Practice Test #2

Biometric factor is a legitimate authentication factor category representing something you are, such as a fingerprint or facial scan. However, the question specifically asks for the two most commonly used factors in MFA, and in practice the most common pair is knowledge plus possession, not knowledge plus biometric. Because possession is not offered as an option, selecting biometric reflects the flawed option set rather than the true industry-standard answer. Therefore this option is valid as a factor type but not as one of the two most commonly used factors in the usual MFA context.

Time factor is not a recognized authentication factor category in standard MFA models. Time may be used as an input to generate a one-time password in TOTP systems, but the factor there is possession of the token or authenticator application, not time itself. Time can also be used in access policy decisions such as restricting logins to business hours. It does not independently prove identity as a factor.

Confidentiality factor is not an authentication factor category. Confidentiality is one of the core security objectives in the CIA triad and refers to preventing unauthorized disclosure of information. It is achieved through controls such as encryption, access restrictions, and data classification. None of those make it a factor used to authenticate a user.

Encryption factor is not an authentication factor category. Encryption is a security mechanism used to protect data at rest or in transit and may support authentication protocols, but it is not itself evidence of identity. Authentication factors are based on what a user knows, has, or is. This option confuses a cryptographic control with an identity-verification category.

Accounting is an AAA function (tracking/logging user/device activity) typically handled by RADIUS/TACACS+ infrastructure such as Cisco ISE or AAA servers. Cisco DNA Center can integrate with identity systems and display operational data, but “accounting” is not a primary DNA Center feature pillar in SD-Access. On exams, accounting aligns more with AAA services than with SDN controller capabilities.

Authentication is the process of verifying identity (users/devices/admins) and is typically provided by Cisco ISE (802.1X/MAB with RADIUS) or TACACS+ servers for device administration. While Cisco DNA Center integrates with ISE to apply group-based policy and facilitate SD-Access segmentation, authentication itself is not a primary DNA Center feature category. Exams often separate controller functions from AAA services.

Encryption protects data confidentiality and integrity (e.g., MACsec on links, IPsec tunnels, TLS for management APIs). Cisco DNA Center uses secure channels for management and can help orchestrate configurations, but encryption is not one of its main SDN feature pillars. In SD-Access, the overlay is VXLAN and control-plane uses LISP; these are not synonymous with encryption, and encryption is handled by separate mechanisms.

Pointing clients to on-premises DNS servers is not a routing test. It only confirms where clients send DNS queries first. Unless those DNS servers are configured to forward to Umbrella (or use a Virtual Appliance), traffic may never reach Umbrella. This option is a partial prerequisite in some designs, but it does not validate that Umbrella is actually receiving and enforcing policy for the new identity.

Intelligent Proxy in Umbrella is used to proxy certain web requests for deeper inspection and enforcement (for example, to apply more granular controls beyond DNS-only decisions). Enabling it does not validate that DNS traffic is being routed through Umbrella or that the correct network identity is in use. It’s a policy/enforcement feature, not a primary connectivity/identity verification tool.

Adding the public IP address to a Core Identity is a configuration step that allows Umbrella to map DNS requests to the correct network identity when queries come from that egress IP. However, it does not test routing by itself. You could add the IP and still have clients using a different DNS path, NAT, or resolver, resulting in no Umbrella visibility or incorrect identity attribution.

Incorrect. FlexVPN is explicitly based on IKEv2, but DMVPN is not defined by IKEv2 and has historically been deployed extensively with IKEv1. Although some DMVPN deployments can use IKEv2, that does not make IKEv2 a universal commonality of both technologies. The option is therefore too absolute to be correct. On Cisco exams, wording like 'use IKEv2' usually points to FlexVPN specifically, not DMVPN as a whole.

Incorrect. IS-IS is not a required routing protocol for either DMVPN or FlexVPN. Both technologies can carry multiple routing protocols such as EIGRP, OSPF, BGP, or even static routing depending on the design. Routing protocol choice is independent of the VPN framework itself. Therefore, IS-IS is not a defining shared characteristic.

Incorrect. Both technologies can indeed use similar hashing or integrity algorithms because both rely on IPsec-related cryptographic functions, but this is too generic and not the specific commonality typically tested between DMVPN and FlexVPN. Many unrelated VPN technologies also support the same hashing algorithms, so this does not distinguish a meaningful architectural overlap. Cisco exam questions on this topic usually target the shared NHRP implementation rather than broad crypto support. As a result, D is less precise and not the best answer.

“Development security” is vague and not a recognized defining attribute by itself. DevSecOps is broader than securing development; it integrates security practices across development, operations, and delivery pipelines with automation and shared responsibility. This option lacks the key idea of continuous, pipeline-driven security integration.

An isolated security team is the opposite of DevSecOps. DevSecOps promotes collaboration and shared ownership where developers, operations, and security work together, with security embedded into tooling and processes. Siloed security typically leads to late reviews, slower releases, and weaker feedback loops.

Mandated controls and checklists describe traditional compliance-heavy approaches and can be largely manual and inflexible. While DevSecOps can include required controls, the hallmark is automating and codifying them (policy as code) and integrating them into CI/CD. A checklist-only mindset is not a defining DevSecOps attribute.

Modifying web proxy settings can ensure web traffic is forwarded to an inspection point (proxy) and can improve control coverage. However, proxy configuration alone does not inherently block known malicious websites unless paired with explicit URL/category/reputation policies. The question asks what must be done to prevent users from visiting known malicious sites; that prevention is achieved by enforcement rules, not merely changing proxy settings.

Outbound malware scanning policies focus on detecting and blocking malicious files or payloads leaving the network (exfiltration) or sometimes inspecting downloads. Phishing sites often harvest credentials or redirect users without delivering a detectable malware file, so malware scanning may not stop the initial web visit. This option is more aligned with data loss/exfiltration or file-based malware controls than URL reputation blocking.

Identification profiles (for example, user identity mapping via ISE/AD/agent-based identity) enable user- or group-based policy decisions and better attribution in logs. They are important for visibility and for applying different rules to different users, but they do not directly prevent access to known malicious websites unless used within an access policy rule that blocks those destinations.

A CASB is primarily used to provide visibility and control over the use of cloud applications, especially SaaS services. Its strengths are enforcing security policies, discovering shadow IT, and protecting data in cloud apps rather than serving as a centralized incident-generation platform across many telemetry sources. Although a CASB can raise alerts, it is not the best match for broad event correlation and incident management requirements. The question's emphasis on creating incidents from events and integrating broadly via API points more clearly to SIEM.

Cisco Cloudlock is a CASB offering focused on SaaS security use cases such as user activity monitoring, DLP, and governance for cloud applications. It can identify risky behavior in supported cloud apps, but it is not a general-purpose SIEM designed to aggregate diverse security events and create incidents across the environment. Its scope is narrower and centered on cloud application security rather than centralized security operations. Therefore it does not best satisfy the full set of requirements in the question.

Adaptive MFA is an access control technology that changes authentication requirements based on contextual risk such as device posture, location, or user behavior. Its purpose is to strengthen identity verification, not to collect and correlate security events from multiple systems or generate incidents for analysts. It also is not the primary platform used for broad security monitoring and operational integrations. Because the requirement is about monitoring events and creating incidents, Adaptive MFA is not the correct choice.

terminal enrollment is a manual method where the device generates a CSR and the administrator copies/pastes the request to a CA and then pastes the issued certificate back into the device. While it can be performed in discrete steps, it does not provide an option to specify HTTP/TFTP commands for retrieving files from a server, which is the key requirement in the question.

selfsigned is not a CA enrollment method. It instructs the device to generate its own self-signed identity certificate locally, typically used for temporary testing, bootstrap, or when no external PKI is available. Because there is no external server interaction, it cannot separate CA authentication from enrollment or specify HTTP/TFTP retrieval commands.

profile enrollment uses an enrollment profile (a predefined set of enrollment parameters) to streamline certificate requests. It is aimed at simplifying and standardizing enrollment settings, not at specifying HTTP/TFTP commands for file retrieval. The question’s emphasis on separate authentication/enrollment actions plus HTTP/TFTP retrieval options aligns more directly with enrollment url.

Incorrect. IP fragmentation does not use 16-octet units for the Fragment Offset. The Fragment Offset field in IPv4 is expressed in 8-byte (8 octet) blocks. While fragments may be various sizes based on MTU, the protocol’s offset granularity is 8 bytes, not 16, so this does not characterize Ping of Death behavior.

Incorrect. “Short synchronized bursts of traffic to disrupt TCP connections” describes TCP-focused DoS behaviors (for example SYN floods, RST injection, or bursty volumetric attacks affecting TCP state). Ping of Death is primarily an ICMP/IP fragmentation and reassembly vulnerability exploit, not a TCP connection disruption technique.

Incorrect. Using publicly accessible DNS servers is characteristic of DNS reflection/amplification DDoS attacks, where spoofed requests generate large responses toward a victim. Ping of Death does not rely on third-party reflectors; it relies on oversized ICMP/IP packets and fragmentation/reassembly issues at the target.