350-701

SCOR 350-701 Exam Details

Domain Weight Breakdown

Certification Path & Exam Strategy

The 350-701 SCOR is the core exam required for CCNP Security certification. Candidates must pass this exam plus one concentration exam (such as 300-710 SNCF, 300-715 SISE, 300-720 SESA, 300-725 SWSA, or 300-730 SVPN) to earn the CCNP Security credential. The SCOR exam also qualifies as the core exam for the CCIE Security certification, which additionally requires a hands-on lab exam.

The exam covers a broad range of security technologies spanning network security, cloud security, content security, endpoint protection, and secure network access. Cisco recommends 3-5 years of experience implementing enterprise security solutions before attempting this exam. Focus heavily on Cisco Firepower Threat Defense (FTD), Identity Services Engine (ISE), Cisco Umbrella, Cisco Secure Endpoint (formerly AMP for Endpoints), and VPN technologies as these form the backbone of the exam content.

Tip: The SCOR exam emphasizes understanding of how Cisco security products integrate together within the SecureX architecture. Do not study each product in isolation - understand how they share telemetry, context, and policy across the security ecosystem.

CIA Triad & Core Security Concepts

Additional concepts: Authentication (verify identity - MFA, certificates), Authorization (grant permissions - RBAC, ABAC), Accounting (log activity - syslog, NetFlow), Non-repudiation (cannot deny actions - digital signatures, audit logs).

Common Threats & Attack Types

Cryptography Fundamentals

Tip: Symmetric encryption is fast but has key distribution challenges. Asymmetric is slow but solves key exchange. In practice, IPsec/TLS use asymmetric for key exchange (IKE/handshake) and symmetric for bulk data (ESP/record layer).

VPN Technologies: IPsec Deep Dive

• IKEv1 Main Mode: 6 messages - first 2 negotiate policy, next 2 exchange DH keys, last 2 authenticate. Identity is protected (encrypted).
• IKEv1 Aggressive Mode: 3 messages - faster but identity sent in cleartext. Vulnerable to offline dictionary attacks.
• IKEv2 Advantages: Fewer messages (4 total for initial exchange), built-in NAT-T, MOBIKE support, EAP authentication, anti-replay, improved reliability.
• Authentication Methods: Pre-shared keys (PSK), RSA signatures (certificates), ECDSA, EAP (IKEv2 only).
• DH Groups: Group 2 (1024-bit, deprecated), Group 5 (1536-bit), Group 14 (2048-bit), Group 19/20 (ECC 256/384-bit). Higher groups = stronger but slower.

IPsec Protocols: AH vs ESP

Transport Mode: Encrypts only payload (host-to-host). Tunnel Mode: Encrypts entire original IP packet, adds new IP header (site-to-site, default). ESP in tunnel mode is the most common IPsec deployment.

SSL/TLS VPN vs IPsec VPN

Firewall Types & Cisco Firepower Threat Defense (FTD)

Cisco FTD combines ASA firewall features with Firepower (Snort-based IPS) into a unified image. Managed by Firepower Management Center (FMC) for multi-device management or Firepower Device Manager (FDM) for single-device. FTD provides: stateful firewalling, Snort IPS, AMP for Networks (file malware detection), URL filtering (with Talos intelligence), SSL/TLS decryption, and identity-based policies.

IPS/IDS & Snort Rules on Firepower

Snort Rule Structure:

• Actions: alert, log, pass, drop, reject, sdrop
• Detection Methods: Signature-based (known patterns), anomaly-based (baseline deviation), policy-based (rule violations)
• Firepower IPS Policies: Connectivity Over Security, Balanced Security and Connectivity (recommended), Security Over Connectivity, Maximum Detection

Cloud Security Models & Shared Responsibility

• Public Cloud: Multi-tenant, provider-owned infrastructure (AWS, Azure, GCP)
• Private Cloud: Single-tenant, owned/leased by organization (on-premises or hosted)
• Hybrid Cloud: Combination of public and private, data/apps move between them
• Community Cloud: Shared by organizations with common needs (government, healthcare)

Cisco Umbrella (DNS-Layer Security)

Cisco Umbrella is a cloud-delivered DNS security service that blocks requests to malicious domains before a connection is established. It acts as a recursive DNS resolver that inspects every DNS query against Cisco Talos threat intelligence.

Tip: Umbrella DNS resolvers: 208.67.222.222 and 208.67.220.220. Deployment options: point DNS to Umbrella, use virtual appliance (internal DNS forwarder), or install roaming client on endpoints. Umbrella is the first line of defense - it stops threats at the DNS layer before malware is downloaded.

Cisco Email Security Appliance (ESA) / Secure Email

Email Pipeline Order: Reputation Filtering (SenderBase) -> Message Filters -> Anti-Spam -> Anti-Virus -> AMP -> Content Filters -> Outbreak Filters -> DLP. Reputation filtering blocks ~80% of spam at the connection level, saving processing resources.

Cisco Web Security Appliance (WSA) / Secure Web Appliance

Deployment Modes: Explicit proxy (client configured with proxy address), Transparent proxy (WCCP redirect from router/switch - no client config needed), PAC file (auto-configuration). WSA can integrate with ISE for identity-based web policies.

CASB & Cisco SecureX

Cloud Access Security Broker (CASB): Sits between users and cloud services to enforce security policies. Key capabilities: Visibility (discover shadow IT, monitor cloud usage), Compliance (enforce regulatory policies across SaaS), Data Security (DLP, encryption, access control), Threat Protection (detect compromised accounts, anomalous behavior). Cisco Cloudlock is the CASB solution integrated with Umbrella.

Cisco SecureX: Cloud-native security platform that connects the Cisco security portfolio and third-party tools. It provides a unified dashboard for threat investigation, orchestration, and response across Umbrella, Secure Endpoint, Firepower, ESA, WSA, and ISE. SecureX Threat Response aggregates observables (IPs, domains, file hashes) from multiple sources and allows pivot investigation. SecureX Orchestration provides automated playbooks (SOAR capabilities) for incident response workflows.

Tip: SecureX is the integration glue for the Cisco security ecosystem. When asked about how Cisco products work together, SecureX is the answer. It provides single-pane-of-glass visibility, automated incident response, and cross-product telemetry correlation.

Cisco Secure Endpoint (formerly AMP for Endpoints)

Cisco Secure Endpoint is an advanced endpoint protection platform that provides prevention, detection, and response capabilities against malware and advanced threats. It uses a cloud-based architecture for real-time threat intelligence from Cisco Talos.

Tip: Retrospective security is unique to AMP/Secure Endpoint. Unlike traditional AV that only checks files at execution time, AMP continuously reassesses file dispositions. If Talos later identifies a previously unknown file as malicious, AMP retroactively alerts and can automatically quarantine the file across all endpoints.

Mobile Device Management (MDM) & BYOD Security

• MDM: Centralized management of mobile devices - enforce passcode policies, remote wipe, app distribution, OS updates, GPS tracking, containerization (separate personal/corporate data)
• MAM (Mobile Application Management): Manage apps without controlling the entire device - app wrapping, per-app VPN, selective wipe (corporate apps only)
• BYOD (Bring Your Own Device): Employees use personal devices for work. Requires: enrollment (onboarding), posture assessment, certificate provisioning, network segmentation (limited vs full access)
• COPE (Corporate-Owned, Personally Enabled): Company owns device but allows personal use. More control than BYOD
• CYOD (Choose Your Own Device): Employee selects from approved company-owned devices

ISE BYOD Flow: User connects -> 802.1X auth -> ISE identifies as unregistered BYOD -> redirects to self-service portal -> user installs certificate + profile -> posture check -> authorized with appropriate access level (e.g., limited VLAN for non-compliant).

802.1X Port-Based Network Access Control

EAP Methods:

• EAP-TLS: Mutual certificate authentication (most secure, requires client certificate)
• PEAP (Protected EAP): Server certificate + username/password inside TLS tunnel (most common)
• EAP-FAST: Cisco proprietary, uses PAC (Protected Access Credential) instead of certificates, faster than PEAP
• EAP-TTLS: Similar to PEAP, server certificate only, inner method can be any legacy protocol

MAB (MAC Authentication Bypass)

MAB is a fallback authentication method for devices that do not support 802.1X (printers, IP phones, IoT devices, cameras). The switch sends the device MAC address as the username and password to the RADIUS server (ISE). ISE matches the MAC against an internal endpoint database to authorize the device.

• Authentication Order: dot1x -> mab (try 802.1X first, fall back to MAB on timeout)
• Authentication Priority: dot1x -> mab (802.1X takes precedence if both respond)
• Limitation: MAC addresses can be spoofed - use MAB with ISE profiling for better security

Cisco ISE (Identity Services Engine)

Tip: ISE profiling probes collect attributes to identify devices. Key probes: DHCP (hostname, class-identifier), HTTP (User-Agent), DNS (reverse lookup), SNMP (device sysDescr), RADIUS (Calling-Station-ID = MAC). Profiling is critical for MAB accuracy and IoT device identification.

TrustSec: SGT & SGACL

Cisco TrustSec provides software-defined segmentation using Security Group Tags (SGTs). Instead of IP-based ACLs, TrustSec assigns a 16-bit SGT tag to each user/device at authentication time and enforces policy based on source SGT to destination SGT mappings.

Benefits over traditional ACLs: Topology-independent (no IP-based rules), scalable (add devices without updating rules), dynamic (policy follows user/device across network), simplified management (SGT matrix in ISE).

Remote Access VPN with Cisco AnyConnect

• AnyConnect Secure Mobility Client: Cisco's VPN client supporting SSL and IKEv2/IPsec remote access VPN. Deployed on ASA or FTD headend
• Full Tunnel: All traffic routed through VPN tunnel (split-tunnel disabled). More secure but higher bandwidth usage
• Split Tunnel: Only corporate traffic goes through VPN; internet traffic goes direct. Lower bandwidth but less security
• Always-On VPN: VPN connects automatically whenever the device is on. Prevents any non-VPN traffic (lockdown mode)
• Posture Module: AnyConnect can assess endpoint compliance (AV, patches, disk encryption) before granting VPN access
• ISE Integration: AnyConnect authenticates via ISE RADIUS, which can enforce CoA (Change of Authorization) if posture changes
• Per-App VPN: Only specified applications use the VPN tunnel (mobile MDM integration)

NetFlow & Flexible NetFlow

NetFlow is a Cisco-developed protocol that collects IP traffic metadata as flows. A flow is defined by a set of key fields: source/destination IP, source/destination port, IP protocol, ingress interface, and ToS byte. NetFlow provides visibility into who is communicating, what applications are used, and how much bandwidth is consumed.

• Flow Record: Defines what fields to collect (match/collect criteria)
• Flow Exporter: Defines where to send flows (collector IP, port 2055/9995, transport protocol)
• Flow Monitor: Binds record + exporter, applied to interface
• Use Cases: Traffic accounting, bandwidth monitoring, anomaly detection, capacity planning, security forensics

Cisco Stealthwatch / Secure Network Analytics

Cisco Stealthwatch (now Secure Network Analytics) is a network detection and response (NDR) solution that uses NetFlow, IPFIX, and other telemetry to provide deep visibility into network traffic and detect threats using behavioral analytics and machine learning.

• Behavioral Analysis: Baselines normal traffic patterns, detects deviations (C&C communication, data exfiltration, lateral movement, DDoS, insider threats)
• Encrypted Traffic Analytics (ETA): Detects malware in encrypted traffic WITHOUT decryption, using metadata (Initial Data Packet, SPLT - Sequence of Packet Lengths and Times)
• Security Events: Addr_Scan, Beaconing_Host, Data_Hoarding, High_Traffic, New_Large_Connection, Suspect_Data_Loss

Tip: Encrypted Traffic Analytics (ETA) is a key SCOR topic. Traditional security tools cannot inspect encrypted traffic. ETA uses machine learning on flow metadata (not payload) to identify malicious patterns in TLS-encrypted sessions. It analyzes the TLS handshake, certificate information, and packet timing patterns.

Cisco pxGrid (Platform Exchange Grid)

pxGrid is a context-sharing framework that enables security products to exchange real-time data. ISE is the primary publisher, sharing user identity, device posture, SGT assignments, and session data. Other products consume this context to make better security decisions.

pxGrid v2: Uses WebSocket + STOMP protocol (replacing XMPP in v1), REST-based APIs, supports pub/sub model. Consumers subscribe to topics published by providers.

Cisco Talos Threat Intelligence

Cisco Talos is one of the world's largest commercial threat intelligence teams. It analyzes millions of malware samples, billions of web requests, and trillions of DNS queries daily to produce actionable threat intelligence that feeds all Cisco security products.

• Feeds: IP/domain reputation, file reputation (SHA-256), Snort rules, ClamAV signatures, vulnerability disclosures
• Products Fed: Firepower IPS, Umbrella DNS, Secure Endpoint (AMP), ESA, WSA, SecureX Threat Response
• Talos Intelligence Portal: Public reputation lookups for IPs, domains, and file hashes
• Indicators of Compromise (IoCs): IP addresses, domains, URLs, file hashes, email addresses, behavioral patterns

SIEM Integration & Security Operations

Log Sources for SIEM: Firewall logs (ASA/FTD syslog), IPS alerts (Firepower eStreamer), Endpoint events (Secure Endpoint API), DNS logs (Umbrella), Authentication logs (ISE), Email logs (ESA), NetFlow (Stealthwatch). Use syslog (UDP 514, TCP 514/6514 for TLS) and eStreamer (Firepower-specific protocol) for log forwarding.

Cisco ASA vs Cisco FTD (Firepower Threat Defense)

Tip: Cisco is migrating all customers from ASA to FTD. FTD is the strategic platform. Key FTD advantage: unified policy management through FMC with integrated NGFW features that required separate modules on ASA.

IKEv1 vs IKEv2

802.1X vs MAB vs Web Authentication

RADIUS vs TACACS+

Tip: Use RADIUS for network access control (802.1X, VPN authentication via ISE). Use TACACS+ for device administration (controlling who can access router/switch CLI and what commands they can run). ISE supports both protocols.

Cisco Security Product Quick Reference

Deployment Modes Comparison

Tip: For SCOR exam, know when to use each deployment mode. Routed mode is the default for perimeter firewalls. Transparent mode is ideal when you need to add a firewall without renumbering IP addresses. Inline tap is useful for testing IPS rules before committing to inline blocking. Passive/SPAN is for monitoring and detection only.