View Full Cisco CCNP Security 300-745 Exam Dumps and Practice Test Dumps.

Q161. An organization is designing protection for a public web service that must remain reachable during large volumetric denial-of-service attacks. Which architecture is most appropriate?

1. Increase the web server’s local disk capacity
   2. Use upstream DDoS detection and traffic-scrubbing services
   3. Disable application logging
   4. Place the server directly on the Internet without filtering

Correct Answer: 2. Use upstream DDoS detection and traffic-scrubbing services

Explanation: Volumetric DDoS attacks can consume far more bandwidth than an organization’s Internet connection or local firewall can handle. Upstream scrubbing services detect malicious traffic and remove it before forwarding legitimate traffic toward the protected application. Because mitigation occurs before the traffic saturates the organization’s own connection, it is more effective against large-scale floods than relying only on controls deployed at the data center edge. Increasing disk capacity has no effect on network exhaustion. Disabling logs reduces visibility, while directly exposing the server increases risk. DDoS design should also include redundancy, monitoring, rate controls, and tested failover procedures.

Q162. A company provides wireless network access to visitors but must ensure guests cannot reach internal employee systems. Which design is most appropriate?

1. Put guests and employees in the same unrestricted VLAN
   2. Give guests domain administrator credentials
   3. Disable firewalling between wireless networks
   4. Place guest users in a separate security zone with Internet-only access

Correct Answer: 4. Place guest users in a separate security zone with Internet-only access

Explanation: Guest devices should be treated as untrusted endpoints and isolated from corporate user, server, and management networks. A separate VLAN, VRF, firewall zone, or equivalent segmentation mechanism can provide Internet access while explicitly denying access to internal resources. Guest authentication or captive portal controls can be added where required. Putting guests on the employee network expands lateral-movement opportunities if a visitor device is compromised. Giving administrative credentials or disabling firewall enforcement would create severe risk. A dedicated guest security zone therefore follows least privilege and reduces exposure of trusted business systems.

Q163. An organization wants recipients to verify that DNS responses for its signed public domain have not been forged or modified. Which technology provides this protection?

1. DNSSEC
   2. GRE
   3. NAT
   4. DHCP relay

Correct Answer: 1. DNSSEC

Explanation: DNS Security Extensions, or DNSSEC, add cryptographic signatures to DNS data so validating resolvers can verify authenticity and integrity. DNSSEC helps protect against forged DNS responses and cache-poisoning attacks by allowing a resolver to confirm that records were signed by the appropriate zone. DNSSEC does not encrypt DNS queries or hide which domains users request; technologies such as encrypted DNS address that separate concern. GRE, NAT, and DHCP relay provide different networking functions. A complete DNS security architecture can combine DNSSEC validation, protective DNS filtering, restricted administration, logging, and secure zone-management procedures.

Q164. A security architect wants suspicious email attachments detonated in an isolated environment before delivery to users. Which control best meets this requirement?

1. DHCP snooping
   2. Port security
   3. Malware sandboxing
   4. Route filtering

Correct Answer: 3. Malware sandboxing

Explanation: Malware sandboxing executes or analyzes suspicious files in an isolated environment to observe behaviors such as process creation, file changes, network connections, persistence attempts, or exploitation activity. Email-security systems can use sandbox verdicts to quarantine malicious attachments before they reach users. This provides an additional layer beyond static signatures because previously unseen malware can be identified by behavior. DHCP snooping, switch port security, and routing filters address network infrastructure threats rather than malicious email attachments. Sandboxing should be combined with sender authentication, URL analysis, anti-phishing controls, endpoint protection, and user awareness.

Q165. A company wants to keep backup copies safe from ransomware that compromises production administrator accounts. Which architecture best reduces the risk?

1. Use isolated, immutable backup copies with separate administrative controls
   2. Store backups only on the same file server as production data
   3. Give every production administrator permanent backup-delete rights
   4. Mount all backups read-write on every workstation

Correct Answer: 1. Use isolated, immutable backup copies with separate administrative controls

Explanation: Ransomware frequently attempts to destroy backups before encrypting production systems. Isolated or immutable backups help prevent attackers from modifying or deleting recovery copies, while separate administrative identities reduce the chance that compromised production credentials can also destroy backups. Organizations should test restoration regularly and consider multiple backup locations or offline copies. Keeping backups on the same production system creates a common failure domain. Broad delete rights and permanently mounted writable backup repositories also make recovery data easier to attack. Backup architecture should therefore provide both recoverability and strong separation from normal production administration.

Q166. A web application displays user-supplied content. Which browser-side security policy can reduce the impact of injected scripts by restricting approved script sources?

1. BGP prefix filtering
   2. DHCP option filtering
   3. Content Security Policy
   4. MACsec

Correct Answer: 3. Content Security Policy

Explanation: Content Security Policy, or CSP, is an HTTP response security mechanism that tells browsers which content sources are allowed for scripts, styles, frames, images, and other resources. A carefully designed CSP can reduce the impact of cross-site scripting by preventing execution of scripts from unauthorized sources or inline contexts. CSP should complement secure output encoding, input handling, framework protections, and other application-security controls rather than substitute for them. BGP, DHCP, and MACsec operate at network layers and do not instruct browsers which application content may execute. CSP is therefore directly relevant to browser-based web security.

Q167. A payment application needs to store customer account identifiers while reducing exposure of the original sensitive values to downstream systems. Which technique is most appropriate?

1. Plaintext duplication
   2. Tokenization
   3. Base64 encoding
   4. Disabling authorization

Correct Answer: 2. Tokenization

Explanation: Tokenization replaces a sensitive value with a non-sensitive surrogate token. Downstream applications can use the token for workflows without necessarily receiving the original data. The mapping between token and sensitive value is protected within a dedicated tokenization system or controlled service. This reduces the amount of sensitive information exposed across application components and can simplify some compliance boundaries. Base64 is only an encoding mechanism and offers no confidentiality. Plaintext duplication increases exposure, while disabling authorization would make the environment less secure. Tokenization is especially useful when systems need a persistent reference without direct access to the protected original value.

Q168. An organization wants cryptographic private keys to be generated and used in hardware designed to resist key extraction. Which solution should be selected?

1. Shared spreadsheet
   2. Plaintext configuration file
   3. Source-code repository
   4. Hardware Security Module

Correct Answer: 4. Hardware Security Module

Explanation: A Hardware Security Module, or HSM, is designed to generate, store, and use cryptographic keys within a protected hardware boundary. Sensitive private keys can remain inside the device while cryptographic operations are performed on behalf of applications. HSMs are commonly used for certificate authorities, code signing, payment systems, high-value encryption keys, and other scenarios where key extraction would create significant risk. Spreadsheets, repositories, and plaintext configuration files lack equivalent tamper resistance and access protection. Key security depends not only on algorithm strength but also on secure generation, storage, rotation, authorization, and auditing.

Q169. A REST API should reject requests containing unexpected fields or invalid data types before application logic processes them. Which design best addresses this requirement?

1. Disable all API authentication
   2. Accept any request body
   3. Enforce API schema validation
   4. Increase DNS cache size

Correct Answer: 3. Enforce API schema validation

Explanation: API schema validation verifies that requests conform to the expected structure, required fields, data types, ranges, and other documented constraints before they reach application logic. This helps reject malformed or unexpected input and can reduce opportunities for application-layer abuse. Schema validation should be paired with authentication, authorization, business-rule checks, rate limiting, and secure error handling because valid syntax does not guarantee an authorized or safe operation. Accepting arbitrary input increases attack surface. DNS configuration is unrelated. Centralized API gateways can sometimes enforce schema validation consistently across multiple services.

Q170. A Kubernetes workload should be prevented from making unnecessary system calls even if the container application is compromised. Which control best reduces this attack surface?

1. Use restrictive seccomp or equivalent runtime syscall policies
   2. Give the container privileged mode
   3. Mount the host filesystem read-write
   4. Disable container isolation

Correct Answer: 1. Use restrictive seccomp or equivalent runtime syscall policies

Explanation: Seccomp and similar runtime controls restrict which operating-system system calls a containerized workload can invoke. By denying unnecessary syscalls, the platform reduces the kernel attack surface available to a compromised process and can limit exploitation techniques that rely on rarely required functionality. This is one layer of container hardening and should be combined with non-root execution, capability reduction, read-only filesystems where practical, workload segmentation, and image security. Privileged containers and writable host filesystem mounts increase risk because they weaken isolation. Runtime restriction supports defense in depth within container platforms.

Q171. A security team needs a standardized format for sharing structured threat indicators such as malicious IP addresses, domains, and attacker behavior between organizations. Which technology is most appropriate?

1. STIX
   2. FTP directory listing
   3. DHCP snooping database
   4. BGP communities

Correct Answer: 4. STIX

Explanation: Structured Threat Information Expression, or STIX, provides a structured language for representing cyber threat intelligence such as indicators, malware, threat actors, relationships, campaigns, and attack patterns. It enables organizations and security tools to exchange threat information in a consistent machine-readable form. TAXII is often used as a transport mechanism for sharing STIX content. FTP, DHCP databases, and BGP communities do not provide a security threat-intelligence data model. Structured threat intelligence supports automation because SIEM, SOAR, threat-intelligence platforms, and other controls can consume standardized indicators and contextual relationships.

Q172. Which protocol is specifically designed to exchange structured cyber threat intelligence between systems over network services?

1. ARP
   2. TAXII
   3. STP
   4. NTP

Correct Answer: 2. TAXII

Explanation: Trusted Automated Exchange of Intelligence Information, or TAXII, defines services for exchanging cyber threat intelligence between systems. TAXII is commonly used with STIX, where STIX represents the threat-intelligence objects and TAXII transports them between producers and consumers. This enables automated sharing among organizations, threat-intelligence platforms, SIEM systems, and security tools. ARP resolves IPv4 addresses to MAC addresses, STP prevents Layer 2 loops, and NTP synchronizes time. TAXII therefore supports automated threat-intelligence distribution rather than ordinary network control or synchronization.

Q173. A company wants to identify which business processes and systems are most critical before defining disaster-recovery priorities. Which activity should be performed?

1. Business Impact Analysis
   2. VLAN pruning
   3. Packet fragmentation testing
   4. DNS recursion tuning

Correct Answer: 1. Business Impact Analysis

Explanation: A Business Impact Analysis, or BIA, identifies critical business processes, dependencies, and the consequences of service disruption. It helps determine priorities for resilience and disaster recovery and provides business input for requirements such as Recovery Time Objective and Recovery Point Objective. Security architects can then design redundancy, backup, recovery, and continuity controls appropriate to the actual business impact. Network optimization tasks do not establish business criticality. Performing the BIA before selecting recovery technology helps ensure expensive resilience investments are focused on services whose loss would have the greatest operational, financial, regulatory, or reputational effect.

Q174. Which risk-analysis methodology is designed to quantify cyber risk in financial terms using factors such as loss-event frequency and loss magnitude?

1. Spanning Tree Protocol
   2. FAIR
   3. DHCP
   4. OSPF

Correct Answer: 4. FAIR

Explanation: Factor Analysis of Information Risk, or FAIR, is a quantitative risk-analysis methodology that models risk using concepts such as loss-event frequency and probable loss magnitude. It aims to express cyber risk in financial terms so organizations can compare security scenarios and make business-oriented decisions about control investment. FAIR is distinct from networking protocols such as STP, DHCP, and OSPF. Quantitative estimates still contain uncertainty and depend on the quality of available information, but structured financial modeling can improve discussions between security practitioners, risk teams, and executives by translating technical exposure into business terms.

Q175. A company subject to European privacy requirements collects personal information from EU residents. Which regulation is most directly relevant?

1. PCI DSS only
   2. SOX only
   3. GDPR
   4. BGPsec

Correct Answer: 3. GDPR

Explanation: The General Data Protection Regulation, or GDPR, establishes requirements involving personal-data processing and privacy rights for covered processing involving individuals in the European Union and European Economic Area. Security architecture can be affected through requirements involving appropriate technical and organizational safeguards, data minimization, privacy by design, breach response, retention, and cross-border data handling. PCI DSS focuses on payment-card data, while SOX concerns financial reporting controls for applicable U.S. public companies. BGPsec is a routing-security technology. Architects must determine applicability based on actual business operations, data subjects, processing purposes, and legal guidance.

Q176. An application team says a cloud provider handles physical data-center security, so the team assumes it has no remaining cloud-security responsibilities. Which concept corrects this misunderstanding?

1. Spanning tree election
   2. Shared responsibility model
   3. GRE tunneling
   4. NAT traversal

Correct Answer: 2. Shared responsibility model

Explanation: Cloud security follows a shared responsibility model. The provider secures specific layers of the underlying cloud platform, while customers remain responsible for areas such as identities, permissions, data, application security, workload configuration, and many service settings. Exact boundaries depend on whether the service is IaaS, PaaS, SaaS, or another managed offering. Assuming the provider handles all security can lead to public storage, excessive permissions, unpatched workloads, or weak data protection. Security architects should explicitly document responsibility boundaries and design controls for everything that remains under customer or shared responsibility.

Q177. An incident-response team confirms an employee endpoint is actively communicating with known command-and-control infrastructure. Which containment action is most appropriate?

1. Network-isolate the endpoint while preserving evidence
   2. Delete every SOC log
   3. Allow the host unrestricted access until the next maintenance window
   4. Disable all enterprise firewalls

Correct Answer: 4. Network-isolate the endpoint while preserving evidence

Explanation: Once active compromise is confirmed, isolating the endpoint can stop command-and-control traffic, lateral movement, and additional data exfiltration while allowing investigators to preserve evidence. Endpoint detection platforms or NAC systems can often quarantine a host while retaining management connectivity for investigation. The exact action should reflect business and safety requirements, especially for critical operational systems. Deleting logs destroys evidence, and delaying containment allows the attacker to continue operating. Broadly disabling firewalls would expand risk across the organization. Containment should be targeted, documented, and coordinated with the incident-response plan.

Q178. A security automation workflow is executed repeatedly against the same firewall configuration. The desired result should remain unchanged after the first successful run. Which automation property is this?

1. Encryption
   2. Idempotency
   3. Obfuscation
   4. Fragmentation

Correct Answer: 2. Idempotency

Explanation: An idempotent automation operation can be executed multiple times without continually changing the system once the desired state has been reached. For example, a workflow that ensures a firewall object exists should create it when missing but should not create duplicate objects every time the automation runs. Idempotency makes infrastructure automation safer, easier to retry after partial failures, and more predictable in declarative workflows. Encryption protects confidentiality, while obfuscation and fragmentation are unrelated concepts. Security automation should strive for idempotent operations wherever possible to reduce configuration drift and unintended repeated actions.

Q179. A DevSecOps pipeline requires access to signing keys during builds. Where should those secrets be stored?

1. Dedicated secrets-management or key-management service
   2. Plaintext pipeline source file
   3. Public repository
   4. Developer chat channel

Correct Answer: 1. Dedicated secrets-management or key-management service

Explanation: Sensitive signing keys should be protected using dedicated key or secret management services with strong access control, auditing, rotation, and preferably hardware-backed protection for high-value use cases. CI/CD jobs should access keys through narrowly scoped identities and avoid exposing raw key material when remote signing APIs or HSM-backed operations are available. Storing keys in source files, public repositories, or chat systems creates unnecessary exposure and makes rotation more difficult. Software-supply-chain security depends heavily on protecting the signing identity because attackers who obtain the signing key may be able to make malicious artifacts appear trusted.

Q180. An enterprise uses retrieval-augmented generation to answer employee questions from internal documents. How should the system prevent one user from retrieving documents they are not authorized to read?

1. Let the AI model decide access based only on the wording of the prompt
   2. Index every document anonymously
   3. Enforce source-document permissions during retrieval
   4. Remove authentication from the document repository

Correct Answer: 3. Enforce source-document permissions during retrieval

Explanation: Retrieval-augmented generation should preserve the authorization controls of the underlying data sources. Before documents or passages are supplied to the model, the retrieval layer should verify that the requesting user is authorized to access them. Otherwise, the AI system can become an unintended path around file, repository, or application permissions. Prompt instructions are not a reliable security boundary because users can manipulate prompts and models can make mistakes. Authentication, identity propagation, access filtering, logging, and data classification should therefore be built into the retrieval architecture rather than delegated to the language model itself.