View Full Cisco CCNP Security 300-745 Exam Dumps and Practice Test Dumps.

Q121. An enterprise wants cryptographic authentication and encryption for SNMP-based monitoring of network devices. Which version should the security architect require?

1. SNMPv1 with community strings
   2. SNMPv2c with a public community
   3. SNMPv2 without authentication
   4. SNMPv3 with authentication and privacy

Correct Answer: 4. SNMPv3 with authentication and privacy

Explanation: SNMPv3 provides stronger security than earlier SNMP versions by supporting authentication and encryption, referred to as privacy. Authentication helps verify the identity of the management system and protects message integrity, while privacy encrypts management traffic so sensitive information is not exposed in transit. SNMPv1 and SNMPv2c rely primarily on community strings, which provide much weaker security and can be exposed if traffic is intercepted. A secure infrastructure design should also restrict SNMP access to approved management systems, use dedicated management networks where possible, and log administrative monitoring activity.

Q122. A company requires certificate-based authentication for corporate laptops connecting to wired access switches. Which design is most appropriate?

1. 802.1X using EAP-TLS
   2. Open switch ports with MAC learning only
   3. Shared local switch passwords
   4. GRE authentication

Correct Answer: 1. 802.1X using EAP-TLS

Explanation: IEEE 802.1X provides port-based network access control, while EAP-TLS uses client and server certificates to perform strong mutual authentication. This design allows the organization to verify that a connecting laptop possesses a trusted certificate before granting normal network access. It avoids depending only on reusable passwords or easily spoofed MAC addresses. A deployment can also integrate identity and device posture information to assign appropriate authorization policies dynamically. Open switch ports provide little admission control, while GRE is a tunneling technology rather than an endpoint authentication mechanism. Certificate lifecycle management is essential for a successful EAP-TLS design.

Q123. A security architect wants routers to reject BGP routes whose originating autonomous system is not authorized to advertise a prefix. Which technology best supports this objective?

1. DHCP snooping
   2. NAT
   3. RPKI Route Origin Validation
   4. MACsec

Correct Answer: 3. RPKI Route Origin Validation

Explanation: Resource Public Key Infrastructure, or RPKI, allows prefix holders to create cryptographically verifiable Route Origin Authorizations that identify which autonomous systems are permitted to originate particular IP prefixes. Routers performing Route Origin Validation can classify received BGP routes as valid, invalid, or not found and apply routing policy accordingly. This helps mitigate certain route-origin hijacking scenarios. It does not protect against every possible BGP attack, so additional route filtering and control-plane safeguards remain important. DHCP snooping, NAT, and MACsec solve different problems and do not validate whether a BGP origin AS is authorized.

Q124. A large enterprise needs overlapping IP address spaces in separate business units while keeping their routing tables isolated on shared routers. Which technology best meets this requirement?

1. One global routing table
   2. VRF instances
   3. Port mirroring
   4. DNS round robin

Correct Answer: 2. VRF instances

Explanation: Virtual Routing and Forwarding, or VRF, creates separate logical routing tables on the same physical network device. This allows different business units, tenants, or security zones to use overlapping address spaces while maintaining routing separation. Traffic does not automatically move between VRFs; explicit route leaking or controlled security policy is required when communication is necessary. This makes VRFs useful as one layer of segmentation, though firewall enforcement may still be required for application-level security. A single routing table cannot safely accommodate overlapping addresses, while port mirroring and DNS round robin do not provide routing isolation.

Q125. An organization needs visibility and policy control over employees uploading sensitive information to sanctioned and unsanctioned SaaS applications. Which security capability is most appropriate?

1. DHCP relay
   2. GRE
   3. BGP authentication
   4. Cloud Access Security Broker

Correct Answer: 4. Cloud Access Security Broker

Explanation: A Cloud Access Security Broker, or CASB, provides visibility and policy enforcement for the use of cloud applications. Depending on the deployment model, it can identify sanctioned and unsanctioned SaaS use, enforce data-protection policies, detect risky behavior, and integrate with DLP and identity controls. This is especially valuable when sensitive information may leave the organization through cloud collaboration or storage services. DHCP relay, GRE, and BGP authentication provide networking functions and cannot enforce SaaS-specific data policies. CASB capabilities are often integrated into broader SSE or SASE architectures for consistent cloud-access security.

Q126. An API allows users to read their own records, but a client application should not receive permission to modify them. Which OAuth design principle best applies?

1. Issue an unrestricted administrator token
   2. Grant only a read-specific OAuth scope
   3. Share one token among all users
   4. Remove token expiration

Correct Answer: 2. Grant only a read-specific OAuth scope

Explanation: OAuth scopes allow an authorization server to limit what an access token permits a client application to do. If the application only needs read access, the token should contain a read-specific scope rather than broad write or administrator privileges. This follows least privilege and limits the damage if the access token is compromised. Tokens should also have appropriate expiration and audience restrictions. Sharing tokens removes identity separation and makes revocation difficult, while unlimited token lifetimes increase exposure. Well-designed scopes help APIs enforce authorization according to the actual function required by each client.

Q127. A development team wants a security control that operates inside a running application and can detect or block malicious behavior using application context. Which technology best fits?

1. Runtime Application Self-Protection
   2. DHCP snooping
   3. MPLS VPN
   4. Port security

Correct Answer: 1. Runtime Application Self-Protection

Explanation: Runtime Application Self-Protection, or RASP, operates within or alongside an application at runtime and uses application context to identify potentially malicious behavior. Because it understands execution flow and application operations, it can sometimes detect and block attacks that would be difficult to identify using network context alone. RASP complements secure coding, SAST, DAST, WAFs, and other application security controls rather than replacing them. DHCP snooping and port security protect network access layers, while MPLS provides WAN connectivity. RASP is specifically focused on protecting an application while it is executing.

Q128. A security team wants an inventory of third-party components and versions included in a software release so that newly disclosed vulnerabilities can be quickly mapped to affected applications. What should the pipeline produce?

1. Routing table
   2. Firewall session table
   3. Software Bill of Materials
   4. DHCP binding database

Correct Answer: 3. Software Bill of Materials

Explanation: A Software Bill of Materials, or SBOM, provides an inventory of software components, libraries, and dependencies included in an application or software artifact. When a vulnerability is disclosed in a third-party component, the organization can use the SBOM to identify which applications contain the affected version and prioritize remediation. SBOMs also support supply-chain transparency and can complement software composition analysis. The inventory should be generated and maintained as part of the build lifecycle. Routing, firewall session, and DHCP tables describe network state rather than software component provenance.

Q129. A container platform must prevent workloads from being deployed when their images are not signed by the organization’s approved build service. Which control should enforce this requirement?

1. DNS filtering
   2. Admission control policy that verifies image signatures
   3. Static route filtering
   4. Browser isolation

Correct Answer: 2. Admission control policy that verifies image signatures

Explanation: Container admission controls evaluate deployment requests before workloads are allowed to run. An admission policy can require a valid cryptographic signature from an approved build identity and reject images that are unsigned or signed by an unauthorized source. This creates an enforcement point between the software supply chain and the runtime environment. It helps prevent developers or attackers from deploying untrusted images even if they can access a container registry. DNS filtering, routing policy, and browser isolation do not validate software artifact provenance. Signature verification should be combined with vulnerability scanning and trusted registry controls.

Q130. A security architect wants to reduce damage if a serverless function receives a malicious event payload from a message queue. Which design provides the strongest protection?

1. Trust every event automatically
   2. Run the function with cloud administrator permissions
   3. Disable input logging
   4. Validate event schemas and apply least-privilege execution permissions

Correct Answer: 4. Validate event schemas and apply least-privilege execution permissions

Explanation: Serverless functions often process events from queues, APIs, storage services, or other sources. Those events should be treated as untrusted input and validated against expected schemas, formats, sizes, and values before being used. The function should also operate with only the cloud permissions necessary for its specific task. If malicious input causes unexpected execution behavior, least privilege limits the resulting blast radius. Administrator permissions greatly increase impact, while disabling logging makes investigation harder. Input validation and constrained workload identity provide complementary protections against malicious or malformed event data.

Q131. During an investigation, a security team collects a disk image that may later be used as legal evidence. Which practice is most important to demonstrate that the evidence was not altered?

1. Maintain chain of custody and cryptographic hashes
   2. Allow anyone to modify the evidence copy
   3. Store the image without timestamps
   4. Disable documentation

Correct Answer: 1. Maintain chain of custody and cryptographic hashes

Explanation: Chain of custody documents who collected, transferred, accessed, and stored evidence throughout an investigation. Cryptographic hashes can be calculated when evidence is acquired and verified later to demonstrate that the data has not changed. Together, these practices support evidence integrity and defensibility. Access should be restricted and documented, and investigators normally work from validated copies rather than unnecessarily modifying originals. Allowing uncontrolled changes or failing to record evidence handling weakens confidence in investigative conclusions. Although exact legal requirements differ by jurisdiction, integrity and traceability are fundamental principles of sound forensic evidence handling.

Q132. A company wants to determine how quickly a critical application must be restored after an outage. Which business continuity metric defines this maximum acceptable restoration time?

1. CVSS
   2. RPO
   3. RTO
   4. MTTD

Correct Answer: 3. RTO

Explanation: Recovery Time Objective, or RTO, defines the target maximum duration that a business service can remain unavailable after a disruption before it must be restored. Security architects use the RTO to design redundancy, disaster recovery, backup, failover, and operational procedures that meet business availability requirements. Recovery Point Objective, or RPO, instead addresses how much data loss can be tolerated, usually expressed as a period of time. CVSS measures vulnerability severity, while MTTD measures detection speed. Understanding RTO and RPO is essential when converting business continuity requirements into technical architecture.

Q133. A database can lose no more than 15 minutes of transactions after a disaster. Which requirement is being defined?

1. RTO
   2. MTTD
   3. MTTR
   4. RPO

Correct Answer: 2. RPO

Explanation: Recovery Point Objective, or RPO, defines the maximum acceptable amount of data loss measured in time. If the business can tolerate losing no more than 15 minutes of transactions, the data protection architecture must provide replication, snapshots, backups, or journaling frequent enough to achieve an RPO of 15 minutes or better. RTO instead defines how quickly the service itself must be restored after an outage. Mean Time to Detect and Mean Time to Respond are security operations metrics. RPO therefore directly influences backup frequency and replication design for business-critical information.

Q134. A security manager wants to compare vulnerabilities based on standardized technical severity factors such as exploitability and impact. Which scoring system is most appropriate?

1. RTO
   2. CVSS
   3. DHCP option codes
   4. BGP local preference

Correct Answer: 3. CVSS

Explanation: The Common Vulnerability Scoring System, or CVSS, provides a standardized framework for expressing technical vulnerability severity. It considers characteristics such as attack vector, complexity, required privileges, user interaction, and impact to confidentiality, integrity, and availability. CVSS helps organizations communicate and compare technical severity consistently, but it should not be treated as a complete measure of business risk. Asset value, exposure, exploit activity, and compensating controls must also be considered. RTO is a continuity metric, while DHCP and BGP settings are networking concepts unrelated to vulnerability severity scoring.

Q135. After a major security incident, the organization wants to evaluate whether roles, communication procedures, and technical recovery processes worked as expected. Which activity is most appropriate?

1. Disable all incident records
   2. Immediately forget the incident
   3. Remove response documentation
   4. Conduct a lessons-learned or post-incident review

Correct Answer: 1. Conduct a lessons-learned or post-incident review

Explanation: A post-incident or lessons-learned review examines what happened, how the organization responded, which controls worked, where delays occurred, and what architectural or process improvements are needed. The review should include relevant technical teams, SOC personnel, business stakeholders, and other participants as appropriate. Findings can drive changes to playbooks, detection rules, segmentation, backup procedures, staffing, or training. Preserving incident records is important because the review depends on reliable evidence. The objective is not to assign blame but to improve resilience and reduce the likelihood or impact of a similar future incident.

Q136. Which exercise allows executives and technical teams to discuss how they would respond to a simulated cyberattack without disrupting production systems?

1. Production destructive test
   2. Tabletop exercise
   3. Disabling all controls
   4. Unannounced deletion of backups

Correct Answer: 4. Tabletop exercise

Explanation: A tabletop exercise presents participants with a simulated security incident and asks them to discuss decisions, responsibilities, communications, escalation, legal considerations, and recovery actions. Because the exercise is discussion-based, it can evaluate plans and coordination without directly affecting production services. Tabletop scenarios can reveal unclear ownership, missing contact information, unrealistic response assumptions, or gaps between technical and executive expectations. They complement technical exercises and penetration testing rather than replacing them. Deliberately damaging production or deleting backups would create real operational risk and is not an appropriate substitute for structured incident preparedness testing.

Q137. A security automation script modifies firewall objects through an API. What should the design do if one change succeeds but a later dependent change fails?

1. Support transactional behavior or rollback to a known-safe state
   2. Leave the firewall partially configured without reporting it
   3. Delete all firewall rules
   4. Disable API authentication

Correct Answer: 3. Support transactional behavior or rollback to a known-safe state

Explanation: Security automation should handle partial failures safely. If a workflow makes several dependent changes and one later step fails, the system should either use a transaction mechanism or execute rollback logic that returns the environment to a known-safe configuration. Leaving infrastructure partially modified can create outages or security exposure. Workflows should also log each action, validate preconditions, and report failures clearly. Authentication must remain enabled, and broad destructive cleanup is not appropriate. Designing rollback and idempotent operations makes automation more reliable and reduces the operational risk of API-driven security changes.

Q138. An organization manages firewall configuration through Git. What is a major security benefit of using GitOps-style deployment instead of untracked manual changes?

1. It eliminates the need for authentication
   2. It provides versioned, reviewable, auditable configuration history
   3. It prevents every possible configuration error automatically
   4. It makes firewalls unnecessary

Correct Answer: 2. It provides versioned, reviewable, auditable configuration history

Explanation: GitOps-style workflows treat configuration stored in version control as the authoritative desired state. Changes can be reviewed through pull requests, tested automatically, approved, and recorded before deployment. The version history shows who proposed and approved modifications and allows previous known-good states to be identified. This improves auditability and reduces uncontrolled configuration drift. GitOps does not remove authentication or guarantee that every approved change is correct, so automated validation and security review remain important. It also does not replace the firewall itself; it improves how firewall policy is managed and deployed.

Q139. A security team uses machine learning to prioritize alerts. Which measurement should be closely monitored to ensure legitimate attacks are not increasingly missed?

1. False-negative rate
   2. Monitor resolution
   3. Ethernet duplex setting
   4. DNS cache size

Correct Answer: 4. False-negative rate

Explanation: A false negative occurs when malicious activity is incorrectly classified as benign. In security monitoring, an increasing false-negative rate can be especially dangerous because real threats may pass without investigation. Teams should monitor false positives and false negatives, along with model drift, precision, recall, and business impact. Model performance should also be validated against representative and changing attack patterns. Hardware display settings and DNS cache size do not measure the effectiveness of a machine-learning alert-prioritization model. Tracking false negatives helps determine whether the model is silently losing important detection capability.

Q140. An AI assistant can query threat intelligence and SIEM data but should not be able to disable user accounts. Which control most directly enforces this boundary?

1. Ask the AI politely not to disable accounts
   2. Give it domain administrator rights and rely on prompts
   3. Disable SIEM authentication
   4. Use a service identity whose API permissions exclude account-management actions

Correct Answer: 1. Use a service identity whose API permissions exclude account-management actions

Explanation: Authorization boundaries should be enforced by the underlying systems rather than depending only on natural-language instructions to the AI model. If the assistant needs read access to SIEM and threat-intelligence data, its service identity should receive those specific permissions and no authority to disable or modify user accounts. Then prompt injection, hallucination, or operator mistakes cannot directly invoke prohibited identity-management actions through that credential. Strong authentication, API logging, rate controls, and human approval can provide additional safeguards. Technical least privilege is therefore more reliable than asking the model to voluntarily avoid dangerous operations.