View Full Cisco CCNP Security 300-745 Exam Dumps and Practice Test Dumps.

Q321. An enterprise wants network authorization policies to follow users and devices independently of their IP addresses or physical VLANs. Which Cisco-oriented design concept best supports this requirement?

1. Static extended ACLs based only on subnet
   2. One VLAN for every individual employee
   3. Unrestricted routing between business units
   4. Security Group Tags used for identity-based segmentation

Correct Answer: 4. Security Group Tags used for identity-based segmentation

Explanation: Security Group Tags, or SGTs, allow access policy to be based on logical security groups rather than relying entirely on IP addresses and physical network location. Users, devices, or workloads can be classified according to their role, and policy can then determine which security groups may communicate. This supports scalable segmentation when users move between access switches, wireless networks, or other locations. Traditional subnet ACLs can still be useful, but they become difficult to maintain when identity and location frequently change. Identity-based segmentation therefore provides more flexible policy enforcement across dynamic enterprise environments.

Q322. A network architect must encrypt IP traffic between gateways and wants only the original IP payload protected while keeping the original IP header visible. Which IPsec mode should be selected?

1. Transport mode
   2. Tunnel mode
   3. GRE mode
   4. MPLS mode

Correct Answer: 1. Transport mode

Explanation: IPsec transport mode protects the payload of the original IP packet while retaining the original IP header for routing. It is commonly associated with host-to-host protection or scenarios where additional tunneling already provides the outer packet structure. IPsec tunnel mode instead encapsulates and protects the entire original IP packet inside a new outer IP packet and is widely used for site-to-site VPN gateways. GRE and MPLS are not IPsec operating modes. Architects should choose the mode based on topology, endpoint capabilities, routing requirements, and whether the original packet header itself needs to be hidden.

Q323. A company wants a modern key-exchange protocol for an IPsec VPN that provides stronger negotiation efficiency and better support for mobility than older approaches. Which protocol is most appropriate?

1. Telnet
   2. PPTP
   3. IKEv2
   4. TFTP

Correct Answer: 3. IKEv2

Explanation: Internet Key Exchange version 2, or IKEv2, negotiates security associations and cryptographic parameters for IPsec. Compared with older IKE designs, it simplifies negotiation and supports capabilities useful for modern VPN deployments, including improved resilience and mobility-related scenarios. Strong cipher suites, certificate or credential authentication, and appropriate lifetime settings should still be selected according to security policy. Telnet and TFTP are insecure management or file-transfer protocols, while PPTP is an obsolete VPN technology with significant security limitations. IKEv2 is therefore the preferred modern choice among the listed options.

Q324. An organization is concerned that employees are using unsanctioned cloud applications that have not undergone security review. Which capability best helps identify this shadow IT usage?

1. Spanning Tree Protocol
   2. CASB or SSE cloud application discovery
   3. GRE keepalives
   4. BGP local preference

Correct Answer: 2. CASB or SSE cloud application discovery

Explanation: CASB and broader SSE platforms can analyze user web and cloud activity to identify SaaS applications being accessed across the organization, including unsanctioned services. Security teams can assess discovered applications according to risk, data handling, compliance, and business need before deciding whether to sanction, restrict, or block them. This visibility is particularly important because departments can adopt cloud services without involving security teams. Spanning tree, GRE, and BGP settings provide network infrastructure functionality and do not classify SaaS usage. Cloud application discovery supports governance of shadow IT and associated data-loss risks.

Q325. A company wants to reduce ransomware infections delivered through malicious email attachments. Which email-security architecture provides the strongest layered defense?

1. Attachment scanning, sandboxing, reputation analysis, and phishing controls
   2. Permit all attachments because the endpoint has antivirus
   3. Disable sender authentication
   4. Allow executable attachments from unknown senders

Correct Answer: 1. Attachment scanning, sandboxing, reputation analysis, and phishing controls

Explanation: Email remains a common ransomware delivery mechanism, so layered controls are preferable to one detection technique. Reputation services can evaluate senders and URLs, attachment scanning can identify known threats, and sandboxing can analyze suspicious files behaviorally. Phishing detection, sender authentication, URL protection, and endpoint controls provide additional defenses when a malicious message bypasses one layer. Relying solely on endpoint antivirus leaves unnecessary exposure. Disabling sender authentication or broadly allowing executable attachments makes email security weaker. Defense in depth provides more opportunities to detect and stop malicious content before execution.

Q326. A web application loads a JavaScript library from a public content delivery network. The architect wants browsers to detect if the downloaded library is unexpectedly modified. Which browser security mechanism is most suitable?

1. DHCP snooping
   2. NAT traversal
   3. Subresource Integrity
   4. BGP authentication

Correct Answer: 3. Subresource Integrity

Explanation: Subresource Integrity, or SRI, allows a web page to specify a cryptographic hash for an externally loaded resource such as a JavaScript or CSS file. The browser calculates the hash of the downloaded content and refuses to use it if the value does not match the expected hash. This helps reduce risk if a third-party CDN or hosted library is modified unexpectedly. SRI does not replace CSP, dependency management, or trusted software sourcing, but it provides useful client-side integrity verification. DHCP, NAT, and BGP features do not validate web resource contents.

Q327. A Java application accepts serialized objects from an untrusted network source. Which architectural change best reduces insecure deserialization risk?

1. Accept every object type automatically
   2. Run the application as root
   3. Disable application logging
   4. Avoid native object deserialization of untrusted input and use constrained data formats with validation

Correct Answer: 4. Avoid native object deserialization of untrusted input and use constrained data formats with validation

Explanation: Insecure deserialization can allow attacker-controlled objects to trigger unexpected code paths or dangerous object construction. A safer architecture avoids deserializing arbitrary native objects supplied by untrusted clients. Instead, applications can use simple constrained data representations with explicit schemas and validation, then map approved fields into internal objects. Where deserialization is unavoidable, type allowlists, hardened libraries, and least privilege can reduce exposure. Running with elevated privileges makes exploitation more damaging, while disabling logging removes evidence. Treating serialized data as trusted can create serious remote-code-execution risk.

Q328. An API supports financial transfers. Which control best prevents a user who is authorized to view an account from automatically being authorized to transfer money from it?

1. Hide the transfer button in the client application
   2. Enforce function-level authorization separately for the transfer operation
   3. Rely on the account identifier being difficult to guess
   4. Increase the API timeout

Correct Answer: 2. Enforce function-level authorization separately for the transfer operation

Explanation: Authorization should be checked for each sensitive operation, not inferred simply because a user has access to a related object. A user might legitimately view an account balance but lack permission to initiate transfers. Server-side function-level authorization should evaluate the authenticated identity, account relationship, role, transaction policy, and potentially additional controls such as step-up authentication. Hiding a client-side button does not prevent direct API calls. Difficult-to-guess identifiers are also not authorization controls. Fine-grained server-side authorization prevents privilege escalation through sensitive API functions.

Q329. A security team wants to detect when a cloud administrator makes an unusual privilege change that deviates significantly from their normal activity. Which analytical capability is most useful?

1. Static subnetting
   2. VLAN pruning
   3. User and Entity Behavior Analytics
   4. GRE encapsulation

Correct Answer: 3. User and Entity Behavior Analytics

Explanation: User and Entity Behavior Analytics, or UEBA, develops behavioral context around users, service accounts, hosts, and other entities and identifies deviations that may indicate compromise or abuse. An unusual privilege grant by an administrator can be compared with historical activity, normal change windows, device context, peer behavior, and other signals. UEBA is useful when individual actions are technically valid but suspicious in context. Static network configuration does not provide this behavioral interpretation. UEBA should complement deterministic detections and human analysis rather than serve as the sole basis for disruptive response actions.

Q330. A SOC wants an investigation platform to automatically group multiple related alerts from the same attack into one case. What is the principal benefit?

1. Increase the number of duplicate alerts
   2. Disable analyst context
   3. Eliminate the need for telemetry
   4. Reduce alert fragmentation and improve incident context

Correct Answer: 4. Reduce alert fragmentation and improve incident context

Explanation: One attack can generate alerts from identity, endpoint, firewall, email, and cloud systems. Correlating related alerts into a single incident helps analysts understand the broader attack sequence rather than investigating every alert independently. This can reduce duplicate work, reveal relationships, and improve prioritization. Correlation should preserve underlying evidence so analysts can still inspect individual detections. It does not eliminate the need for quality telemetry. Effective incident grouping is a key SOC capability because attackers commonly cross multiple security domains during a single intrusion.

Q331. An organization measures how long it takes from incident detection until the affected system is isolated from the network. Which operational metric is most directly being evaluated?

1. Mean Time to Contain
   2. Recovery Point Objective
   3. CVSS base score
   4. Annualized Loss Expectancy

Correct Answer: 1. Mean Time to Contain

Explanation: Mean Time to Contain measures how quickly an organization limits an incident after it has been identified, for example by isolating endpoints, disabling compromised accounts, blocking malicious infrastructure, or segmenting affected systems. Lower containment time can reduce attacker dwell time and limit lateral movement or data loss. MTTD measures detection speed, while recovery metrics focus on restoring service. CVSS evaluates vulnerability severity, and ALE estimates financial risk. Tracking containment speed helps SOC and incident-response teams assess whether alerts translate into timely defensive action.

Q332. A security architecture team uses the NIST Cybersecurity Framework to organize security outcomes. Which function is most closely associated with understanding organizational assets, risks, and vulnerabilities?

1. Recover
   2. Identify
   3. Respond
   4. Contain

Correct Answer: 2. Identify

Explanation: The Identify function of the NIST Cybersecurity Framework focuses on understanding the organization’s environment, assets, business context, governance, and cybersecurity risk. Activities such as asset management and risk assessment support informed decisions about how protection, detection, response, and recovery should be designed. The framework organizes security outcomes rather than prescribing a specific product architecture. Recover addresses restoration and improvement after incidents, while Respond focuses on actions taken after detection. Understanding the environment and risk is essential because security controls should be derived from what the organization needs to protect.

Q333. Which framework is commonly used to establish an information security management system based on risk management and continual improvement?

1. ARP
   2. OSPF
   3. DHCP
   4. ISO/IEC 27001

Correct Answer: 4. ISO/IEC 27001

Explanation: ISO/IEC 27001 defines requirements for establishing, implementing, maintaining, and continually improving an information security management system, or ISMS. The standard uses a risk-based approach and helps organizations govern information security systematically rather than treating security as a set of isolated technical controls. Certification can provide external assurance that an organization operates an ISMS conforming to the standard’s requirements. ARP, OSPF, and DHCP are networking protocols rather than information-security management frameworks. Security architects may need to align technical designs with controls and governance requirements established through an organization’s ISMS.

Q334. A proposed security control costs $500,000 annually but is expected to reduce only $20,000 of annualized risk. What should the risk decision process do?

1. Automatically implement it because every security control is beneficial
   2. Ignore risk analysis entirely
   3. Evaluate whether a less costly treatment better aligns with business risk and requirements
   4. Disable all existing controls

Correct Answer: 1. Evaluate whether a less costly treatment better aligns with business risk and requirements

Explanation: Security controls should be evaluated in relation to business risk, mandatory requirements, and the expected reduction in exposure. If a control costs far more than the risk it reduces, decision-makers should consider whether other treatment options provide better value, unless legal, safety, contractual, or strategic requirements mandate the control. Quantitative analysis is not the only factor, but it provides useful context. Security architecture is ultimately a risk-management discipline rather than an objective of maximizing security spending. Alternative mitigation, transfer, acceptance, or avoidance may be more appropriate.

Q335. An organization accepts a temporary exception to a security standard. Which governance practice is most important?

1. Make the exception permanent automatically
   2. Document the owner, justification, expiration date, and compensating controls
   3. Hide the exception from auditors
   4. Remove all monitoring from the affected system

Correct Answer: 2. Document the owner, justification, expiration date, and compensating controls

Explanation: Security exceptions should be formally governed so temporary business needs do not become undocumented permanent weaknesses. The exception should state what requirement is being waived, why it is necessary, who owns the associated risk, what compensating controls reduce exposure, and when the exception expires or must be reviewed. Monitoring should remain in place and may need to be strengthened. An explicit expiration date helps ensure the issue returns for review. Transparent exception management supports accountability, auditability, and informed risk acceptance.

Q336. A company wants its infrastructure templates to be continuously checked against security standards before and after deployment. Which DevSecOps design is best?

1. Manual annual inspection only
   2. No configuration validation
   3. Policy as code integrated with CI/CD and continuous compliance checks
   4. Administrator memory as the primary enforcement mechanism

Correct Answer: 3. Policy as code integrated with CI/CD and continuous compliance checks

Explanation: Policy as code turns security and compliance requirements into machine-evaluable rules. CI/CD pipelines can evaluate Infrastructure as Code before deployment, while continuous compliance checks can evaluate the resulting live environment for drift or noncompliance afterward. This provides both preventive and detective controls. Manual annual checks occur too infrequently for fast-changing cloud environments, and relying on administrator memory is inconsistent. Policy as code also creates versioned, reviewable, and testable security rules that can be improved alongside infrastructure automation.

Q337. A CI pipeline executes third-party build tools. Which isolation strategy best limits damage if one build tool is malicious?

1. Use isolated, ephemeral build environments with minimal permissions
   2. Run every build tool on the production database server
   3. Give build tools domain administrator privileges
   4. Disable network controls around build workers

Correct Answer: 1. Use isolated, ephemeral build environments with minimal permissions

Explanation: Ephemeral build environments reduce persistence because each build runs in a fresh environment that is destroyed afterward. Isolation limits access to other builds and internal systems, while least-privilege identities restrict what a compromised build process can do. Network egress can also be constrained to required repositories and services. Running third-party tooling on production servers or granting broad privileges creates a direct supply-chain attack path. Build infrastructure should be treated as sensitive security infrastructure because compromise can affect every artifact produced by the pipeline.

Q338. An AI security system is offered as a hosted API. The organization is concerned that an attacker could copy the model’s functionality by sending large numbers of carefully selected queries. Which AI threat does this describe?

1. VLAN hopping
   2. DHCP exhaustion
   3. Model extraction or model stealing
   4. ARP poisoning

Correct Answer: 4. Model extraction or model stealing

Explanation: Model extraction attacks use repeated queries and observed outputs to approximate or reproduce the behavior of a proprietary machine-learning model. This can threaten intellectual property and may also help attackers study the model for later evasion. Defenses can include authentication, rate limits, query monitoring, output minimization, watermarking where appropriate, and behavioral detection of suspicious query patterns. Traditional network attacks such as ARP poisoning or DHCP exhaustion do not describe the theft of model functionality. Hosted AI services should consider model confidentiality alongside ordinary API security.

Q339. A generative AI service processes confidential SOC incidents. Which control is most important for protecting prompts and responses from unnecessary retention by external providers?

1. Review provider data-retention and training policies and use enterprise privacy controls
   2. Assume all public AI services discard information automatically
   3. Submit credentials to improve response quality
   4. Disable contractual review

Correct Answer: 1. Review provider data-retention and training policies and use enterprise privacy controls

Explanation: Before sensitive incident information is submitted to an external AI provider, the organization should understand how prompts and responses are stored, retained, accessed, processed, and potentially used for service improvement or model training. Enterprise agreements and privacy controls may provide different behavior from public consumer services. Data minimization and redaction can further reduce exposure. Assuming that information is automatically deleted is unsafe. Credentials and secrets should not be provided merely for additional context. Third-party AI services should undergo security, privacy, contractual, and compliance review like other sensitive SaaS providers.

Q340. An organization wants to evaluate whether a generative AI system can be manipulated through prompt injection before allowing production use. Which activity is most appropriate?

1. Disable security testing
   2. Assume vendor testing is sufficient for every use case
   3. Perform AI-focused adversarial testing and red-team exercises
   4. Give the model production administrator rights first

Correct Answer: 3. Perform AI-focused adversarial testing and red-team exercises

Explanation: AI red teaming deliberately tests how a model and its surrounding application behave under adversarial prompts, indirect prompt injection, data-exfiltration attempts, tool misuse, and other abuse scenarios. Testing should include the complete AI system, not just the base model, because retrieval systems, plugins, tools, and authorization boundaries can create additional attack paths. Findings can guide guardrails, access controls, prompt separation, output validation, and human approval requirements. Vendor evaluation is useful but cannot cover every organization’s data sources, workflows, and permissions. Production deployment should follow risk-based adversarial validation.