Examers.io
ExamsOrganizationsHow it worksPricingHelp & FAQ
Sign inStart free
CISCO

Cisco Certified Network Professional Security

350-701

The Cisco Certified Network Professional (CCNP) Security certification validates your ability to design, implement, and operate core security technologies, including network security, cloud security, content security, endpoint protection, and secure network access. It is designed for security engineers and architects who protect enterprise networks and data. Earning this credential demonstrates advanced skills that are essential for securing modern, complex IT environments.

Practice Free Questions

1289 practice questions · Updated 2026-07-30

6Domains
47Objectives
319Concepts
1289Questions

350-701 Curriculum

Every domain, objective, and concept the 350-701 exam measures.

1.1 Explain attack threats against on-premises, hybrid, and cloud environments such as viruses, trojans, DoS/DDoS, phishing, rootkits, man-in-the middle, malware, data breaches, insecure APIs, compromised credentials, PQC, and AI

14 concepts · 45 questions
  1. On-premises attack vectors
  2. Hybrid environment attack surfaces
  3. Cloud-specific threats
  4. Viruses and trojans
  5. DoS and DDoS attacks
  6. Phishing attacks
  7. Rootkits
  8. Man-in-the-middle attacks
  9. Malware categories
  10. Data breaches
  11. Insecure APIs
  12. Compromised credentials
  13. Post-quantum cryptography (PQC) threats
  14. AI-related attack threats

1.2 Describe security vulnerabilities and exploits such as software bugs, weak and/or hardcoded passwords, OWASP top ten, missing encryption ciphers, buffer overflow, path traversal, cross-site scripting/forgery, SQL injection, and identification and prioritization using CVEs and CVSS scores

10 concepts · 39 questions
  1. Software Bugs
  2. Weak and Hardcoded Passwords
  3. OWASP Top Ten
  4. Missing Encryption Ciphers
  5. Buffer Overflow
  6. Path Traversal
  7. Cross-Site Scripting (XSS)
  8. Cross-Site Request Forgery (CSRF)
  9. SQL Injection
  10. CVEs and CVSS Scores

1.3 Describe vulnerabilities in AI/LLM models such as prompt injection, system prompt leakage, vector and embedding weaknesses, and supply chain

4 concepts · 26 questions
  1. Prompt Injection
  2. System Prompt Leakage
  3. Vector and Embedding Weaknesses
  4. Supply Chain Vulnerabilities in AI/LLM

1.4 Describe the controls used to protect against phishing and social engineering attacks

7 concepts · 31 questions
  1. Phishing attack vectors
  2. Phishing attack types
  3. Social engineering techniques
  4. Technical controls against phishing
  5. User awareness and training
  6. Authentication and verification controls
  7. Incident response and reporting

1.5 Describe cryptography security components such as hashing, encryption, PKI, SSL, TLS, QUIC, MASQUE, IPsec, NAT-T IPv4 for IPsec, preshared key, certificate-based authorization, and post-quantum cryptography

12 concepts · 35 questions
  1. Hashing
  2. Symmetric Encryption
  3. Asymmetric Encryption
  4. Public Key Infrastructure (PKI)
  5. SSL/TLS
  6. QUIC
  7. MASQUE
  8. IPsec
  9. NAT-T IPv4 for IPsec
  10. Preshared Key
  11. Certificate-Based Authorization
  12. Post-Quantum Cryptography

1.7 Describe security intelligence authoring, sharing, and consumption

8 concepts · 25 questions
  1. Security Intelligence Authoring
  2. Security Intelligence Sharing
  3. Security Intelligence Consumption
  4. Threat Intelligence Feeds
  5. Indicators of Compromise (IOCs)
  6. STIX/TAXII
  7. Intelligence Lifecycle
  8. Integration with Security Tools

1.8 Describe zero trust architecture

6 concepts · 26 questions
  1. Zero Trust Architecture Definition
  2. Zero Trust Pillars
  3. Zero Trust Components
  4. Zero Trust Deployment Models
  5. Zero Trust vs Traditional Security
  6. Zero Trust Implementation Challenges

1.9 Describe defense in depth strategy such as Secure Architecture for Everyone (SAFE)

5 concepts · 27 questions
  1. Defense in Depth Principles
  2. SAFE Architecture Overview
  3. SAFE Pillars and Places in the Network
  4. SAFE Design and Implementation
  5. Mapping Security Controls to SAFE

1.10 Interpret scripts used to call security appliances APIs in a language such as Python

7 concepts · 24 questions
  1. API Authentication Methods
  2. HTTP Methods and Endpoints
  3. Request and Response Handling
  4. Error Handling and Status Codes
  5. Script Structure and Best Practices
  6. Use Case: Retrieving Security Data
  7. Use Case: Configuring Security Devices

2.1 Describe network security solutions and deployment models that provide intrusion prevention and firewall capabilities

5 concepts · 25 questions
  1. Intrusion Prevention Systems (IPS)
  2. Firewall Technologies
  3. Deployment Models
  4. Network Security Solutions Integration
  5. High Availability and Scalability

2.2 Describe security monitoring and telemetry technologies

12 concepts · 42 questions
  1. Security Monitoring Fundamentals
  2. Telemetry Data Sources
  3. NetFlow and IPFIX
  4. Syslog and Log Management
  5. SNMP for Monitoring
  6. Packet Capture and Analysis
  7. Threat Intelligence Feeds
  8. Security Information and Event Management (SIEM)
  9. Network Traffic Analysis (NTA)
  10. Endpoint Detection and Response (EDR)
  11. Orchestration and Automation in Monitoring
  12. Monitoring Architecture and Deployment

2.3 Configure network infrastructure security methods (network segmentation using VLANs or SGTs; Layer 2 and port security; DHCP snooping; Dynamic ARP inspection; storm control; and defenses against MAC, ARP, VLAN hopping, STP, and DHCP rogue attacks)

12 concepts · 34 questions
  1. VLAN Segmentation
  2. SGT Segmentation
  3. Layer 2 Security Fundamentals
  4. Port Security
  5. DHCP Snooping
  6. Dynamic ARP Inspection (DAI)
  7. Storm Control
  8. MAC Attack Defense
  9. ARP Attack Defense
  10. VLAN Hopping Defense
  11. STP Attack Defense
  12. Rogue DHCP Defense

2.4 Select management options for network security solutions (single vs. multidevice manager, in-band vs. out-of-band, on-premises vs. cloud with Cisco Security Cloud Control)

5 concepts · 24 questions
  1. Single vs. multidevice manager
  2. In-band vs. out-of-band management
  3. On-premises vs. cloud management
  4. Cisco Security Cloud Control
  5. Selecting management options

2.5 Describe CIS benchmarks for hardening devices such as Cisco Secure Firewall (FTD) and Cisco IOS XE

6 concepts · 29 questions
  1. CIS Benchmarks Overview
  2. CIS Benchmark Structure
  3. CIS Benchmarks for Cisco Secure Firewall (FTD)
  4. CIS Benchmarks for Cisco IOS XE
  5. Applying CIS Benchmarks
  6. Verifying Compliance

2.6 Troubleshoot AAA for device and network access such as TACACS+ and RADIUS

11 concepts · 32 questions
  1. AAA architecture overview
  2. TACACS+ protocol fundamentals
  3. RADIUS protocol fundamentals
  4. TACACS+ vs RADIUS comparison
  5. AAA configuration for device access
  6. AAA configuration for network access
  7. Troubleshooting AAA authentication
  8. Troubleshooting AAA authorization
  9. Troubleshooting AAA accounting
  10. AAA debugging and logging
  11. AAA server integration and testing

2.8 Implement access control policies, AVC, URL filtering, malware protection, and intrusion prevention using Cisco Secure Firewall (FTD)

6 concepts · 18 questions
  1. Access Control Policies
  2. Application Visibility and Control (AVC)
  3. URL Filtering
  4. Malware Protection
  5. Intrusion Prevention System (IPS)
  6. Integration of Security Features

2.9 Configure site-to-site and remote access VPN using Cisco Secure Firewall (FTD) and Cisco Secure Client

6 concepts · 14 questions
  1. Site-to-site VPN fundamentals on FTD
  2. Configuring site-to-site VPN on FTD
  3. Remote access VPN fundamentals on FTD
  4. Configuring remote access VPN on FTD
  5. Cisco Secure Client deployment and configuration
  6. VPN troubleshooting on FTD

2.10 Troubleshoot VPN tunnel establishment on Cisco Secure Firewall (FTD)

7 concepts · 21 questions
  1. VPN tunnel establishment phases
  2. Common VPN misconfigurations
  3. Troubleshooting commands and logs
  4. IKE and IPsec SA negotiation issues
  5. NAT and routing impact on VPN
  6. Certificate and authentication problems
  7. Firewall policy and interface issues

3.1 Describe security responsibility within common Cloud Shared Responsibility Models

7 concepts · 30 questions
  1. Shared Responsibility Model Overview
  2. Provider vs. Customer Responsibilities
  3. Service Model Variations
  4. Deployment Model Considerations
  5. Data and Access Responsibilities
  6. Provider-Specific Models
  7. Practical Application in Security

3.2 Select security capabilities, deployment models, cloud security frameworks, and policy management to secure the cloud

5 concepts · 29 questions
  1. Cloud Security Capabilities
  2. Cloud Deployment Models
  3. Cloud Service Models
  4. Cloud Security Frameworks
  5. Cloud Policy Management

3.3 Select security solutions for cloud environments (public; private; hybrid; community cloud; NIST 800-145 SaaS, PaaS, and IaaS; and Cloud Access Security Broker)

5 concepts · 26 questions
  1. Cloud Deployment Models
  2. NIST 800-145 Cloud Service Models
  3. Cloud Security Shared Responsibility Model
  4. Cloud Access Security Broker (CASB)
  5. Selecting Security Solutions for Cloud

3.4 Describe network, application, and data security in cloud environments with solutions such as Cisco Multicloud Defense and Cisco Secure Workload

9 concepts · 30 questions
  1. Cloud Security Fundamentals
  2. Network Security in Cloud
  3. Application Security in Cloud
  4. Data Security in Cloud
  5. Cisco Multicloud Defense Overview
  6. Cisco Multicloud Defense Capabilities
  7. Cisco Secure Workload Overview
  8. Cisco Secure Workload Capabilities
  9. Integration of Solutions

3.5 Configure Splunk to ingest cloud logging and monitoring data from other security solutions

5 concepts · 24 questions
  1. Splunk data ingestion fundamentals
  2. Cloud logging and monitoring data sources
  3. Integration with other security solutions
  4. Data parsing and field extraction
  5. Troubleshooting ingestion issues

3.6 Describe application and workload security concepts including eBPF

4 concepts · 26 questions
  1. Application security concepts
  2. Workload security concepts
  3. eBPF overview
  4. eBPF use cases in security

3.7 Describe DevSecOps (Infrastructure as Code security, CI/CD pipeline, container orchestration, and secure software development)

4 concepts · 24 questions
  1. Infrastructure as Code (IaC) Security
  2. CI/CD Pipeline Security
  3. Container Orchestration Security
  4. Secure Software Development Lifecycle (SSDLC)

4.1 Describe Security Service Edge (SSE) and Secure Access Service Edge (SASE)

5 concepts · 25 questions
  1. SSE Definition
  2. SASE Definition
  3. SSE vs SASE
  4. SSE Use Cases
  5. SASE Use Cases

4.2 Configure Cisco Secure Access Secure Internet Access

6 concepts · 27 questions
  1. Cisco Secure Access Overview
  2. Secure Internet Access Architecture
  3. Configuration of Secure Internet Access
  4. Integration with Identity Providers
  5. Policy Enforcement for Internet Traffic
  6. Monitoring and Troubleshooting

4.3 Configure Cisco Secure Access Secure Private Access

6 concepts · 26 questions
  1. Cisco Secure Access Overview
  2. Secure Private Access Components
  3. Configure Secure Private Access Policies
  4. Integrate with Identity Providers
  5. Deploy and Manage Connectors
  6. Monitor and Troubleshoot Secure Private Access

4.4 Configure data loss prevention and AI guardrails for secure internet access

6 concepts · 29 questions
  1. Data Loss Prevention (DLP) fundamentals
  2. DLP policy configuration
  3. DLP integration with secure internet access
  4. AI guardrails overview
  5. AI guardrail configuration
  6. Monitoring and reporting for DLP and AI guardrails

4.5 Interpret Cisco Secure Access Investigate scores and indicators

5 concepts · 26 questions
  1. Investigate scores
  2. Indicators of compromise
  3. Score thresholds and risk levels
  4. Investigate data sources
  5. Correlating scores with security events

5.1 Describe Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) solutions

4 concepts · 25 questions
  1. EPP vs EDR
  2. EPP Core Capabilities
  3. EDR Core Capabilities
  4. EPP and EDR Integration

5.2 Describe endpoint device management and asset inventory systems such as MDM

4 concepts · 24 questions
  1. MDM Overview
  2. MDM Features and Capabilities
  3. Asset Inventory Systems
  4. Integration of MDM and Asset Inventory

5.3 Describe endpoint posture assessment solutions to ensure endpoint security

6 concepts · 29 questions
  1. Endpoint Posture Assessment Overview
  2. Posture Assessment Components
  3. Posture Assessment Process
  4. Posture Assessment Technologies
  5. Integration with Security Infrastructure
  6. Remediation and Enforcement

5.4 Describe endpoint protection and detection security with solutions such as Cisco Secure Client and Cisco Secure Malware Analytics

5 concepts · 20 questions
  1. Cisco Secure Client Overview
  2. Cisco Secure Client Features
  3. Cisco Secure Malware Analytics Overview
  4. Malware Analysis Process
  5. Integration with Endpoint Protection

5.5 Configure endpoint antimalware protection using Cisco Secure Endpoint

8 concepts · 29 questions
  1. Cisco Secure Endpoint architecture
  2. Connector installation and configuration
  3. Policy creation and management
  4. Malware detection engines
  5. File trajectory and retrospective analysis
  6. Advanced malware protection (AMP) cloud integration
  7. Endpoint isolation and remediation
  8. Reporting and auditing

5.6 Interpret Cisco Secure Endpoint malware detection events

8 concepts · 32 questions
  1. Malware Event Categories
  2. Event Severity Levels
  3. Event Details and Artifacts
  4. Detection Technologies
  5. Event Lifecycle and Disposition
  6. Threat Intelligence Integration
  7. Event Correlation and Triage
  8. Remediation Actions

5.7 Configure email security features with Cisco Security Email Threat Defense

9 concepts · 29 questions
  1. Email Security Threat Defense Overview
  2. Mail Flow Policies
  3. Message Filters
  4. Content Filters
  5. Outbreak Filters
  6. Anti-Spam and Anti-Virus Settings
  7. Email Encryption
  8. Data Loss Prevention (DLP)
  9. Reporting and Tracking

6.1 Describe identity management and secure network access concepts such as guest services, profiling, posture assessment, and BYOD

5 concepts · 28 questions
  1. Identity Management Fundamentals
  2. Guest Services
  3. Profiling
  4. Posture Assessment
  5. BYOD (Bring Your Own Device)

6.2 Describe device compliance and application control

3 concepts · 15 questions
  1. Device Compliance
  2. Application Control
  3. Cisco Compliance and Application Control Technologies

6.3 Configure network access control mechanisms such as 802.1X and MAB with Cisco Identity Services Engine

7 concepts · 24 questions
  1. 802.1X Authentication Flow
  2. MAB (MAC Authentication Bypass)
  3. ISE as Authentication Server
  4. AAA and RADIUS Integration
  5. ISE Policy Sets and Authorization
  6. Profiling and Identity Groups
  7. Troubleshooting 802.1X and MAB

6.4 Configure network access with CoA

7 concepts · 22 questions
  1. CoA fundamentals
  2. CoA message types
  3. CoA with RADIUS
  4. CoA use cases
  5. CoA configuration on Cisco ISE
  6. CoA configuration on network devices
  7. CoA troubleshooting

6.5 Explain exfiltration techniques such as DNS tunneling, HTTPS, email, FTP/SSH/SCP/SFTP, ICMP, Messenger, IRC, NTP, and cloud storage

9 concepts · 35 questions
  1. DNS tunneling
  2. HTTPS exfiltration
  3. Email exfiltration
  4. FTP/SSH/SCP/SFTP exfiltration
  5. ICMP exfiltration
  6. Messenger exfiltration
  7. IRC exfiltration
  8. NTP exfiltration
  9. Cloud storage exfiltration

6.6 Describe network visibility and enforcement using telemetry and native AI/ML capabilities with XDR and SIEM/SOAR platforms such as Splunk and Cisco XDR

7 concepts · 31 questions
  1. Telemetry Fundamentals
  2. Native AI/ML Capabilities
  3. XDR Overview
  4. SIEM and SOAR Platforms
  5. Splunk Integration
  6. Cisco XDR Integration
  7. Enforcement Mechanisms

6.7 Describe Cisco Duo in a zero-trust security architecture (Trust Monitor, MFA, Device Trust, health checks, Adaptive Access policies, SSO, and CII)

8 concepts · 29 questions
  1. Cisco Duo Overview in Zero Trust
  2. Trust Monitor
  3. Multi-Factor Authentication (MFA)
  4. Device Trust
  5. Health Checks
  6. Adaptive Access Policies
  7. Single Sign-On (SSO)
  8. Critical Infrastructure Integration (CII)

6.8 Describe managing, orchestrating, and automating security information and events with Splunk

8 concepts · 28 questions
  1. Splunk architecture and components
  2. Data ingestion and parsing
  3. Search and investigation
  4. Dashboards and visualizations
  5. Alerts and correlation
  6. Automation and orchestration
  7. Management and administration
  8. Security information and event management (SIEM) use cases
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Practice Free Questions

Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for 350-701, so none is invented.