View Full Cisco CCNP Security 300-745 Exam Dumps and Practice Test Dumps.

Q341. An organization wants to stop unauthorized endpoints from connecting to wired access ports before they receive normal network access. Which design is most appropriate?

1. Static routing
   2. 802.1X network access control
   3. GRE tunneling
   4. DNSSEC

Correct Answer: 2. 802.1X network access control

Explanation: 802.1X provides port-based network access control and allows a switch to require authentication before granting normal network connectivity. The endpoint acts as the supplicant, the access switch functions as the authenticator, and a centralized authentication server evaluates credentials and policy. Certificate-based methods such as EAP-TLS can provide strong device or user authentication. This approach supports dynamic authorization, segmentation, and compliance checks. Static routing and GRE address connectivity rather than network admission, while DNSSEC protects DNS integrity. 802.1X is therefore the appropriate architecture when access ports should authenticate endpoints before allowing corporate network access.

Q342. A company needs an encrypted tunnel between two sites, but the tunnel must transport multicast routing updates in addition to ordinary unicast traffic. Which design best meets the requirement?

1. NAT overload
   2. Plain IPsec transport mode only
   3. Static public routing
   4. GRE protected by IPsec

Correct Answer: 4. GRE protected by IPsec

Explanation: GRE can encapsulate multicast, broadcast, and additional routed protocol traffic that may not fit a simple point-to-point IPsec design. Because GRE does not provide confidentiality on its own, IPsec can be added to secure the GRE packets with encryption, integrity, authentication, and anti-replay protection. This combination is useful when routing protocols or multicast applications must traverse an encrypted site-to-site connection. NAT and ordinary public routing do not provide the required secure multicast-capable overlay. The architect should also consider MTU and fragmentation because GRE and IPsec both add encapsulation overhead.

Q343. A security architect wants Internet routers to discard routes received from a customer that are outside the prefixes the customer is authorized to advertise. Which control should be used?

1. Explicit BGP prefix filtering
   2. DHCP snooping
   3. MACsec
   4. URL filtering

Correct Answer: 1. Explicit BGP prefix filtering

Explanation: BGP prefix filtering allows a router to define exactly which network prefixes a neighbor is permitted to advertise. If the customer sends an unexpected or unauthorized route, the routing policy can reject it rather than placing it into the routing table or propagating it further. This helps prevent accidental route leaks and some forms of route hijacking. Prefix filtering should be complemented by peer authentication, maximum-prefix limits, route-origin validation, and monitoring. DHCP snooping, MACsec, and URL filtering protect other layers of the infrastructure and do not determine which BGP routes a neighbor may announce.

Q344. An enterprise wants switch links between two buildings encrypted at Layer 2 without creating an IP tunnel. Which technology is most suitable?

1. GRE
   2. IPsec tunnel mode
   3. MACsec
   4. NAT

Correct Answer: 3. MACsec

Explanation: MACsec provides confidentiality, integrity, and data-origin authentication for Ethernet frames on supported Layer 2 links. This makes it suitable for protecting switch-to-switch or router-to-router Ethernet connections where the organization does not want to create an IP-layer tunnel. IPsec protects IP traffic and normally operates at Layer 3, while GRE provides encapsulation without native encryption. NAT changes addressing rather than protecting traffic. MACsec is particularly useful for campus, data-center, and metro Ethernet links where frame-level protection is needed. Secure key establishment and compatible hardware support remain important design considerations.

Q345. A security team wants branch users to access SaaS applications directly while maintaining centrally managed cloud-delivered security policy. Which architecture best fits?

1. Backhaul all traffic to one data center regardless of location
   2. Disable branch Internet access
   3. Use only static ACLs on branch switches
   4. SASE or SSE-based cloud security with local Internet breakout

Correct Answer: 4. SASE or SSE-based cloud security with local Internet breakout

Explanation: SASE and SSE architectures provide cloud-delivered security controls such as secure web gateway, cloud application controls, zero-trust access, and data protection. When combined with local Internet breakout, branch traffic can reach SaaS applications through a nearby security enforcement point rather than being backhauled through headquarters. This can improve performance while maintaining consistent policy. Data-center backhaul may increase latency and bandwidth consumption. Static switch ACLs cannot provide equivalent application-aware cloud security. The architecture should still account for identity, endpoint posture, logging, DNS protection, and secure WAN design.

Q346. An organization wants highly sensitive administrator sessions to require a managed workstation, MFA, and an approved change ticket. Which security model is being applied?

1. Context-aware conditional access
   2. Anonymous administration
   3. Shared-account access
   4. Implicit network trust

Correct Answer: 1. Context-aware conditional access

Explanation: Conditional access combines multiple signals when deciding whether to allow a sensitive operation. In this scenario, identity authentication through MFA, device trust through a managed workstation, and business context through an approved change ticket all contribute to the authorization decision. This is stronger than relying on a password or network location alone and aligns with zero-trust principles. Shared accounts weaken accountability, anonymous administration removes identity assurance, and implicit network trust assumes that internal access is automatically safe. High-risk administrative access should therefore evaluate both identity and contextual trust signals before privilege is granted.

Q347. A company wants to prevent employees from installing unsigned executable software on privileged workstations. Which endpoint control best meets the requirement?

1. DHCP relay
   2. GRE
   3. Application allowlisting with trusted signing rules
   4. BGP filtering

Correct Answer: 3. Application allowlisting with trusted signing rules

Explanation: Application allowlisting can restrict execution to software that meets approved criteria, including digital signatures from trusted publishers. On privileged workstations, this can significantly reduce the chance that malicious tools, scripts, or unauthorized executables run successfully. The policy should be centrally managed and tested carefully so required administrative tools and updates remain functional. DHCP relay, GRE, and BGP filtering operate at network layers and cannot control which local applications execute. Allowlisting works best alongside EDR, least privilege, secure software distribution, patching, and strong administrative identity controls.

Q348. A web application uses TLS but the security team wants the load balancer to inspect HTTP requests before forwarding them to back-end servers. What must occur?

1. Disable encryption permanently
   2. Terminate or decrypt TLS at the inspection point and optionally re-encrypt to the backend
   3. Convert HTTPS to FTP
   4. Allow encrypted packets to bypass inspection

Correct Answer: 2. Terminate or decrypt TLS at the inspection point and optionally re-encrypt to the backend

Explanation: HTTP-layer inspection requires visibility into the decrypted request. A load balancer, reverse proxy, or WAF can terminate TLS, inspect the HTTP content, apply security policy, and then forward the request to the back-end server. Sensitive environments often re-encrypt the back-end connection so data remains protected between the inspection point and application servers. Disabling encryption would unnecessarily expose data, while leaving traffic opaque prevents full application-layer inspection. The architecture should protect private keys carefully, use trusted certificates, and consider privacy and regulatory requirements when designing TLS termination or decryption.

Q349. A containerized service should not be able to write to host device files even after compromise. Which runtime design most directly helps?

1. Minimize privileges and avoid privileged container mode
   2. Mount all host devices into the container
   3. Give the container full host PID and filesystem access
   4. Disable container isolation

Correct Answer: 1. Minimize privileges and avoid privileged container mode

Explanation: Privileged containers and broad host-device mounts weaken the isolation boundary between the workload and the underlying host. Running containers with minimal privileges, limited Linux capabilities, restricted device access, seccomp controls, and non-root identities reduces what an attacker can do after compromising the application. A container should receive only the host resources required for its intended function. Full host access greatly increases the chance that a container compromise becomes a host compromise. Runtime hardening should complement trusted images, vulnerability scanning, network segmentation, and workload identity controls.

Q350. A serverless function receives an event containing a URL that it later accesses. Which application threat should the architect specifically consider?

1. VLAN hopping
   2. BGP hijacking
   3. Server-Side Request Forgery
   4. MAC flooding

Correct Answer: 3. Server-Side Request Forgery

Explanation: Server-Side Request Forgery, or SSRF, occurs when an attacker influences a server-side application into making requests to destinations chosen by the attacker. In a serverless environment, this can expose internal APIs, metadata services, or protected network resources. Controls include validating allowed destinations, rejecting arbitrary URLs, controlling outbound network access, using hardened metadata services, and applying least-privilege cloud identities. The function should not assume that event data is trustworthy. VLAN hopping, BGP hijacking, and MAC flooding are network infrastructure attacks rather than server-side web request manipulation techniques.

Q351. A security team wants to verify that software dependencies used by a build have not been replaced with tampered files after approval. Which control most directly provides this assurance?

1. Integrity hashes or cryptographic signatures for dependencies
   2. Larger build servers
   3. Longer DNS TTL values
   4. Disable artifact verification

Correct Answer: 4. Integrity hashes or cryptographic signatures for dependencies

Explanation: Cryptographic integrity verification allows a build system to confirm that a downloaded dependency matches an approved artifact. Hashes can detect unexpected changes, while digital signatures can also provide provenance when the signing identity is trusted. This helps protect against repository compromise, malicious package substitution, or altered dependencies. Verification should be paired with controlled repositories, version pinning, software composition analysis, and secure build infrastructure. Increasing build-server capacity does not establish artifact integrity, and disabling verification weakens the supply chain. Build systems should fail safely when dependency integrity cannot be validated.

Q352. A security team discovers that several alerts generated during a breach were suppressed because an overly broad exception matched them. What design improvement best addresses the problem?

1. Disable the entire detection platform
   2. Use narrowly scoped, time-bound detection exceptions with regular review
   3. Suppress all alerts from the affected business unit
   4. Delete historical alerts

Correct Answer: 2. Use narrowly scoped, time-bound detection exceptions with regular review

Explanation: Detection exceptions should be as specific as possible and should not remain indefinitely unless there is a justified business need. Time-bound exceptions with owners and review dates reduce the chance that a temporary tuning change creates a permanent blind spot. Rules should ideally use context such as specific hosts, users, applications, or known benign behavior rather than broad suppression criteria. Disabling large parts of the detection platform increases risk. Historical alerts should remain available for investigation. Detection engineering requires the same governance discipline as firewall and access-control policy.

Q353. During an incident, a compromised account is disabled and malicious network connections are blocked. Which incident-response objective is being achieved?

1. Containment
   2. Preparation
   3. Lessons learned
   4. Risk acceptance

Correct Answer: 1. Containment

Explanation: Containment limits the attacker’s ability to continue operating after an incident has been identified. Disabling a compromised account can stop further unauthorized authentication, while blocking malicious infrastructure or isolating systems can interrupt command and control and lateral movement. Eradication follows by removing malware, persistence, and root causes, while recovery returns systems to normal operation. Preparation occurs before incidents, and lessons learned occurs afterward. Timely containment is critical because it reduces additional damage while preserving enough evidence for investigation and subsequent remediation.

Q354. An organization requires that security incidents affecting regulated personal data be escalated immediately to legal and privacy teams. What is this primarily an example of?

1. Route filtering
   2. Incident-response escalation requirement
   3. Network address translation
   4. Container orchestration

Correct Answer: 2. Incident-response escalation requirement

Explanation: Incident-response plans should define escalation paths based on severity, data type, regulatory impact, operational risk, and other business factors. Incidents involving regulated personal information may trigger legal review, privacy assessment, contractual notifications, or statutory reporting deadlines. Clear escalation requirements prevent delays and uncertainty during high-pressure events. The requirement should identify responsible roles, contact methods, decision authority, and timing. Network routing, NAT, and container orchestration are unrelated to organizational incident governance. Architecture and operational procedures should be designed together so relevant telemetry can identify when escalation criteria are met.

Q355. A vulnerability is technically severe but has a reliable compensating control that prevents exploitation in the current architecture. What should risk assessment consider?

1. Ignore the vulnerability permanently
   2. Remove the compensating control
   3. Evaluate residual risk after considering the effectiveness of the compensating control
   4. Treat the technical severity score as the only input

Correct Answer: 3. Evaluate residual risk after considering the effectiveness of the compensating control

Explanation: Risk assessment should consider the vulnerability, asset value, exposure, threat activity, and the effectiveness of existing controls. A strong compensating control may substantially reduce exploit likelihood or impact, resulting in lower residual risk than the raw technical severity suggests. This does not mean the vulnerability can be ignored indefinitely; the control itself might fail or become ineffective as the environment changes. Architects should document assumptions and periodically validate compensating controls. Risk-based prioritization combines technical findings with business and architectural context rather than relying on one vulnerability score alone.

Q356. A new regulatory requirement states that audit records must be retained for seven years. Which architectural area must be modified most directly?

1. Logging storage, retention, integrity, and archival design
   2. Ethernet duplex settings
   3. DHCP lease duration
   4. BGP hold timers

Correct Answer: 4. Logging storage, retention, integrity, and archival design

Explanation: A seven-year audit-retention requirement directly affects the logging architecture. The organization must ensure enough storage, appropriate archival tiers, access controls, tamper protection, search capability, lifecycle policies, backup, and secure disposal at the end of the retention period. Costs and retrieval requirements should be considered because long-term records may move to lower-cost storage while remaining available for audits or investigations. Network protocol timers do not satisfy record-retention obligations. Security architecture should translate regulatory language into specific technical requirements that can be validated and operated consistently over time.

Q357. An Infrastructure as Code pipeline identifies that a proposed firewall rule permits 0.0.0.0/0 to an administrative port. What should the secure pipeline do?

1. Reject the change through an automated policy gate unless an approved exception exists
   2. Deploy the rule automatically because it is syntactically valid
   3. Disable firewall logging
   4. Remove code review requirements

Correct Answer: 1. Reject the change through an automated policy gate unless an approved exception exists

Explanation: Policy-as-code controls can detect dangerous configurations before deployment, including unrestricted access to administrative ports. The pipeline should fail the proposed change unless there is a formally approved, documented exception. This shifts security validation earlier and creates repeatable enforcement across deployments. Syntactic validity does not mean a configuration is secure. Logging and code review should remain enabled because they provide traceability and additional quality controls. Infrastructure as Code is most powerful when combined with automated policy evaluation, peer review, protected branches, and controlled deployment identities.

Q358. An automation system calls an external security API that occasionally returns HTTP 500 errors. Which behavior is most appropriate?

1. Retry forever with no delay
   2. Disable error handling
   3. Perform bounded retries with backoff and then fail safely if the problem persists
   4. Treat every failed response as success

Correct Answer: 3. Perform bounded retries with backoff and then fail safely if the problem persists

Explanation: Temporary server errors can occur in external APIs, so automation should handle them predictably. A small number of bounded retries with increasing delay can recover from transient failures without overwhelming the service. If the error persists, the workflow should fail safely, log the condition, and alert an operator or trigger another controlled path. Infinite rapid retries can amplify outages and consume resources. Treating failed responses as success can result in incomplete security actions. Resilient automation should distinguish retryable failures from permanent errors and implement appropriate timeouts and rollback behavior.

Q359. An AI-based detection model performs extremely well on its training dataset but poorly on new production events. Which machine-learning issue is most likely?

1. Overfitting
   2. ARP poisoning
   3. Route redistribution
   4. DHCP relay failure

Correct Answer: 2. Overfitting

Explanation: Overfitting occurs when a machine-learning model learns the details and noise of its training data too closely and fails to generalize to unseen data. A model can therefore show excellent training accuracy while performing poorly on real production events. Proper validation using separate datasets, cross-validation, regularization, representative training data, and ongoing production monitoring can help detect and reduce overfitting. In cybersecurity, changing attacker behavior makes generalization especially important. ARP, routing, and DHCP issues are network problems and do not explain a gap between training and real-world model performance.

Q360. An organization wants an AI assistant to summarize security alerts but never expose raw customer records in generated responses. Which architecture best enforces this?

1. Give the model unrestricted database access
   2. Depend only on a prompt saying “do not reveal data”
   3. Disable authorization on the customer database
   4. Filter and minimize retrieved data before it reaches the model

Correct Answer: 3. Filter and minimize retrieved data before it reaches the model

Explanation: The strongest control is to prevent unnecessary sensitive information from entering the model context in the first place. Retrieval and preprocessing layers should enforce authorization, classification, redaction, and data-minimization policies before content is supplied to the AI system. Prompt instructions can provide additional behavioral guidance, but they should not be the primary security boundary. If the model never receives raw customer records, prompt injection or hallucination is less likely to expose them. AI systems should inherit existing enterprise access controls rather than bypassing them for convenience.