View Full Cisco CCNP Security 300-745 Exam Dumps and Practice Test Dumps.

Q61. An organization wants switch-to-switch Ethernet links protected against eavesdropping and frame tampering while preserving Layer 2 connectivity. Which technology is most appropriate?

1. GRE
   2. MACsec
   3. NAT
   4. DHCP snooping

Correct Answer: 2. MACsec

Explanation: MACsec provides confidentiality and integrity for Ethernet frames on supported Layer 2 links. It is useful for protecting traffic between switches, routers, or other compatible devices where Ethernet transport itself must be secured. MACsec operates differently from IPsec, which protects IP-layer communications. GRE provides tunneling but does not supply encryption by itself. NAT changes addressing information rather than protecting frame content. DHCP snooping protects DHCP operations against rogue servers but does not encrypt Ethernet traffic. MACsec is therefore the appropriate design when the requirement specifically calls for protecting Ethernet frames against interception and modification.

Q62. A company wants to prevent employees from resolving known malicious Internet domains before a connection is established. Which control best meets this requirement?

1. DNS-layer security filtering
   2. GRE tunneling
   3. Port mirroring
   4. Static routing

Correct Answer: 1. DNS-layer security filtering

Explanation: DNS-layer security can block resolution of known malicious, phishing, command-and-control, or otherwise prohibited domains before the endpoint establishes an IP connection to the destination. This provides an early enforcement point and can protect users whether they are on the corporate network or remote, depending on the architecture. GRE and static routing provide connectivity rather than domain reputation enforcement. Port mirroring copies traffic for monitoring but does not inherently prevent malicious DNS resolution. DNS security is particularly valuable as one layer in a defense-in-depth design alongside secure web gateways, endpoint security, firewalls, and threat intelligence.

Q63. An architect must secure routing updates between two BGP peers against unauthorized neighbors and certain spoofing attacks. Which control is most appropriate?

1. Disable all BGP timers
   2. Configure open unauthenticated peering
   3. Allow TCP 179 from every Internet address
   4. Authenticate the BGP session and restrict permitted peers

Correct Answer: 4. Authenticate the BGP session and restrict permitted peers

Explanation: BGP peer security should limit sessions to known neighbors and authenticate the control-plane relationship where supported. Access controls can restrict TCP port 179 to expected peers, while BGP authentication helps reduce the risk of unauthorized or spoofed session establishment. Additional measures such as route filtering, maximum-prefix controls, TTL security, RPKI, and infrastructure ACLs can strengthen the design further. Allowing BGP from arbitrary Internet addresses expands attack surface. Disabling timers does not provide authentication. A secure routing architecture protects both who can establish a peer relationship and what routing information that peer is allowed to advertise.

Q64. A security team wants to prevent rogue DHCP servers from supplying malicious default gateways to users on an access switch. Which switch feature should be enabled?

1. Port mirroring
   2. GRE
   3. DHCP snooping
   4. BGP communities

Correct Answer: 3. DHCP snooping

Explanation: DHCP snooping distinguishes trusted DHCP-facing switch ports from untrusted access ports. DHCP server responses received on untrusted ports can be blocked, preventing an attacker from operating a rogue DHCP server and distributing malicious network parameters such as a default gateway or DNS server. DHCP snooping can also build a binding table used by other Layer 2 security features. GRE and BGP communities are unrelated to protecting DHCP. Port mirroring provides traffic visibility but does not enforce DHCP server trust. DHCP snooping therefore directly addresses unauthorized DHCP responses on switched networks.

Q65. A company has a public SaaS application but wants employees to authenticate through the corporate identity provider without maintaining separate application passwords. Which architecture is most appropriate?

1. Federated identity using SAML or OIDC
   2. Shared application credentials
   3. Local accounts on every SaaS application
   4. Anonymous application access

Correct Answer: 1. Federated identity using SAML or OIDC

Explanation: Identity federation allows a SaaS application to rely on a trusted corporate identity provider for authentication. Technologies such as SAML and OpenID Connect enable single sign-on while centralizing authentication policy, MFA, account lifecycle, and identity governance. When employees leave the organization or lose authorization, access can be changed centrally rather than requiring administrators to manage separate passwords in each SaaS platform. Shared credentials reduce accountability, and independent local accounts increase lifecycle complexity. Anonymous access would remove identity assurance completely. Federation therefore improves both usability and centralized identity security for SaaS services.

Q66. A business wants direct Internet access at branch offices while applying consistent security controls without sending all Internet traffic through headquarters. Which architecture best meets this requirement?

1. Layer 2 extension to headquarters
   2. SD-WAN integrated with cloud security or secure Internet gateway services
   3. Static default routing with no security inspection
   4. Disable all local Internet access

Correct Answer: 2. SD-WAN integrated with cloud security or secure Internet gateway services

Explanation: SD-WAN can provide local Internet breakout while steering traffic through cloud-delivered security controls such as secure web gateways, DNS security, firewall services, or broader SASE platforms. This reduces backhaul latency and allows branches to reach SaaS and Internet services more efficiently while maintaining consistent policy. Extending Layer 2 to headquarters is not a scalable Internet security design. Uninspected direct Internet access creates security gaps, while disabling local access preserves the backhaul problem. SD-WAN combined with appropriate cloud security therefore addresses performance and centralized security requirements simultaneously.

Q67. A company needs to connect two sites and carry multicast traffic across the tunnel while also encrypting the traffic. Which design is most appropriate?

1. NAT only
   2. TLS inspection only
   3. MPLS without encryption
   4. GRE protected by IPsec

Correct Answer: 4. GRE protected by IPsec

Explanation: GRE can encapsulate multicast and other traffic types that plain IPsec tunnel designs may not transport directly in all scenarios. However, GRE itself does not provide confidentiality or integrity. Protecting the GRE tunnel with IPsec combines GRE’s encapsulation flexibility with IPsec encryption and authentication. This architecture has historically been useful when routing protocols or multicast traffic must traverse an encrypted tunnel. NAT and TLS inspection solve different problems. MPLS can carry multiple traffic types but does not inherently encrypt customer traffic. GRE over IPsec therefore meets both the multicast and encryption requirements.

Q68. Which control-plane protection best limits traffic destined specifically for a router’s CPU without affecting normal transit traffic unnecessarily?

1. Web Application Firewall
   2. DLP
   3. Control Plane Policing
   4. Endpoint isolation

Correct Answer: 3. Control Plane Policing

Explanation: Control Plane Policing classifies traffic destined for a network device’s control plane and applies rate limits or other actions to protect CPU resources. It can protect routing protocols, management services, and other infrastructure functions from malicious or excessive traffic while allowing normal forwarding-plane traffic to continue. A WAF protects web applications, DLP protects sensitive information, and endpoint isolation is an incident-response capability. CoPP is particularly important because a router or switch can become unavailable if control-plane traffic overwhelms the processor even when interfaces and forwarding hardware remain operational.

Q69. A company wants to allow developers to access production servers only when using a managed administrative workstation that meets security posture requirements. Which design best satisfies this requirement?

1. Shared root account from any endpoint
   2. Identity- and device-aware privileged access policy
   3. Public SSH access with passwords
   4. Disable administrative logging

Correct Answer: 2. Identity- and device-aware privileged access policy

Explanation: Administrative access should evaluate both the administrator’s identity and the security posture of the device being used. A managed privileged-access workstation can be required to meet controls such as endpoint protection, encryption, certificate identity, patch level, and corporate management status. Strong MFA and just-in-time privilege can further reduce risk. Shared root accounts reduce accountability, while Internet-exposed password-based SSH increases attack surface. Disabling logs undermines investigation. Identity- and device-aware controls therefore support zero-trust principles by verifying both the user and endpoint before granting high-risk production access.

Q70. A security team wants to detect malicious network behavior and automatically drop matching traffic in real time. Which deployment model is most appropriate?

1. Inline IPS
   2. Out-of-band IDS only
   3. SPAN collector without enforcement
   4. Passive packet capture only

Correct Answer: 4. Inline IPS

Explanation: An inline Intrusion Prevention System sits directly in the traffic path and can block or reset connections when malicious patterns are detected. This provides active prevention rather than detection alone. An out-of-band IDS or passive packet capture can identify suspicious traffic but cannot normally prevent the original malicious packets from reaching their destination. Inline IPS designs must account for performance, latency, availability, and false positives because the device becomes part of the forwarding path. Proper tuning and resilient deployment are therefore important when using active network intrusion prevention in production.

Q71. A containerized application should permit only the front-end service to communicate with the application tier, and only the application tier to communicate with the database. Which control best enforces this architecture?

1. Microsegmentation policies
   2. One flat Kubernetes network
   3. Disable container logs
   4. One shared root credential

Correct Answer: 1. Microsegmentation policies

Explanation: Microsegmentation can explicitly define which workloads and services are permitted to communicate. In a three-tier application, policy can allow the front end to reach only required application-tier services and permit the application tier to reach only approved database ports. Direct front-end-to-database communication can be denied. This limits lateral movement if one workload is compromised and reinforces application architecture boundaries. A flat network gives attackers more freedom after compromise. Shared root credentials and disabled logs further weaken security. Microsegmentation therefore provides fine-grained east-west enforcement based on the intended application communication model.

Q72. A web application handles sensitive customer data and performs TLS encryption itself, but the organization wants a reverse proxy to perform certificate handling and reduce application CPU usage. Which design should be considered?

1. Disable TLS entirely
   2. Replace HTTPS with FTP
   3. TLS offloading at the reverse proxy with protected back-end communication
   4. Send customer data in plaintext internally without review

Correct Answer: 3. TLS offloading at the reverse proxy with protected back-end communication

Explanation: TLS offloading allows a reverse proxy or load balancer to perform cryptographic operations on behalf of back-end application servers. This can centralize certificate management and reduce application CPU consumption. However, architects must consider the trust boundary between the proxy and application. Sensitive environments may require re-encryption so traffic remains protected after termination at the proxy. Sending confidential information in plaintext simply because traffic is inside a data center can create unnecessary risk. TLS offloading should therefore be designed with network segmentation, certificate management, and back-end encryption requirements appropriate to the application’s sensitivity.

Q73. Which design is best for preventing a compromised serverless function from accessing unrelated cloud resources?

1. Use a separate least-privilege execution identity for the function
   2. Give the function subscription-wide administrator rights
   3. Store the cloud root credential in an environment variable
   4. Disable audit logging

Correct Answer: 1. Use a separate least-privilege execution identity for the function

Explanation: Each serverless function should use a dedicated workload identity with permissions limited to the APIs and resources it needs. This limits the impact of compromise because an attacker gaining control of the function inherits only those restricted permissions. Broad administrator access increases blast radius and makes application defects more dangerous. Root credentials should never be embedded in function configuration, and audit logs are valuable for detecting and investigating abuse. Where possible, cloud-native identities and temporary credentials should replace static secrets. Least privilege is therefore fundamental to secure serverless architecture.

Q74. An organization needs to identify where regulated data resides across cloud storage, databases, and SaaS applications before defining DLP controls. Which activity should occur first?

1. Disable all cloud services
   2. Perform data discovery and classification
   3. Delete every unstructured file
   4. Allow all users unrestricted access

Correct Answer: 2. Perform data discovery and classification

Explanation: Effective data protection begins with understanding what information exists, where it resides, and how sensitive it is. Data discovery identifies repositories and content, while classification labels data according to sensitivity or regulatory importance. DLP rules can then be designed to apply appropriate controls to categories such as customer records, intellectual property, financial information, or regulated personal data. Applying restrictive controls without knowing the data landscape can produce excessive false positives or leave important information unprotected. Discovery and classification therefore provide the foundation for risk-based DLP and access-control policies.

Q75. A company uses a third-party SaaS platform to process confidential customer records. Which assessment should be part of the security architecture process before adoption?

1. Only measure the provider’s website loading speed
   2. Review only the provider’s logo and branding
   3. Third-party security and risk assessment
   4. Ignore data residency requirements

Correct Answer: 3. Third-party security and risk assessment

Explanation: Using a SaaS provider can transfer important processing and storage responsibilities outside the organization’s direct control. Security architects should evaluate the provider’s security posture, compliance certifications, contractual obligations, breach-notification terms, identity integration, encryption, logging, resilience, data location, subcontractors, and exit strategy. This is part of third-party or supply-chain risk management. Performance and branding may matter commercially but do not demonstrate that security requirements are satisfied. Data residency can be especially important where regulations or customer contracts restrict where information may be stored or processed.

Q76. Which incident-response phase focuses on restoring affected systems to normal operation after the threat has been removed?

1. Identification
   2. Containment
   3. Preparation
   4. Recovery

Correct Answer: 4. Recovery

Explanation: Recovery returns affected systems and services to normal business operation after containment and eradication have addressed the active threat. Activities can include restoring from known-good backups, rebuilding systems, resetting credentials, applying patches, validating security controls, monitoring for recurrence, and gradually returning systems to production. Identification determines that an incident exists, while containment limits damage and eradication removes malicious persistence or root causes. Preparation happens before an incident. A strong recovery phase also verifies that restored systems are trustworthy rather than simply bringing compromised environments back online as quickly as possible.

Q77. Which activity best helps a security team determine whether its architecture can detect techniques used by real-world adversaries?

1. Mapping controls and detections to MITRE ATT&CK techniques
   2. Increasing DNS TTL values
   3. Replacing every subnet mask
   4. Disabling threat intelligence

Correct Answer: 1. Mapping controls and detections to MITRE ATT&CK techniques

Explanation: MITRE ATT&CK maps adversary behaviors into tactics and techniques such as credential access, persistence, lateral movement, defense evasion, and exfiltration. Security teams can map their controls, logs, and detection analytics against those techniques to identify coverage gaps. This does not prove that every attack will be detected, but it provides a structured way to evaluate architecture and monitoring against known adversary behaviors. DNS TTL changes and subnet masks do not provide equivalent security coverage analysis. Threat intelligence can strengthen ATT&CK mapping by showing which techniques are particularly relevant to the organization’s likely adversaries.

Q78. A critical vulnerability has a high technical severity score, but the affected server is isolated, contains no sensitive data, and cannot be reached by untrusted users. What should the risk process consider?

1. Ignore all technical severity information
   2. Business context and exploitability in addition to vulnerability severity
   3. Automatically shut down the entire company
   4. Treat every vulnerability as identical risk

Correct Answer: 3. Business context and exploitability in addition to vulnerability severity

Explanation: Vulnerability severity is an important input, but organizational risk depends on more than a technical score. Architects should consider asset criticality, network exposure, exploit availability, compensating controls, data sensitivity, business impact, and likelihood of successful exploitation. A critical vulnerability on a highly isolated low-value system can represent different risk from the same flaw on an Internet-facing payment server. Risk-based prioritization does not mean ignoring technical severity; it combines technical and business context. Treating every vulnerability identically can waste remediation resources and delay fixes for genuinely high-risk exposures.

Q79. A CI/CD pipeline uses open-source packages from a public repository. Which control most directly reduces software supply-chain risk from a compromised dependency?

1. Disable all build logs
   2. Use approved repositories, dependency verification, and software composition analysis
   3. Allow arbitrary unpinned package versions
   4. Give build agents permanent root credentials

Correct Answer: 2. Use approved repositories, dependency verification, and software composition analysis

Explanation: Software supply-chain security should control where dependencies come from and verify what is being introduced into builds. Approved internal or trusted repositories, version pinning, package-signature or integrity verification, software composition analysis, and SBOM generation can reduce exposure to malicious or vulnerable dependencies. Allowing builds to download arbitrary unpinned packages creates opportunities for dependency confusion, compromised upstream packages, and unexpected updates. Build systems should also use least privilege rather than permanent root credentials. These controls make dependency use more predictable, auditable, and resilient against supply-chain compromise.

Q80. An organization is developing an AI-based SOC assistant. Which safeguard best limits the risk that malicious content in an incident ticket manipulates the AI into executing unauthorized actions?

1. Give the AI unrestricted command execution
   2. Treat all ticket content as trusted instructions
   3. Disable authentication for automation APIs
   4. Separate untrusted input from privileged instructions and restrict available tool permissions

Correct Answer: 4. Separate untrusted input from privileged instructions and restrict available tool permissions

Explanation: Prompt-injection attacks can attempt to manipulate an AI system by embedding malicious instructions in data the model is asked to analyze. A secure design should treat incident text, emails, logs, and webpages as untrusted content rather than privileged instructions. The AI’s tools should have narrowly scoped permissions, and high-impact operations should require deterministic validation or human approval. Authentication and audit logging should remain enabled. Granting unrestricted command access magnifies the consequences of model error or prompt injection. Separating instructions from untrusted data and enforcing least privilege reduces the risk of AI-driven unauthorized actions.