Covers security approaches and VPN tunneling design, firewall and DLP for cloud-native applications, SOC incident handling and risk mitigation, and AI-driven security automation and DevSecOps.
12 free sample questions150 in the full practice test
Secure Infrastructure · Endpoint and client devices (on-network, off-network, and remote)
An organization is transitioning from a traditional VPN architecture to a Zero Trust Network Access (ZTNA) model. Which approach best demonstrates the principle of continuous trust when securing remote endpoints?
Answer and explanation
Correct answer: A
Continuous trust (or continuous adaptive risk and trust assessment - CARTA) moves away from point-in-time authentication. Instead of verifying a user or device only at the initial login, the system continuously evaluates the device's security posture, location, and user behavior throughout the session. If the risk level changes (e.g., malware is detected or the user moves to a high-risk location), access can be dynamically revoked or restricted.
Q2Question 2
Advanced
Secure Infrastructure · Email (phishing, ransomware, business email compromise, malware, and spoofing)
A multinational financial institution is redesigning its email security architecture to combat a surge in Business Email Compromise (BEC) and ransomware delivered via malicious attachments. The current environment relies solely on the default protections provided by their cloud email provider.
The security architect must select a comprehensive design that addresses both spoofing of executive domains and zero-day malware dropping payloads.
Which combination of technologies provides the optimal architectural defense against these specific threats?
Answer and explanation
Correct answer: E
To combat BEC (which relies heavily on domain spoofing), DMARC with a 'p=reject' policy is the industry standard, as it ensures that emails claiming to be from the organization actually align with SPF and DKIM validations. To combat ransomware via zero-day attachments, Cisco Secure Email Threat Defense (which integrates via API to cloud providers like Microsoft 365) provides advanced malware analysis, sandboxing, and retrospective security to catch payloads that bypass native cloud email filters.
Q3Question 3
Beginner
Secure Infrastructure · Identity such as MFA, passwordless, continuous trust, and identity intelligence
True or False: Passwordless authentication completely eliminates the use of cryptographic keys, relying entirely on biometric data (such as fingerprints or facial recognition) transmitted to the central authentication server.
Answer and explanation
Correct answer: B
False. Passwordless authentication (such as FIDO2/WebAuthn) heavily relies on asymmetric cryptographic keys. The biometric data is used locally on the device to unlock a private key stored in a hardware enclave (like a TPM). The biometric data itself is never transmitted to the central authentication server; instead, the device signs a cryptographic challenge to prove the user's identity.
Q4Question 4
Intermediate
Secure Infrastructure · SaaS
A security architect is designing a solution to gain visibility into unsanctioned application usage (Shadow IT) across a globally distributed workforce. Users frequently bypass the corporate VPN when working from home. Which technology should the architect select to enforce data security policies on these unmanaged SaaS applications?
Answer and explanation
Correct answer: C
A Cloud Access Security Broker (CASB) is specifically designed to discover Shadow IT, monitor SaaS usage, and enforce data security policies (like DLP) on cloud applications. Because the users are remote and bypassing the VPN, integrating the CASB with an endpoint-based Secure Web Gateway (SWG) roaming client (such as Cisco Umbrella) ensures that the traffic is inspected and policies are enforced regardless of the user's physical location.
Q5Question 5
Intermediate
Secure Infrastructure · IoT
A manufacturing plant relies on legacy Programmable Logic Controllers (PLCs) that cannot run endpoint security agents and cannot be patched. The architect must design a solution to prevent lateral movement of malware if an IT workstation is compromised. Which design provides the best protection for these unmanaged OT devices?
Answer and explanation
Correct answer: C
Legacy OT devices (like PLCs) cannot run agents, making host-based solutions impossible. Cisco Cyber Vision uses passive network monitoring to discover industrial assets and their communication flows without disrupting them. By integrating this visibility with Cisco Identity Services Engine (ISE), the architect can enforce TrustSec (SGT-based) microsegmentation, restricting the PLCs to communicate only with authorized engineering workstations, effectively preventing lateral movement from a general IT compromise.
Q6Question 6
Intermediate
Secure Infrastructure · Applications across data center and multi-cloud
An enterprise is migrating monolithic applications from its on-premises data center to AWS and Azure. The security team mandates that identical workload protection and microsegmentation policies must be enforced regardless of where the application resides. Which approach best satisfies this multi-cloud requirement?
Answer and explanation
Correct answer: B
Cisco Secure Workload provides consistent, zero-trust microsegmentation across on-premises data centers and public clouds (AWS, Azure, GCP). By utilizing software agents on the workloads themselves (or integrating with cloud APIs), it enforces identity-driven policies consistently at the workload level, agnostic of the underlying network infrastructure. Managing disparate native cloud security groups manually would violate the requirement for a unified, consistent policy approach.
Register free for 6 more questions
Or unlock all 150 300-745 questions with explanations, timed mode and flashcards.
