospective analysis allows it to block files even after they've initially passed inspection, ensuring continuous protection and deep visibility into how threats enter and move within the environment.

In summary, Firepower is designed for proactive network-layer threat prevention, while AMP emphasizes endpoint protection with advanced tracking, retrospective analysis, and root cause identification. Together, they provide comprehensive security across both network and endpoint environments.

A multicontext firewall is a feature that allows a single physical firewall to be divided into multiple virtual firewalls, also known as security contexts. Each context operates as an independent device, with its own security policy, interfaces, and administrators. This feature is useful for service providers, large enterprises, or any network that requires more than one firewall. One of the problems that a multicontext firewall can solve is an overlapping IP addressing plan. This means that different contexts can use the same IP addresses without causing conflicts, as long as they are separated by different interfaces or VLANs. This allows for more efficient use of IP address space and easier management of multiple networks. A multicontext firewall can also support dynamic routing protocols and VPNs within each context, providing more flexibility and functionality12 References := 1: What Are Multi-Context Firewalls? -
Franklin Fitch 2:

Multiple Context Mode - Cisco

A certificate signing request (CSR) is one of the first steps towards getting your own SSL Certificate.
Generated on the same server you plan to install the certificate on, the CSR contains information (e.g. common name, organization, country) that the Certificate Authority (CA) will use to create your certificate.
It also contains the public key that will be included in your certificate and is signed with the corresponding private key

References:
https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-configguide-v64/introduction_to_network_discovery_and_identity.html

References:
https://talosintelligence.com/newsletters

Domain name system (DNS) is the protocol that translates human-friendly URLs, such as securitytut.com, into IP addresses, such as 183.33.24.13. Because DNS messages are only used as the beginning of each communication and they are not intended for data transfer, many organizations do not monitor their DNS traffic for malicious activity. As a result, DNS-based attacks can be effective if launched against their networks. DNS tunneling is one such attack.An example of DNS Tunneling is shown below:

The attacker incorporates one of many open-source DNS tunneling kits into an authoritative DNSnameserver (NS) and malicious payload.2. An IP address (e.g. 1.2.3.4) is allocated from the attacker's infrastructure and a domain name (e.g. attackerdomain.com) is registered or reused. The registrar informs the top-level domain (.com) nameservers to refer requests for attackerdomain.com to ns.attackerdomain.com, which has a DNS record mapped to 1.2.3.43. The attacker compromises a system with the malicious payload. Once the desired data is obtained, the payload encodes the data as a series of 32 characters (0-9, A-Z) broken into short strings (3KJ242AIE9, P028X977W,...).4. The payload initiates thousands of unique DNS record requests to the attacker's domain with each string as
References:
https://learn-umbrella.cisco.com/i/775902-dns-tunneling/0

https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-mfa-password-security-infographic.pdf

References:
https://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configurefirepower-00.html

GETVPN Simplifies branch-to-branch instantaneous communications - Ensures low latency and jitter by enabling full-time, direct communications between sites, without requiring transport through a central hub

Maximizes security - Provides encryption for MPLS networks while maintaining network intelligence such as full-mesh connectivity, natural routing path, and quality of service (QoS)

Complies with governmental regulation and privacy laws - Helps you meet security compliance and internal regulation by encrypting all WAN traffic

Offers management flexibility - Eliminates complex peer-to-peer key management with group encryption keys

Cisco Stealthwatch Cloud: Available as an SaaS product offer to provide visibility and threat detection within public cloud infrastructures such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).

https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/eta-sda-fabric-deployment-guide-2019sep.pdf

https://www.cisco.com/c/en/us/td/docs/security/ise/1-4-1/admin_guide/b_ise_admin_guide_141/b_ise_admin_guide_141_chapter_01110.html

Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message.Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on.For example the code below is written in hex:
<ahref=javascript:alert&#x28'XSS')>Click Here</a>is equivalent to:<a href=javascript:alert('XSS')>Click
Here</a>Note: In the format "&#xhhhh", hhhh is the code point in hexadecimal form.

DevSecOps (development, security, and operations) is a concept used in recent years to describe how to movesecurity activities to the start of the development life cycle and have built-in security practices in the continuousintegration/ continuous deployment (CI/CD) pipeline. Thus minimizing vulnerabilities and bringing security closerto IT and business objectives.Three key things make a real DevSecOps environment:+ Security testing is done by the development team.+ Issues found during that testing is managed by the development team.+ Fixing those issues stays within the development team.

References:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-sy/sec-usr-aaa-15-sy-book/sec-rad-coa.html

References:
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-configguide-v63/scada_preprocessors.html
Both DNP3 and CIP preprocessors can be used to detect traffic anomalies but we choose CIP as it is widely used in industrial applications.Note:+ An intrusion rule is a specified set of keywords and arguments that the system uses to detect attempts to exploit vulnerabilities in your network. As the system analyzes network traffic, it compares packets against the conditions specified in each rule, and triggers the rule if the data packet meets all the conditions specified in the rule. + Preprocessor rules, which are rules associated with preprocessors and packet decoder detection options in the network analysis policy. Most preprocessor rules are disabled by default.

References:
https://www.ciscopress.com/articles/article.asp?p=24833&seqNum=4

References:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/cfgmpls-netflow.html

Dynamic ARP Inspection
To prevent ARP poisoning attacks such as the one described in the previous section, a switch must ensure that only valid ARP requests and responses are relayed. DAI prevents these attacks by intercepting all ARP requests and responses. Each of these intercepted packets is verified for valid MAC address to IP address bindings before the local ARP cache is updated or the packet is forwarded to the appropriate destination. Invalid ARP packets are dropped.

DAI determines the validity of an ARP packet based on valid MAC address to IP address bindings stored in a trusted database. This database is built at runtime by DHCP snooping, provided that it is enabled on the VLANs and on the switch in question. In addition, DAI can also validate ARP packets against user-configured ARP ACLs in order to handle hosts that use statically configured IP addresses.

DAI can also be configured to drop ARP packets when the IP addresses in the packet are invalid or when the MAC addresses in the body of the ARP packet do not match the addresses specified in the Ethernet header.

Patch management remediation is performed.
Cisco ISE's posture module can detect missing patches on endpoints and trigger remediation actions, ensuring systems are updated before allowing full network access.

The latest antivirus updates are applied before access is allowed.
The posture module checks if antivirus software is installed and up to date. If not, it can block access or initiate remediation to enforce compliance.

References:
https://www.cisco.com/c/en/us/products/collateral/security/firesight-management-center/
datasheetc78-736775.html

sfr {fail-open | fail-close [monitor-only]} <- There's a couple different options here. The first one is fail-open which means that if the Firepower software module is unavailable, the ASA will continue to forward traffic. fail-close means that if the Firepower module fails, the traffic will stop flowing. While this doesn't seem ideal, there might be a use case for it when securing highly regulated environments. The monitor-only switch can be used with both and basically puts the Firepower services into IDS-mode only. This might be useful for initial testing or setup.

The purpose of message integrity algorithms, such as Secure Hash Algorithm (SHA-1), ensures data has notbeen changed in transit. They use one way hash functions to determine if data has been changed.SHA- 1, which is also known as HMAC-SHA-1 is a strong cryptographic hashing algorithm, stronger thananother popular algorithm known as Message Digest 5 (MD5). SHA-1 is used to provide data integrity (toguarantee data has not been altered in transit) and authentication (to guarantee data came from the source itwas supposed to come from). SHA was produced to be used with the digital signature standard.A VPN uses groundbreaking 256-bit AES encryption technology to secure your online connection againstcyberattacks that can compromise your security. It also offers robust protocols to combat malicious attacks and reinforce your online identity.IKE SAs describe the security parameters between two IKE devices, the first stage in establishing IPSec

Cisco FMC's Threat Intelligence Director allows security teams to integrate security intelligence observables from various sources, such as Cisco Talos, into their Cisco FMC environment. This allows the FMC to push updated security intelligence to its sensors, enabling them to better detect and respond to potential threats.

References:
https://docs.umbrella.com/deployment-umbrella/docs/what-is-the-intelligent-proxy

References:
https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2019/pdf/5eU6DfQV/LTRSEC-2240-
LG2.pdf

References:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_010001.html

https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/98628-zone-design-guide.html

References:
https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_010100.html.xml#:~:text=Network%20probe%20is%20a%20method,in%20the%20Cisco%20ISE%20database

ExplanationStorm control prevents traffic on a LAN from being disrupted by a broadcast, multicast, or unicast storm on one of the physical interfaces. A LAN storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. Errors in the protocol-stack implementation, mistakes in network configurations, or users issuing a denial-of-service attack can cause a storm.By using the " storm-control broadcast level [falling-threshold]" we can limit the broadcast traffic on the switch.

References:
CCNP And CCIE Security Core SCOR 350-701 Official Cert Guide

Endpoint protection platforms (EPP) prevent endpoint security threats like known and unknown malware.Endpoint detection and response (EDR) solutions can detect and respond to threats that your EPP and other security tools did not catch.EDR and EPP have similar goals but are designed to fulfill different purposes. EPP is designed to providedevice-level protection by identifying malicious files, detecting potentially malicious activity, and providing tools for incident investigation and response.The preventative nature of EPP complements proactive EDR. EPP acts as the first line of defense, filtering out attacks that can be detected by the organization's deployed security solutions. EDR acts as a second layer of protection, enabling security analysts to perform threat hunting and identify more subtle threats to the endpoint.Effective endpoint defense requires a solution that integrates the capabilities of both EDR and EPP to provide protection against cyber threats without overwhelming an organization's security team.