300-745 sample questions

Question 1

An organization is transitioning from a traditional VPN architecture to a Zero Trust Network Access (ZTNA) model. Which approach best demonstrates the principle of continuous trust when securing remote endpoints?

Accepted Answer

Evaluating device posture and user behavior dynamically throughout the session to adjust access privileges in real-time.

Answer

Authenticating the user via MFA once per day and granting a 24-hour session token.

Answer

Deploying a static NAC policy that blocks non-compliant devices at the initial 802.1X authentication phase.

Answer

Requiring a hardware token to establish an IPsec tunnel to the corporate datacenter.

Question 2

A multinational financial institution is redesigning its email security architecture to combat a surge in Business Email Compromise (BEC) and ransomware delivered via malicious attachments. The current environment relies solely on the default protections provided by their cloud email provider.

The security architect must select a comprehensive design that addresses both spoofing of executive domains and zero-day malware dropping payloads.

Which combination of technologies provides the optimal architectural defense against these specific threats?

Accepted Answer

Deploy Cisco Secure Email Threat Defense via API integration for advanced malware analysis, and enforce a DMARC policy of 'p=reject' based on aligned SPF and DKIM records.

Answer

Implement SPF and DKIM on all domains, and deploy an inline proxy firewall to inspect all SMTP traffic for malicious attachments.

Answer

Configure a strict DMARC policy of 'p=none' for visibility, and utilize Cisco Umbrella to block DNS requests to known ransomware command-and-control servers.

Answer

Route all email through a traditional Secure Web Gateway (SWG) to perform SSL decryption and utilize Data Loss Prevention (DLP) to stop BEC attacks.

Answer

Deploy Cisco Secure Endpoint on all executive devices to block the BEC payloads locally, and use SPF to block inbound ransomware.

Question 3

True or False: Passwordless authentication completely eliminates the use of cryptographic keys, relying entirely on biometric data (such as fingerprints or facial recognition) transmitted to the central authentication server.

Accepted Answer

False

Answer

True

Question 4

A security architect is designing a solution to gain visibility into unsanctioned application usage (Shadow IT) across a globally distributed workforce. Users frequently bypass the corporate VPN when working from home. Which technology should the architect select to enforce data security policies on these unmanaged SaaS applications?

Accepted Answer

Implement a Cloud Access Security Broker (CASB) integrated with a Secure Web Gateway (SWG) roaming client.

Answer

Deploy a traditional Next-Generation Firewall (NGFW) at all corporate egress points.

Answer

Utilize Cisco Secure Network Analytics (Stealthwatch) utilizing NetFlow from the core switches.

Answer

Configure IPsec tunnels from the remote endpoints directly to the SaaS providers.

Question 5

A manufacturing plant relies on legacy Programmable Logic Controllers (PLCs) that cannot run endpoint security agents and cannot be patched. The architect must design a solution to prevent lateral movement of malware if an IT workstation is compromised. Which design provides the best protection for these unmanaged OT devices?

Accepted Answer

Use Cisco Cyber Vision to discover and baseline OT communication patterns, and integrate with Cisco ISE to enforce TrustSec microsegmentation policies.

Answer

Deploy a host-based firewall via Group Policy Object (GPO) to all devices on the manufacturing floor.

Answer

Implement 802.1X authentication with EAP-TLS on the PLCs to ensure only trusted devices connect to the OT switch.

Answer

Route all OT traffic through an external cloud-based Web Application Firewall (WAF) to sanitize the industrial protocols.

Question 6

An enterprise is migrating monolithic applications from its on-premises data center to AWS and Azure. The security team mandates that identical workload protection and microsegmentation policies must be enforced regardless of where the application resides. Which approach best satisfies this multi-cloud requirement?

Accepted Answer

Utilize Cisco Secure Workload (formerly Tetration) to enforce software-based, identity-driven microsegmentation policies directly on the host OS across all environments.

Answer

Deploy physical Cisco Secure Firewalls in the data center and use native AWS Security Groups and Azure Network Security Groups managed independently.

Answer

Implement a DMVPN Phase 3 architecture to tunnel all cloud traffic back to the on-premises data center for inspection.

Answer

Use Cisco Umbrella to enforce DNS-layer security on all workloads in both the data center and the cloud.

Free 300-745 sample questions

An organization is transitioning from a traditional VPN architecture to a Zero Trust Network Access (ZTNA) model. Which approach best demonstrates the principle of continuous trust when securing remote endpoints?

True or False: Passwordless authentication completely eliminates the use of cryptographic keys, relying entirely on biometric data (such as fingerprints or facial recognition) transmitted to the central authentication server.

6 more free samples are waiting