View Full Cisco CCNP Security 300-745 Exam Dumps and Practice Test Dumps.

Q201. An enterprise wants edge routers to discard incoming packets whose source addresses should not legitimately be reachable through the interface on which they arrived. Which technology best supports this requirement?

1. Unicast Reverse Path Forwarding
   2. DNSSEC
   3. MACsec
   4. DHCP relay

Correct Answer: 1. Unicast Reverse Path Forwarding

Explanation: Unicast Reverse Path Forwarding, or uRPF, helps detect and drop packets with spoofed source IP addresses by checking whether the routing table provides an acceptable return path for the source address. Depending on whether strict or loose mode is used, the router can enforce different levels of validation. uRPF can be especially useful at network boundaries where spoofed traffic should not be accepted. Care is required with asymmetric routing because strict checks may reject legitimate traffic. DNSSEC, MACsec, and DHCP relay address DNS integrity, Ethernet protection, and DHCP forwarding rather than source-address validation.

Q202. A network security team wants to protect router loopback addresses and infrastructure interfaces from unnecessary traffic originating on user networks. Which control is most appropriate?

1. Allow all user traffic to infrastructure addresses
   2. Disable routing protocol authentication
   3. Infrastructure access control lists
   4. Remove all management logging

Correct Answer: 3. Infrastructure access control lists

Explanation: Infrastructure ACLs are designed to restrict traffic destined for network infrastructure addresses, such as router loopbacks, transit interfaces, and management endpoints. Only traffic required for routing, monitoring, management, or other legitimate infrastructure services should be permitted. This reduces the attack surface available to compromised endpoints and Internet-based attackers. Infrastructure ACLs complement control-plane policing rather than replacing it: ACLs restrict who can reach device services, while CoPP can limit traffic rates to the control plane. Allowing unrestricted access or disabling authentication and logging would make the infrastructure more vulnerable.

Q203. An organization wants network devices to verify that the operating-system image loaded during startup has not been replaced with unauthorized software. Which architectural capability best meets this requirement?

1. DHCP snooping
   2. Hardware root of trust and secure boot
   3. NAT overload
   4. URL filtering

Correct Answer: 2. Hardware root of trust and secure boot

Explanation: Secure boot uses cryptographic verification to ensure that firmware and operating-system components loaded during startup are trusted and have not been maliciously modified. A hardware root of trust provides a protected foundation from which these integrity checks can begin. This helps protect infrastructure devices from persistent compromise involving altered firmware or boot images. DHCP snooping protects access networks against rogue DHCP servers, NAT translates addresses, and URL filtering controls web access. Secure boot does not eliminate the need for image-signing validation, patching, physical security, and protected software distribution, but it strengthens platform integrity.

Q204. A company needs secure branch connectivity and centralized path selection across multiple Internet links while dynamically steering business applications over the best available transport. Which solution best fits?

1. Static GRE only
   2. One unmanaged Layer 2 extension
   3. Telnet over the Internet
   4. Secure SD-WAN architecture**

Correct Answer: 4. Secure SD-WAN architecture

Explanation: SD-WAN can use multiple WAN transports while dynamically steering application traffic according to performance, availability, or policy. Secure SD-WAN designs commonly encrypt overlay traffic and centrally define segmentation and routing policies across branches. This can provide greater operational scalability than manually maintaining large numbers of static tunnels. Static GRE does not provide encryption by itself and offers limited centralized application-aware path control. Layer 2 extension is generally not an appropriate scalable WAN architecture, while Telnet is insecure. SD-WAN is therefore well suited when business requirements combine secure branch connectivity with intelligent multi-link traffic steering.

Q205. An employee grants a malicious third-party SaaS application OAuth permission to read corporate email even though the attacker never learns the employee’s password. Which threat has occurred?

1. OAuth consent phishing
   2. ARP poisoning
   3. BGP hijacking
   4. VLAN hopping

Correct Answer: 2. OAuth consent phishing

Explanation: OAuth consent phishing tricks a user into authorizing a malicious application to access cloud resources through legitimate OAuth permissions. Because the user grants the permission directly, an attacker may obtain persistent API access without stealing the user’s password. Defenses include restricting user consent, requiring administrator approval for sensitive scopes, monitoring risky applications, reviewing OAuth grants, and applying identity intelligence. MFA alone may not prevent the attack because the authorization can occur after successful legitimate authentication. ARP poisoning, BGP hijacking, and VLAN hopping are network attacks unrelated to malicious SaaS application consent.

Q206. A security architect wants to prevent a compromised cloud workload from using server-side request forgery to access the cloud instance metadata service. Which design provides the strongest protection?

1. Allow unrestricted outbound HTTP from every workload
   2. Publish metadata services on the Internet
   3. Disable application authentication
   4. Restrict metadata access and enforce controlled egress from workloads

Correct Answer: 1. Restrict metadata access and enforce controlled egress from workloads

Explanation: Server-Side Request Forgery, or SSRF, can cause an application server to make attacker-controlled requests to internal services, including cloud instance metadata endpoints that may expose credentials. Strong mitigations include using hardened metadata-service versions, blocking unnecessary workload access to metadata endpoints, applying egress filtering, validating outbound destinations, and avoiding direct use of user-controlled URLs. Unrestricted outbound access increases SSRF impact. Publishing metadata services externally or disabling authentication would further weaken security. SSRF protection therefore requires both secure application input handling and infrastructure controls that limit what compromised server-side components can reach.

Q207. An API uses JSON Web Tokens for authorization. Which validation is essential before trusting a received token?

1. Trust every token containing a username
   2. Accept tokens with no expiration
   3. Validate the signature, issuer, audience, and expiration claims
   4. Decode the token and ignore cryptographic verification

Correct Answer: 4. Validate the signature, issuer, audience, and expiration claims

Explanation: A JWT should not be trusted simply because it can be decoded. The application must verify the token’s cryptographic signature using an approved algorithm and key and validate claims such as issuer, audience, expiration, and other application-specific requirements. Audience validation helps ensure that a token issued for one service is not replayed against another. Expiration limits token lifetime, while issuer validation confirms the trusted identity system that created it. Applications should also avoid algorithm-confusion weaknesses and handle key rotation correctly. Merely reading token contents without cryptographic verification provides no reliable assurance of authenticity.

Q208. A public API is used by a mobile application that cannot safely store a client secret. Which OAuth mechanism is designed to reduce authorization-code interception risk in this scenario?

1. Shared administrator password
   2. PKCE
   3. HTTP Basic authentication with a hard-coded secret
   4. Permanent bearer tokens

Correct Answer: 3. PKCE

Explanation: Proof Key for Code Exchange, or PKCE, strengthens OAuth authorization-code flows for public clients such as mobile and browser-based applications that cannot securely store a client secret. The client creates a temporary code verifier and sends a derived challenge during authorization. The authorization code can later be exchanged only when the correct verifier is presented. This reduces the usefulness of an intercepted authorization code. Embedding a permanent client secret in a mobile application is unsafe because users or attackers can extract it. Long-lived bearer tokens also increase exposure if compromised.

Q209. A security architect wants database administrators to manage database availability without automatically being able to view highly sensitive application records in plaintext. Which design principle is most applicable?

1. Separation of duties combined with strong encryption and key separation
   2. Give every database administrator the encryption keys
   3. Disable database auditing
   4. Store keys beside the encrypted database

Correct Answer: 1. Separation of duties combined with strong encryption and key separation

Explanation: Separation of duties can limit the ability of a single privileged role to control both protected data and the cryptographic keys required to decrypt it. Database administrators can maintain availability and performance while key-management responsibilities are assigned to a separate trusted function. Strong encryption alone provides limited value if the same administrators automatically control both the ciphertext and keys. Audit logging should remain enabled, and keys should be protected separately from encrypted data. This design reduces insider risk and can help organizations meet requirements involving privileged-access control and sensitive-data confidentiality.

Q210. A security team wants to detect unauthorized configuration changes made directly to cloud resources outside the approved Infrastructure as Code workflow. Which capability is most appropriate?

1. Disable configuration monitoring
   2. Configuration drift detection
   3. Increase DNS TTL values
   4. GRE keepalives

Correct Answer: 4. Configuration drift detection

Explanation: Configuration drift occurs when the deployed infrastructure state differs from the approved or declared configuration. Drift-detection tooling can compare live cloud resources against Infrastructure as Code definitions or configuration baselines and alert when unauthorized manual changes appear. Some workflows can automatically remediate drift by restoring the approved state. This is particularly valuable in environments where emergency console changes or misconfigured automation can bypass normal code review. DNS and GRE settings do not identify infrastructure-policy drift. Drift detection complements version control, policy as code, change approval, and strong control over direct administrative access.

Q211. A SOC wants to distinguish a genuine malicious event from a detection that incorrectly flagged normal behavior. What is the latter called?

1. False positive
   2. False negative
   3. Residual risk
   4. Recovery point

Correct Answer: 3. False positive

Explanation: A false positive occurs when a security control or detection system labels benign activity as malicious. Excessive false positives consume analyst time, can cause alert fatigue, and may reduce confidence in the detection platform. Tuning should therefore improve fidelity without creating excessive false negatives, where real malicious activity is missed. The objective is not simply to minimize alert volume but to balance detection sensitivity against operational impact. Residual risk describes risk remaining after controls, while a recovery point relates to business continuity. Understanding false-positive and false-negative behavior is essential when evaluating SOC detection quality.

Q212. During an incident investigation, analysts want to determine which process opened a malicious network connection on a specific workstation. Which telemetry source provides the most direct evidence?

1. Public BGP table
   2. Endpoint detection and response telemetry
   3. DNS registrar information only
   4. Switch spanning-tree state

Correct Answer: 2. Endpoint detection and response telemetry

Explanation: EDR telemetry links endpoint activity such as process creation, parent-child process relationships, file modifications, network connections, registry changes, and user context. This allows an analyst to determine which executable initiated a suspicious connection and what happened before and after that event. Network telemetry might show the connection itself but not necessarily identify the local process responsible. BGP and spanning-tree information describe network control behavior rather than endpoint execution. Combining EDR with network and identity telemetry provides an even stronger investigative picture of how an attacker operated.

Q213. An incident-response team needs to collect volatile evidence from a compromised host. Which type of information should generally be prioritized because it may disappear when the system is powered off?

1. Memory-resident processes and active network connections
   2. Archived documentation stored offline
   3. Printed network diagrams
   4. Historical contracts

Correct Answer: 4. Memory-resident processes and active network connections

Explanation: Volatile evidence can disappear or change rapidly, especially when a system is shut down or rebooted. Examples include running processes, memory contents, active network sessions, logged-on users, open files, and temporary cryptographic material. Incident responders often prioritize volatile data before collecting less transient evidence, provided that doing so is consistent with the organization’s forensic procedures. Static documents and offline records will generally remain available later. The exact collection order depends on the incident, system type, legal requirements, and response playbook, but volatility is a key consideration in evidence acquisition.

Q214. A security architect must design a new service to comply with a legal requirement that customer records remain stored within a specified country. Which architecture concern is most directly involved?

1. Ethernet duplex
   2. Data residency
   3. BGP local preference
   4. DHCP lease duration

Correct Answer: 1. Data residency

Explanation: Data residency concerns where information is physically or logically stored and processed. Legal, regulatory, contractual, or sovereignty requirements may require certain categories of information to remain within a particular country or region. Security architects must therefore evaluate cloud regions, backups, replicas, disaster recovery, support access, and third-party processing locations. Encryption alone does not necessarily satisfy residency requirements because encrypted data may still be physically stored outside the approved jurisdiction. Ethernet, routing, and DHCP parameters do not address this requirement. Data-location constraints should be identified early because they can materially affect architecture and provider selection.

Q215. A requirement states that a security gateway must process at least 10 Gbps of inspected traffic while adding no more than 5 ms latency. What type of requirement is this?

1. Marketing requirement
   2. User-interface requirement
   3. Nonfunctional technical requirement
   4. Password requirement

Correct Answer: 2. Nonfunctional technical requirement

Explanation: Throughput and latency targets describe how well a solution must perform rather than a business function it must perform. These are nonfunctional technical requirements and are critical when sizing firewalls, inspection services, VPN gateways, or cloud-security platforms. They should be measurable and testable so architects can validate whether a design meets expected load. Functional requirements describe capabilities such as allowing remote users to access an application. Security requirements might specify controls such as MFA or encryption. Clearly distinguishing requirement types helps teams evaluate architecture objectively and avoid choosing solutions that provide the right features but insufficient performance.

Q216. A company needs an independent party to assess whether a new security architecture meets documented controls before production approval. Which governance principle is most relevant?

1. Self-approval by the same engineer who implemented every control
   2. Independent control assessment
   3. Disable documentation
   4. Remove change records

Correct Answer: 3. Independent control assessment

Explanation: Independent assessment reduces conflicts of interest by separating implementation from evaluation. An assessor reviews whether required controls are correctly designed, implemented, and operating as intended before a system receives authorization or production approval. The degree of independence needed depends on organizational policy and risk, but high-impact systems often benefit from stronger separation between builders and assessors. Self-review remains useful during development but may not provide sufficient assurance by itself. Disabling documentation and change records would undermine the evidence needed for assessment. Independent validation strengthens governance and helps ensure security requirements were actually met.

Q217. A DevSecOps team wants to ensure a build is stopped automatically when a critical vulnerability is detected in a dependency. Which pipeline mechanism should be implemented?

1. A security quality gate based on defined vulnerability policy
   2. Ignore scan results until production
   3. Disable dependency scanning
   4. Allow every build regardless of severity

Correct Answer: 2. A security quality gate based on defined vulnerability policy

Explanation: A security quality gate converts scan findings into enforceable deployment policy. For example, the pipeline can fail when a dependency contains a critical vulnerability unless an approved exception exists. This prevents known high-risk artifacts from progressing automatically toward production. Effective gates should be risk-based and carefully tuned so developers are not overwhelmed by low-value findings. Exceptions should be documented, time-bound, and reviewed. Simply producing reports without linking them to deployment decisions limits the value of automated scanning. Security gates help integrate security requirements directly into the software-delivery process.

Q218. An automation platform must rotate API keys every 30 days. Which approach is most secure?

1. Email new keys to all employees
   2. Update keys manually in dozens of source repositories
   3. Disable key expiration
   4. Automate rotation through a secrets-management system and update consumers securely

Correct Answer: 4. Automate rotation through a secrets-management system and update consumers securely

Explanation: Automated secret rotation reduces operational burden and shortens the lifetime of compromised credentials. A secrets-management platform can generate or request new API keys, distribute them only to authorized workloads, update references, and revoke older credentials according to policy. Automation should include rollback and monitoring in case consumers fail to adopt a new key. Emailing secrets or storing them across source repositories increases exposure. Disabling expiration creates long-lived credentials that remain useful to attackers for extended periods. Centralized lifecycle automation is therefore the preferred approach for recurring key rotation.

Q219. An AI system can recommend containment actions based on SOC data. Which logging requirement is most important for governance?

1. Record model recommendations, relevant inputs, approvals, and executed actions
   2. Delete AI decision records immediately
   3. Log only successful user logins
   4. Disable audit trails for automated actions

Correct Answer: 1. Record model recommendations, relevant inputs, approvals, and executed actions

Explanation: AI-assisted security workflows should preserve an audit trail showing what the model recommended, what evidence influenced the recommendation, whether a human or deterministic control approved the action, and what action was ultimately executed. This supports investigation, accountability, model evaluation, and regulatory review. Sensitive information should still be protected through appropriate access and retention controls. Deleting decision records removes evidence needed to understand mistakes or malicious manipulation. AI governance should therefore treat model-driven actions like other privileged automation: authenticated, authorized, logged, reviewable, and attributable.

Q220. An enterprise wants a cryptographic migration plan but does not know where RSA, ECC, and other algorithms are currently used. What should it do first?

1. Immediately disable every certificate
   2. Create an enterprise cryptographic inventory
   3. Replace all encryption with plaintext
   4. Ignore existing dependencies

Correct Answer: 3. Create an enterprise cryptographic inventory

Explanation: A cryptographic inventory identifies algorithms, certificates, protocols, key sizes, cryptographic libraries, hardware dependencies, and applications that rely on them. Without this inventory, an organization cannot reliably plan algorithm upgrades or post-quantum migration because hidden dependencies may break unexpectedly. The inventory should include externally facing systems, internal applications, code-signing processes, VPNs, identity systems, and stored encrypted data. Once dependencies are understood, architects can prioritize migration and improve crypto-agility. Abruptly disabling certificates or encryption would create outages and security exposure. Discovery is therefore the essential first step in a controlled cryptographic transition.