Free Cisco 350-701 SCOR practice questions

10 free Cisco 350-701 SCOR practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 703 questions. Work through them, then open each answer to check your reasoning.

Get all 703 questions (US$39) · Download these 10 as a PDF

Question 1

Which functions of an SDN architecture require southbound APIs to enable communication?

  1. SDN controller and the network elements
  2. management console and the SDN controller
  3. management console and the cloud
  4. SDN controller and the cloud
Show answer and explanation

Correct answer: A. SDN controller and the network elements

Southbound APIs in SDN architecture enable communication between the SDN controller and network elements (switches, routers, and other forwarding devices). These APIs allow the controller to program and manage the data plane devices. The management console communicates with the controller via northbound APIs, not southbound APIs, making option B incorrect.

Why the other options are wrong

  • B. Management console uses northbound APIs, not southbound APIs, to communicate with the controller.
  • C. This describes management console to cloud communication, which does not involve southbound APIs.
  • D. SDN controller to cloud communication does not define the purpose of southbound APIs.

Question 2

The main function of northbound APIs in the SDN architecture is to enable communication between which two areas of a network?

  1. SDN controller and the cloud
  2. management console and the SDN controller
  3. management console and the cloud
  4. SDN controller and the management solution ✅Correct Answer: B, management console and the SDN controller Northbound APIs sit above the controller and carry traffic between the management console (the application/management layer) and the SDN controller. The console uses them to request services, push policy intent, and read network state, while the controller programs the devices below it through southbound APIs.
Show answer and explanation

Answer and explanation for question 2

Question 3

What is a feature of the open platform capabilities of Cisco DNA Center?

  1. application adapters
  2. domain integration
  3. intent-based APIs
  4. automation adapters
Show answer and explanation

Correct answer: C. intent-based APIs

Intent-based APIs are a core feature of Cisco DNA Center's open platform capabilities. These APIs allow external systems and applications to programmatically interact with DNA Center using intent-based networking concepts rather than device-level configuration. This enables integration with third-party tools and custom automation.

Why the other options are wrong

  • A. Application adapters are not a standard open platform capability feature of DNA Center.
  • B. Domain integration is not the primary feature of DNA Center's open platform capabilities.
  • D. Automation adapters are not the correct terminology for DNA Center's open platform features.

Question 4

Refer to the exhibit.

What does the API do when connected to a Cisco security appliance?

Exhibit for question 4

  1. create an SNMP pull mechanism for managing AMP
  2. gather network telemetry information from AMP for endpoints
  3. get the process and PID information from the computers in the network
  4. gather the network interface information about the computers AMP sees
Show answer and explanation

Correct answer: D. gather the network interface information about the computers AMP sees

The code demonstrates an API call to a Cisco AMP endpoint that retrieves computer data, then iterates through the response to extract and display network interface information (MAC addresses, IPv4 addresses, and IPv6 addresses) for each computer. The nested loops access computer['network_addresses'] and then retrieve specific network interface properties like 'mac', 'ip', and 'ipv6', which are then printed. This clearly shows the API is gathering network interface information about the computers that AMP sees.

Why the other options are wrong

  • A. The code uses HTTP GET requests with basic authentication, not SNMP, which is a different protocol used for network management.
  • B. The code specifically extracts network interface details (MAC, IP, IPv6) rather than general telemetry information, and does not gather process or performance metrics.
  • C. The code accesses network_addresses and interface properties, not process information or PIDs; the API response structure shown contains network data, not process-level details.

Question 5

Which form of attack is launched using botnets?

  1. TCP flood
  2. DDOS
  3. DOS
  4. virus
Show answer and explanation

Correct answer: B. DDOS

Botnets are used to launch Distributed Denial of Service (DDoS) attacks. A botnet consists of compromised computers that can be coordinated to send traffic toward a target simultaneously, creating a distributed attack. While botnets can be used in various ways, DDoS is the most characteristic attack leveraging botnet infrastructure.

Why the other options are wrong

  • A. TCP flood is a form of DoS attack but is not specifically leveraged by botnets as their primary attack vector.
  • C. DOS (Denial of Service) is singular and refers to attacks from one source, whereas botnets inherently enable distributed attacks.
  • D. Virus distribution is a use of botnets, but the primary attack function leveraging botnets is DDoS.

Question 6

In which form of attack is alternate encoding, such as hexadecimal representation, most often observed?

  1. smurf
  2. distributed denial of service
  3. cross-site scripting
  4. rootkit exploit
Show answer and explanation

Correct answer: C. cross-site scripting

Cross-site scripting (XSS) attacks frequently use alternate encoding methods such as hexadecimal, Unicode, or HTML entity encoding to obfuscate malicious scripts and bypass input filters and security controls. Attackers use these encodings to hide the true nature of the injected code from both automated filters and human reviewers.

Why the other options are wrong

  • A. Smurf attacks use ICMP echo requests and do not typically employ alternate encoding techniques.
  • B. DDoS attacks rely on traffic volume rather than encoding obfuscation techniques.
  • D. Rootkit exploits focus on privilege escalation and system access, not encoding-based evasion.

Question 7

Which flaw does an attacker leverage when exploiting SQL injection vulnerabilities?

  1. user input validation in a web page or web application
  2. Linux and Windows operating systems
  3. database
  4. web page images
Show answer and explanation

Correct answer: A. user input validation in a web page or web application

SQL injection vulnerabilities exist when web applications fail to properly validate and sanitize user input before using it in SQL queries. Attackers exploit this lack of input validation by injecting malicious SQL code through input fields, allowing them to manipulate database queries and access unauthorized data.

Why the other options are wrong

  • B. Operating systems are not the flaw exploited in SQL injection attacks.
  • C. While the database is affected by SQL injection, the vulnerability stems from improper input validation in the application layer, not from a flaw in the database itself.
  • D. Web page images are not related to SQL injection vulnerabilities.

Question 8

What is the difference between deceptive phishing and spear phishing?

  1. Deceptive phishing is an attacked aimed at a specific user in the organization who holds a C-level role.
  2. A spear phishing campaign is aimed at a specific person versus a group of people.
  3. Spear phishing is when the attack is aimed at the C-level executives of an organization.
  4. Deceptive phishing hijacks and manipulates the DNS server of the victim and redirects the user to a false webpage.
Show answer and explanation

Correct answer: B. A spear phishing campaign is aimed at a specific person versus a group of people.

Spear phishing is distinguished by targeting a specific individual or small group of people with personalized attacks, whereas deceptive phishing is a broad campaign sent to large groups of recipients. Spear phishing involves reconnaissance to make the attack more convincing to the target, making it more dangerous and targeted than generic deceptive phishing.

Why the other options are wrong

  • A. Spear phishing targets specific individuals but is not limited to C-level roles; it can target any employee with valuable access or information.
  • C. This describes spear phishing focused on executives but incorrectly limits the definition; spear phishing can target any specific individual.
  • D. This describes DNS hijacking, which is a different attack type entirely, not a characteristic of deceptive phishing.

Question 9

Which two mechanisms are used to control phishing attacks? (Choose two.)

  1. Enable browser alerts for fraudulent websites.
  2. Define security group memberships.
  3. Revoke expired CRL of the websites.
  4. Use antispyware software.
  5. Implement email filtering techniques.
Show answer and explanation

Correct answer: A, E

A. Enable browser alerts for fraudulent websites. E. Implement email filtering techniques. The two most effective mechanisms to control phishing attacks are enabling browser alerts that warn users about fraudulent or suspicious websites, and implementing email filtering techniques that detect and block phishing emails before they reach user inboxes. These preventive measures address phishing at both the email delivery and user interaction levels.

Why the other options are wrong

  • B. Security group memberships control network access permissions, not phishing attacks.
  • C. CRL revocation relates to certificate validity, not phishing email or website detection.
  • D. Antispyware targets spyware and malware, not phishing social engineering attacks.

Question 10

Which attack is commonly associated with C and C++ programming languages?

  1. cross-site scripting
  2. water holing
  3. DDoS
  4. buffer overflow
Show answer and explanation

Correct answer: D. buffer overflow

Buffer overflow attacks are the attack type most commonly associated with C and C++ programming languages. These languages lack built-in bounds checking on memory operations, allowing attackers to write data beyond allocated buffer boundaries, overwriting adjacent memory and potentially executing arbitrary code. This vulnerability is fundamental to the memory management model of C and C++.

Why the other options are wrong

  • A. Cross-site scripting (XSS) is a web application vulnerability, primarily affecting JavaScript and interpreted web languages.
  • B. Water holing attacks target websites frequented by specific user groups; they are not language-specific.
  • C. DDoS attacks are network-based attacks independent of programming language.

That was 10 of 703.

The full Cisco 350-701 SCOR pack has all 703 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack