View Full Cisco CCNP Security 300-745 Exam Dumps and Practice Test Dumps.

Q361. An enterprise uses NETCONF for automated router configuration. Which transport design best protects management credentials and configuration data?

1. NETCONF over unauthenticated HTTP
   2. NETCONF over SSH with authenticated automation identities
   3. Telnet with a shared enable password
   4. TFTP from every user subnet

Correct Answer: 2. NETCONF over SSH with authenticated automation identities

Explanation: NETCONF is commonly secured using SSH, which provides confidentiality, integrity, and server authentication for management traffic. Automation should authenticate with a dedicated service identity rather than a shared human administrator account, and that identity should receive only the permissions required for its workflow. Management access should also be restricted to approved automation systems or management networks and logged centrally. Telnet and TFTP do not provide appropriate confidentiality for sensitive configuration operations. Securing the management transport is critical because compromise of network automation can allow attackers to change many infrastructure devices rapidly.

Q362. A business connects its data center to a public cloud using two Internet VPN tunnels and wants automatic path failover if one tunnel becomes unavailable. Which design best meets the requirement?

1. Use one static route to a single tunnel
   2. Disable routing adjacency monitoring
   3. Send traffic randomly without health checks
   4. Run dynamic routing across redundant IPsec tunnels

Correct Answer: 4. Run dynamic routing across redundant IPsec tunnels

Explanation: Dynamic routing over redundant IPsec tunnels allows the data center and cloud environment to exchange reachability information and automatically stop using a failed path when its routing adjacency disappears. BGP is commonly used in public-cloud VPN designs because it supports scalable routing and path selection across redundant tunnels. A single static route provides weak failover unless additional tracking is configured. Random traffic forwarding without tunnel health awareness can cause blackholing. Redundant encrypted tunnels combined with dynamic routing provide both secure connectivity and improved resilience when an Internet path or VPN gateway connection fails.

Q363. An internal API should accept connections only from services that possess organization-issued certificates. Which control best satisfies this requirement?

1. Mutual TLS between the calling service and API
   2. Source IP checking only
   3. Anonymous HTTPS
   4. A shared API password embedded in source code

Correct Answer: 1. Mutual TLS between the calling service and API

Explanation: Mutual TLS provides cryptographic authentication for both sides of a connection. The API verifies the caller’s certificate, while the calling service also verifies the API’s certificate. This gives workloads stronger identity assurance than relying only on network location or IP address. Certificates can be issued through an enterprise PKI or automated workload identity system and rotated regularly. A shared password embedded in source code creates secret-management problems and broad blast radius. Anonymous HTTPS encrypts traffic but does not identify the calling workload. mTLS is therefore appropriate for service-to-service authentication in zero-trust architectures.

Q364. A security architect wants an IPS deployment that can actively stop malicious traffic but must not become a single point of failure during appliance outages. Which design is best?

1. Passive IDS only
   2. One inline appliance with no redundancy
   3. Redundant inline IPS components with an appropriate fail-open or failover strategy
   4. Disable intrusion detection entirely

Correct Answer: 3. Redundant inline IPS components with an appropriate fail-open or failover strategy

Explanation: Inline IPS can block malicious traffic in real time, but because it sits directly in the forwarding path, availability must be considered carefully. Redundant IPS components and defined failure behavior help prevent a single appliance failure from unnecessarily interrupting business traffic. Depending on risk requirements, the design can favor fail-open behavior for availability or fail-closed behavior for stronger security. Passive IDS cannot directly block the original attack packets. A single nonredundant inline device creates an avoidable failure point. Security architecture should balance prevention effectiveness with the availability requirements of the protected service.

Q365. An organization must protect administrative configuration backups for firewalls and routers from unauthorized viewing or modification. Which design is most appropriate?

1. Encrypt backups, restrict access, and verify their integrity
   2. Store all backups in a publicly readable file share
   3. Email device configurations to all engineers
   4. Disable backup versioning and logging

Correct Answer: 1. Encrypt backups, restrict access, and verify their integrity

Explanation: Network-device configuration backups can contain passwords, SNMP information, VPN parameters, certificates, addressing, and other sensitive infrastructure details. They should therefore be encrypted at rest and in transit, stored in a repository with strong access control, and protected against unauthorized modification. Integrity checking or signed version control can help identify tampering. Version history is also valuable for recovery and investigation. Public file shares and broad email distribution unnecessarily expose sensitive information. Backup security is part of management-plane protection because stolen or altered configurations can directly enable infrastructure compromise.

Q366. A company deploys a Web Application Firewall in front of a critical application. What additional capability best protects the application if a malicious request successfully bypasses the WAF?

1. Disable secure coding reviews
   2. Make the application run as root
   3. Remove application logging
   4. Layer application security with secure coding and runtime or host protections

Correct Answer: 4. Layer application security with secure coding and runtime or host protections

Explanation: A WAF is an important application-layer control, but it should not be treated as the only defense. Secure coding, vulnerability management, strong authentication, least privilege, host controls, runtime protection, and application logging provide additional layers if the WAF misses an attack. Defense in depth is especially important because application behavior and attacker techniques continually change. Running the application with elevated privileges increases the impact of exploitation, while disabling logging reduces detection and investigation capability. Security architecture should assume individual controls can fail and provide multiple independent protections around critical applications.

Q367. A cloud application should access one database table but must not have permission to administer the entire database service. Which identity design is best?

1. Use the cloud account root credential
   2. Assign a narrowly scoped workload identity
   3. Share the database administrator password with the application
   4. Disable authentication between the application and database

Correct Answer: 2. Assign a narrowly scoped workload identity

Explanation: A workload identity should receive only the permissions required by the application. If the application needs to read or modify one specific dataset, it should not receive administrative control over the entire database platform. Cloud-native identities can also use temporary credentials instead of long-lived passwords. This reduces the impact if the application is compromised. Root or administrator credentials create excessive privilege and are difficult to protect safely inside application environments. Disabling authentication removes an important security boundary. Least-privilege workload identity is therefore a fundamental cloud application design principle.

Q368. A containerized workload requires temporary writable storage but should not retain application data after the container is destroyed. Which design best matches the requirement?

1. Store all data on the host root filesystem
   2. Mount production secrets as writable files
   3. Use ephemeral storage separated from persistent application data
   4. Run the container with unlimited host access

Correct Answer: 3. Use ephemeral storage separated from persistent application data

Explanation: Ephemeral storage is appropriate for caches, temporary files, and intermediate processing data that does not need to survive workload replacement. Separating temporary storage from persistent business data supports immutable workload design and reduces unwanted state within containers. Persistent information should be stored in approved external volumes, databases, or managed storage services with appropriate backup and access controls. Mounting the host root filesystem or providing broad host access weakens isolation. Secrets should also be handled through secure secret-management mechanisms rather than general writable storage. Clear state separation improves container resilience and lifecycle management.

Q369. A development team wants to verify that production container images were created from an approved source repository by the approved build pipeline. Which controls best support this?

1. Anonymous image uploads
   2. Unverified public registry pulls
   3. Manual file naming conventions only
   4. Artifact provenance metadata and cryptographic signing

Correct Answer: 4. Artifact provenance metadata and cryptographic signing

Explanation: Provenance records where an artifact came from and how it was built, while cryptographic signatures provide integrity and signer authenticity. Together, these controls can demonstrate that a production container image originated from an approved source and trusted build process and has not been modified afterward. Admission policies can verify the signature and provenance before allowing deployment. File names provide no meaningful cryptographic assurance, and anonymous or unverified uploads create supply-chain risk. Provenance and signing are therefore key controls for establishing trust between CI/CD systems and production runtime environments.

Q370. A web application allows users to upload profile images. Which design most directly reduces the risk that an attacker uploads executable server-side code?

1. Validate file types, rename files, store them outside executable paths, and prevent execution
   2. Trust the uploaded filename extension
   3. Place uploads directly in the web application’s script directory
   4. Grant uploaded files execute permission automatically

Correct Answer: 1. Validate file types, rename files, store them outside executable paths, and prevent execution

Explanation: Secure file-upload design uses several layers. The application should validate permitted content types, normalize or replace user-supplied filenames, scan content where appropriate, and store files outside directories where the web server can execute them. Files should receive non-executable permissions and be served through controlled application logic or static-content infrastructure. File extensions and client-supplied MIME types alone are not trustworthy. Storing uploads in executable application directories can turn a simple upload function into a remote-code-execution path. Layered upload handling therefore reduces both direct exploitation and malware-distribution risk.

Q371. A SIEM rule identifies repeated failed logins followed by a successful administrator login from the same source. Which analytical concept best improves the alert compared with treating each event separately?

1. Event correlation
   2. Packet fragmentation
   3. Route summarization
   4. VLAN pruning

Correct Answer: 3. Event correlation

Explanation: Event correlation combines related security events to identify a larger pattern that individual records may not reveal. Multiple failed logins followed by a successful privileged authentication could indicate password guessing or credential compromise. Correlation can consider source address, user, device, timing, authentication type, and subsequent activity to improve detection fidelity. Security teams can then enrich the incident with endpoint and identity context before responding. Packet fragmentation, routing, and VLAN operations are network functions and do not combine security events into behavioral sequences. SIEM correlation is central to detecting multi-step attack activity.

Q372. An organization wants analysts to automatically receive asset criticality and owner information when a security alert is created. Which capability best supports this workflow?

1. Disable asset inventory
   2. Integrate SIEM or SOAR with the asset-management system
   3. Store owner information only in paper records
   4. Require analysts to guess the system’s importance

Correct Answer: 2. Integrate SIEM or SOAR with the asset-management system

Explanation: Security alerts become more actionable when technical evidence is enriched with business context. Integrating SIEM or SOAR with a configuration management database or asset inventory can automatically provide system owner, environment, data classification, criticality, business service, and contact information. Analysts can then prioritize an alert affecting a production payment server differently from the same detection on a test workstation. Manual lookup can slow response, while missing inventory leads to poor prioritization. Security architecture should therefore connect operational security telemetry with authoritative asset and business-context sources.

Q373. A vulnerability assessment lists a system as critically vulnerable, but the system is no longer in production and has been disconnected from all networks. What should happen to its risk rating?

1. Reassess the risk using the current exposure and business context
   2. Keep the exact original risk forever regardless of changes
   3. Increase the rating automatically because it is offline
   4. Ignore the asset inventory

Correct Answer: 1. Reassess the risk using the current exposure and business context

Explanation: Risk changes when the environment changes. A disconnected, decommissioned system has a different exposure profile from an Internet-facing production system, even if the technical vulnerability still exists on its disk. Risk assessment should consider current asset value, connectivity, threat exposure, compensating controls, and intended disposition. The vulnerability can remain documented, particularly if the system may be reconnected later, but its operational risk should reflect current reality. Security risk is contextual rather than a fixed property derived only from a vulnerability score.

Q374. A project cannot meet a mandatory security standard by its launch date. What should the governance process require?

1. Ignore the requirement
   2. Hide the noncompliance from stakeholders
   3. Deploy without documenting the issue
   4. Formal exception approval with risk acceptance and compensating controls

Correct Answer: 3. Formal exception approval with risk acceptance and compensating controls

Explanation: When a mandatory security requirement cannot be met, the deviation should be handled through a formal exception process rather than silently ignored. Appropriate risk owners should understand and accept the residual risk, compensating controls should reduce exposure where possible, and the exception should include an expiration or review date. This creates accountability and prevents temporary deviations from becoming permanent unnoticed weaknesses. The security team should also track the remediation plan. Hidden noncompliance undermines governance, auditability, and informed business decision-making.

Q375. Which architecture practice most directly ensures that security controls are mapped back to specific business and regulatory needs?

1. Requirements traceability
   2. Random product selection
   3. Disabling documentation
   4. Using only vendor defaults

Correct Answer: 4. Requirements traceability

Explanation: Requirements traceability links business, regulatory, technical, and security requirements to architecture decisions and implemented controls. For example, a requirement to protect cardholder information can be traced to segmentation, encryption, logging, and access-control mechanisms in the design. Traceability helps reviewers verify that important requirements have not been missed and allows later changes to be evaluated for security impact. Randomly selecting products or relying solely on defaults can result in controls that do not address actual organizational needs. Documented traceability strengthens governance and architecture validation.

Q376. A security architecture has several overlapping controls protecting the same critical asset. What is the primary benefit?

1. It guarantees no attack can ever succeed
   2. It provides resilience when one security control fails or is bypassed
   3. It removes the need for monitoring
   4. It makes vulnerability management unnecessary

Correct Answer: 2. It provides resilience when one security control fails or is bypassed

Explanation: Layered security controls reduce dependence on any single mechanism. An attacker who bypasses a perimeter firewall might still encounter workload segmentation, strong identity checks, host protection, application authorization, and monitoring. This is the core value of defense in depth. Multiple layers do not guarantee perfect security and do not remove the need for patching, monitoring, or vulnerability management. Controls should also be designed carefully to avoid unnecessary complexity. The objective is to create independent barriers that reduce attack probability and limit impact when another layer is ineffective.

Q377. An Infrastructure as Code pipeline must ensure that all cloud databases are encrypted before deployment. Which control is most appropriate?

1. Automated policy-as-code validation of the deployment plan
   2. Manual review once per year
   3. Disable encryption configuration checks
   4. Permit developers to bypass all pipeline controls

Correct Answer: 3. Automated policy-as-code validation of the deployment plan

Explanation: Policy-as-code can inspect planned infrastructure before deployment and reject configurations that violate required security standards. A rule can verify that every database resource has approved encryption enabled and can prevent the pipeline from progressing until the requirement is satisfied or a formal exception is approved. This approach is scalable and consistent across many cloud projects. Annual manual review occurs too late to prevent insecure resources from being deployed. Automated validation shifts security controls left and turns architectural requirements into repeatable machine-enforced policy.

Q378. An automated firewall workflow receives the same request twice because a message queue retries delivery. Which design property prevents duplicate rule creation?

1. Unlimited administrative permissions
   2. Idempotent workflow design
   3. Anonymous API access
   4. Disabled transaction logging

Correct Answer: 1. Idempotent workflow design

Explanation: An idempotent workflow produces the same intended state even if the same request is processed multiple times. Instead of blindly creating a new firewall rule on every execution, the automation checks whether the required rule already exists and takes no duplicate action once the desired state is reached. This is especially important in event-driven systems where retries and duplicate message delivery are normal. Idempotency improves safety, recoverability, and predictability. Broad permissions or anonymous access increase risk, while disabled logs make duplicate or failed automation harder to investigate.

Q379. A machine-learning detector produces many false positives after the organization deploys a new application that changes normal network behavior. What should the security team do?

1. Retrain or retune the model using validated new behavioral data
   2. Disable all security telemetry permanently
   3. Automatically treat every alert as malicious
   4. Delete the new application

Correct Answer: 2. Retrain or retune the model using validated new behavioral data

Explanation: New applications can change legitimate traffic patterns and cause models trained on older baselines to generate excessive false positives. The security team should first validate that the new behavior is benign and then update the detection baseline, features, thresholds, or model using controlled and trustworthy data. Changes should be tested before production promotion to avoid introducing new blind spots. Simply disabling telemetry removes valuable visibility, while automatically treating every alert as malicious creates operational disruption. Model maintenance is an ongoing lifecycle requirement because real environments and attacker behavior continually evolve.

Q380. An organization wants an AI security assistant to execute only read-only SIEM searches, even if a prompt requests account deletion. Which control provides the strongest guarantee?

1. Tell the AI not to perform deletions
   2. Give the model global administrator access
   3. Disable SIEM authentication
   4. Use an API identity that has only read-only SIEM permissions

Correct Answer: 4. Use an API identity that has only read-only SIEM permissions

Explanation: Tool authorization should be enforced by the connected system rather than relying on prompt instructions. If the AI’s service identity possesses only read permissions, the SIEM will reject write or destructive operations regardless of what the model generates. This limits damage from prompt injection, hallucination, or mistaken reasoning. Prompt rules remain useful for behavior guidance but should not be the primary security boundary. Least-privilege API identities, strong authentication, audit logging, and execution limits provide more reliable control over what AI-assisted security workflows can actually do.