View Full Cisco CCNP Security 300-745 Exam Dumps and Practice Test Dumps.

Q141. A company wants to protect IPv6 access networks from hosts advertising themselves as unauthorized routers. Which control is most appropriate?

1. DHCP snooping
   2. IPv6 Router Advertisement Guard
   3. GRE authentication
   4. BGP route reflectors

Correct Answer: 2. IPv6 Router Advertisement Guard

Explanation: IPv6 Router Advertisement Guard, commonly called RA Guard, helps prevent unauthorized devices on access networks from sending malicious IPv6 router advertisements. An attacker could otherwise advertise itself as a default router and redirect user traffic through a malicious system. RA Guard allows switches to distinguish trusted router-facing interfaces from ordinary endpoint ports and block inappropriate advertisements. DHCP snooping addresses rogue DHCP activity rather than IPv6 router advertisements. GRE and BGP route reflection solve unrelated tunneling and routing problems. RA Guard is therefore an important Layer 2 security control when designing protected IPv6 access networks.

Q142. A security architect needs a VPN solution for mobile employees whose public IP addresses frequently change as they move between networks. Which design is most appropriate?

1. A permanent static GRE tunnel from each laptop
   2. MPLS Layer 3 VPN directly to each laptop
   3. MACsec between the laptop and corporate switch
   4. Remote-access VPN using authenticated client sessions

Correct Answer: 4. Remote-access VPN using authenticated client sessions

Explanation: Remote-access VPNs are designed for individual users who connect from variable locations and networks. The client authenticates the user and often the device before establishing an encrypted tunnel to the organization’s VPN gateway. Because the user’s Internet address can change, the architecture does not require a permanent static peer configuration for every endpoint. Static GRE is unsuitable for roaming clients and does not provide encryption by itself. MPLS is generally a provider WAN service rather than an endpoint remote-access solution. MACsec protects specific Ethernet links and does not provide Internet-based mobile VPN access.

Q143. Which security feature best prevents an attacker from successfully using a manually configured IP address to impersonate another host on a switched access network when DHCP snooping data is available?

1. IP Source Guard
   2. DNSSEC
   3. GRE
   4. NAT overload

Correct Answer: 1. IP Source Guard

Explanation: IP Source Guard can use information learned through DHCP snooping to restrict which source IP addresses are permitted on a switch access port. If an endpoint attempts to transmit traffic using an unauthorized source address, the switch can block the traffic. This reduces the effectiveness of simple IP spoofing within the access network. DHCP snooping builds trusted IP-to-MAC-to-port bindings, while IP Source Guard uses that information for enforcement. DNSSEC protects DNS integrity, GRE provides tunneling, and NAT overload translates addresses. IP Source Guard is therefore directly suited to controlling source-address spoofing on access ports.

Q144. An organization wants to protect against an attacker sending forged ARP messages to intercept local subnet traffic. Which switch feature should be used with DHCP snooping?

1. PortFast
   2. Route summarization
   3. Dynamic ARP Inspection
   4. GRE keepalives

Correct Answer: 3. Dynamic ARP Inspection

Explanation: Dynamic ARP Inspection, or DAI, validates ARP messages against trusted bindings, commonly those created by DHCP snooping. It can block forged ARP replies that attempt to associate an attacker’s MAC address with another host’s IP address. This helps defend against ARP poisoning and local man-in-the-middle attacks. Trusted interfaces can be defined for legitimate infrastructure devices where necessary. PortFast affects spanning-tree behavior, route summarization affects routing tables, and GRE keepalives monitor tunnels. DAI specifically addresses malicious or invalid ARP information and is an important Layer 2 access-network protection.

Q145. A company operates critical industrial controllers that cannot be patched without shutting down production. Which architecture most effectively reduces their exposure?

1. Isolate the controllers in restricted network zones with tightly controlled communications
   2. Give every corporate endpoint direct access to the controllers
   3. Expose management interfaces directly to the Internet
   4. Disable monitoring around the controllers

Correct Answer: 1. Isolate the controllers in restricted network zones with tightly controlled communications

Explanation: Legacy or operational-technology systems that cannot be patched require strong compensating controls. Network segmentation can restrict communication to only the systems, protocols, and management stations required for production. Firewalls, industrial security monitoring, jump hosts, application allowlisting, and strict administrative access can further reduce exposure. The goal is to reduce the likelihood that an attacker can reach or exploit the unpatched controller while maintaining required operations. Broad corporate or Internet access dramatically increases risk. Disabling monitoring also removes visibility. Isolation and explicit allow policies are therefore central design controls for difficult-to-patch industrial assets.

Q146. A security architect wants SaaS administrators to receive elevated privileges only after approval and only for a limited period. Which architecture best meets this requirement?

1. Permanent global administrator assignments
   2. Shared privileged accounts
   3. Password-only authentication
   4. Privileged access management with just-in-time elevation

Correct Answer: 4. Privileged access management with just-in-time elevation

Explanation: Just-in-time privileged access grants elevated permissions only when they are needed and can automatically remove those permissions after a defined period. A privileged access management workflow may require approval, stronger authentication, ticket references, session recording, or justification before elevation. This reduces standing privilege and therefore limits the value of a compromised normal user account. Permanent global administrator rights create unnecessary exposure, while shared accounts reduce accountability. Password-only access is also insufficient for high-impact privileges. Temporary, approved elevation provides a stronger balance between operational needs and least-privilege security.

Q147. An application team wants to protect sensitive data stored in a database so that stolen storage media does not expose readable records. Which control directly addresses this requirement?

1. Network address translation
   2. GRE encapsulation
   3. Encryption at rest
   4. DHCP snooping

Correct Answer: 3. Encryption at rest

Explanation: Encryption at rest protects stored information by ensuring that database files, disks, backups, or storage objects cannot be read without the appropriate cryptographic keys. If an attacker steals media or obtains unauthorized access to raw storage, encrypted data remains protected as long as the keys are secured separately and managed correctly. Encryption at rest should complement application authorization, database access controls, backup security, and encryption in transit. NAT, GRE, and DHCP snooping provide networking functions and do not protect stored database contents. Key management is a critical part of the overall encryption-at-rest architecture.

Q148. A microservices application uses a message broker. The architect wants to prevent one compromised service from reading messages intended for unrelated services. Which control is most appropriate?

1. Give every service access to every queue
   2. Apply per-service identities and least-privilege queue authorization
   3. Disable broker authentication
   4. Share one administrative broker credential among all services

Correct Answer: 2. Apply per-service identities and least-privilege queue authorization

Explanation: Each microservice should authenticate using its own workload identity and receive access only to the queues, topics, or message operations required by its role. If one service is compromised, least-privilege authorization limits which messages the attacker can read, publish, or modify. Shared administrative credentials create a large blast radius and make activity difficult to attribute. Disabling authentication would permit unauthorized access entirely. Message brokers are critical trust boundaries in event-driven architectures, so workload identity, encrypted transport, access policy, and audit logging should be designed as carefully as API authorization.

Q149. A web application must prevent users from modifying object identifiers in API requests to access another customer’s records. Which security control is most important?

1. Server-side object-level authorization checks
   2. Client-side JavaScript validation only
   3. Hiding object IDs in the user interface
   4. Increasing DNS TTL values

Correct Answer: 4. Server-side object-level authorization checks

Explanation: Applications must enforce authorization on the server for every requested object. An attacker can modify API requests regardless of what the user interface displays, so hiding identifiers or validating requests only with client-side JavaScript does not provide a reliable security boundary. The server should verify that the authenticated identity is authorized to read, modify, or delete the specific requested record. This protects against broken object-level authorization and insecure direct-object-reference scenarios. DNS behavior is unrelated. Strong server-side authorization should be combined with secure session handling, logging, and careful API design.

Q150. Which technique is most appropriate for protecting passwords stored in an application’s authentication database?

1. Reversible plaintext encryption with a shared key in source code
   2. Plaintext storage
   3. A slow, salted password-hashing algorithm
   4. Base64 encoding

Correct Answer: 1. A slow, salted password-hashing algorithm

Explanation: Password databases should store password verifiers produced by purpose-built, slow password-hashing algorithms with unique salts. Examples include modern adaptive password hashing functions designed to make offline guessing expensive. The salt prevents identical passwords from producing identical stored values and defeats precomputed rainbow tables. Passwords usually do not need to be decrypted, so reversible encryption is generally inappropriate for ordinary authentication storage. Base64 is merely encoding and provides no cryptographic protection. If attackers obtain the password database, strong salted hashes increase the computational cost of recovering users’ original passwords.

Q151. A SOC wants network telemetry that summarizes conversations using source and destination addresses, ports, protocols, byte counts, and timing without storing every packet. Which data source best fits this requirement?

1. Full packet capture only
   2. Endpoint screenshots
   3. Source-code repositories
   4. Network flow records

Correct Answer: 2. Network flow records

Explanation: Network flow telemetry summarizes communication between systems without requiring the storage volume of full packet capture. Flow records can include source and destination addresses, ports, protocol, bytes, packets, timestamps, and interface information. This makes them useful for identifying unusual connections, lateral movement, data-transfer patterns, and network baselines across large environments. Full packet capture provides deeper content visibility but requires substantially more storage and privacy considerations. Endpoint screenshots and source-code repositories do not provide equivalent network-communication metadata. Flow telemetry is therefore an efficient data source for network-oriented SOC analytics.

Q152. An analyst needs the complete payload of a suspicious TCP session to determine whether malware was transferred. Which telemetry provides the greatest detail?

1. DHCP lease logs
   2. DNS cache entries only
   3. Full packet capture
   4. A routing table

Correct Answer: 3. Full packet capture

Explanation: Full packet capture records actual network packets, including payload data when it is visible and not protected by encryption. This gives analysts the greatest network-level detail for reconstructing sessions, inspecting transferred files, analyzing protocol behavior, and validating detections. It requires considerably more storage than flow telemetry and can contain sensitive information, so retention and access policies are important. DHCP and DNS data provide valuable context but not complete session payloads. Routing tables describe forwarding decisions rather than user traffic. Packet capture is therefore most appropriate when deep forensic examination of network content is required.

Q153. During incident response, malware persistence has been removed and compromised credentials have been reset. Which response phase has primarily been performed?

1. Eradication
   2. Identification
   3. Preparation
   4. Risk transfer

Correct Answer: 4. Eradication

Explanation: Eradication focuses on removing the threat and its persistence mechanisms from the environment. Activities may include deleting malware, removing unauthorized accounts, eliminating scheduled tasks or persistence mechanisms, patching exploited vulnerabilities, and resetting compromised credentials. Containment generally comes earlier and limits the attacker’s ability to cause additional damage. Recovery follows eradication and returns systems to normal operation while monitoring for recurrence. Identification determines what happened, while preparation happens before incidents occur. Removing the attacker’s foothold and correcting the root technical mechanisms are key eradication activities.

Q154. Which threat-modeling approach uses diagrams of system components, data stores, external entities, trust boundaries, and information movement to identify security threats?

1. DHCP scope analysis
   2. Data-flow diagram based threat modeling
   3. Ethernet speed testing
   4. DNS round robin

Correct Answer: 2. Data-flow diagram based threat modeling

Explanation: Data-flow diagrams help architects visualize how information moves through a system, where it is stored, which processes handle it, which external entities interact with it, and where trust boundaries exist. Threat-modeling techniques such as STRIDE can then be applied to the diagram’s elements to identify possible spoofing, tampering, information disclosure, denial of service, and privilege-escalation threats. This process is particularly useful during application and architecture design because security weaknesses can be addressed before implementation. DHCP, Ethernet testing, and DNS balancing do not provide a structured representation of application trust and data movement.

Q155. A business decides that a critical system must remain operational even if any single application server fails. Which architectural principle best meets this requirement?

1. High availability through redundancy
   2. One large standalone server
   3. Disable health monitoring
   4. Store all backups on the same server

Correct Answer: 1. High availability through redundancy

Explanation: Redundancy removes single points of failure by providing multiple application instances, load balancers, clustered services, or other failover capabilities. Health monitoring detects failed instances and directs traffic toward healthy resources. The exact design depends on the application’s state, storage model, session behavior, and RTO requirements. One large server remains a single point of failure regardless of its capacity. Disabling monitoring makes failure detection slower, while placing backups on the failed system provides little resilience. High availability uses redundant components and automated failover to maintain service when individual infrastructure elements fail.

Q156. A security architect wants to define a standard, reusable solution for providing secure administrator access through hardened jump hosts. What architectural artifact is most appropriate?

1. Incident ticket
   2. Packet capture
   3. Security design pattern
   4. DHCP reservation

Correct Answer: 3. Security design pattern

Explanation: A security design pattern documents a reusable architectural solution to a recurring security problem. A privileged-access pattern could describe hardened jump hosts, administrative network isolation, MFA, session recording, access approval, logging, and permitted management protocols. Teams can reuse the pattern across projects instead of redesigning the same control each time. Patterns also improve architectural consistency and make reviews easier because approved security principles are captured in a repeatable model. Incident tickets and packet captures document operational events, while DHCP reservations provide network configuration. They are not reusable architectural solutions.

Q157. A CI/CD pipeline needs to test an application for SQL injection and authentication weaknesses after deploying it into a temporary test environment. Which control should be integrated?

1. Dynamic Application Security Testing
   2. Route summarization
   3. DHCP snooping
   4. MACsec

Correct Answer: 2. Dynamic Application Security Testing

Explanation: DAST evaluates a running application from an external perspective, making it appropriate after the application is deployed to a temporary test environment. The scanner can send malicious or unexpected requests to identify issues such as injection flaws, insecure authentication behavior, and server configuration weaknesses. This complements SAST, which analyzes code without executing the application, and SCA, which focuses on third-party dependencies. Integrating DAST into the pipeline provides repeatable pre-production security testing. Routing, DHCP snooping, and MACsec address infrastructure security rather than application vulnerability testing.

Q158. Which API authentication design is preferred for an automated security service that calls another internal service without a human user?

1. Reuse an employee’s personal password
   2. Disable API authentication
   3. Use a dedicated machine identity with scoped credentials
   4. Share the root API key with all automation systems

Correct Answer: 1. Use a dedicated machine identity with scoped credentials

Explanation: Machine-to-machine integrations should use dedicated workload or service identities rather than personal user credentials. Permissions should be scoped to the exact API operations and resources the automation requires. Where possible, short-lived tokens, certificate-based authentication, or workload identity federation should replace long-lived static secrets. This improves attribution, rotation, and incident response. Disabling authentication allows unauthorized access, while one shared root key creates excessive privilege and makes it difficult to identify which service performed an action. Dedicated machine identities therefore provide a stronger foundation for secure automation workflows.

Q159. An AI-based security tool provides a confidence score for whether an event is malicious. What should the architecture do with low-confidence predictions involving high-impact containment actions?

1. Automatically shut down the entire environment
   2. Ignore all predictions permanently
   3. Delete the underlying telemetry
   4. Route the decision for additional validation or human review

Correct Answer: 4. Route the decision for additional validation or human review

Explanation: High-impact actions such as disabling critical accounts, isolating production servers, or blocking major network ranges should not rely blindly on uncertain AI predictions. When confidence is low, the architecture should introduce additional deterministic checks, correlated evidence, or human review before containment occurs. This balances automation speed against the risk of damaging false positives. Telemetry should be retained for investigation, and predictions should not simply be ignored. Confidence-aware response policies are part of responsible AI security design and help ensure that machine-learning recommendations are proportional to both certainty and operational impact.

Q160. Which emerging cryptographic approach is specifically intended to remain secure against attacks from sufficiently capable quantum computers?

1. Post-quantum cryptography
   2. Base64 encoding
   3. Plaintext authentication
   4. CRC checksums

Correct Answer: 3. Post-quantum cryptography

Explanation: Post-quantum cryptography refers to cryptographic algorithms designed to resist attacks from both classical and sufficiently capable quantum computers. Organizations should track standardization, build cryptographic inventories, and improve crypto-agility so vulnerable public-key algorithms can be replaced as required. Migration will take time because certificates, protocols, applications, hardware, vendors, and interoperability all depend on cryptographic choices. Base64 provides encoding rather than security, plaintext authentication exposes credentials, and ordinary checksums do not provide quantum-resistant confidentiality or authentication. PQC is therefore a major architectural consideration for long-lived security systems and sensitive data.