300-745 sample questions

Question 1

A multinational financial institution is redesigning its email security architecture to combat a surge in Business Email Compromise (BEC) and ransomware delivered via malicious attachments. The current environment relies solely on the default protections provided by their cloud email provider.

The security architect must select a comprehensive design that addresses both spoofing of executive domains and zero-day malware dropping payloads.

Which combination of technologies provides the optimal architectural defense against these specific threats?

Accepted Answer

Deploy Cisco Secure Email Threat Defense via API integration for advanced malware analysis, and enforce a DMARC policy of 'p=reject' based on aligned SPF and DKIM records.

Answer

Route all email through a traditional Secure Web Gateway (SWG) to perform SSL decryption and utilize Data Loss Prevention (DLP) to stop BEC attacks.

Answer

Deploy Cisco Secure Endpoint on all executive devices to block the BEC payloads locally, and use SPF to block inbound ransomware.

Answer

Configure a strict DMARC policy of 'p=none' for visibility, and utilize Cisco Umbrella to block DNS requests to known ransomware command-and-control servers.

Answer

Implement SPF and DKIM on all domains, and deploy an inline proxy firewall to inspect all SMTP traffic for malicious attachments.

Question 2

True or False: Passwordless authentication completely eliminates the use of cryptographic keys, relying entirely on biometric data (such as fingerprints or facial recognition) transmitted to the central authentication server.

Accepted Answer

False

Answer

True

Question 3

A security architect is designing a solution to gain visibility into unsanctioned application usage (Shadow IT) across a globally distributed workforce. Users frequently bypass the corporate VPN when working from home. Which technology should the architect select to enforce data security policies on these unmanaged SaaS applications?

Accepted Answer

Implement a Cloud Access Security Broker (CASB) integrated with a Secure Web Gateway (SWG) roaming client.

Answer

Deploy a traditional Next-Generation Firewall (NGFW) at all corporate egress points.

Answer

Configure IPsec tunnels from the remote endpoints directly to the SaaS providers.

Answer

Utilize Cisco Secure Network Analytics (Stealthwatch) utilizing NetFlow from the core switches.

Question 4

A manufacturing plant relies on legacy Programmable Logic Controllers (PLCs) that cannot run endpoint security agents and cannot be patched. The architect must design a solution to prevent lateral movement of malware if an IT workstation is compromised. Which design provides the best protection for these unmanaged OT devices?

Accepted Answer

Use Cisco Cyber Vision to discover and baseline OT communication patterns, and integrate with Cisco ISE to enforce TrustSec microsegmentation policies.

Answer

Route all OT traffic through an external cloud-based Web Application Firewall (WAF) to sanitize the industrial protocols.

Answer

Implement 802.1X authentication with EAP-TLS on the PLCs to ensure only trusted devices connect to the OT switch.

Answer

Deploy a host-based firewall via Group Policy Object (GPO) to all devices on the manufacturing floor.

Question 5

An enterprise is migrating monolithic applications from its on-premises data center to AWS and Azure. The security team mandates that identical workload protection and microsegmentation policies must be enforced regardless of where the application resides. Which approach best satisfies this multi-cloud requirement?

Accepted Answer

Utilize Cisco Secure Workload (formerly Tetration) to enforce software-based, identity-driven microsegmentation policies directly on the host OS across all environments.

Answer

Use Cisco Umbrella to enforce DNS-layer security on all workloads in both the data center and the cloud.

Answer

Implement a DMVPN Phase 3 architecture to tunnel all cloud traffic back to the on-premises data center for inspection.

Answer

Deploy physical Cisco Secure Firewalls in the data center and use native AWS Security Groups and Azure Network Security Groups managed independently.

Question 6

A retail organization has 500 branch locations using legacy routers. They require a VPN solution that provides dynamic spoke-to-spoke communication to reduce latency for point-of-sale transactions between branches. They do not have the budget to upgrade to SD-WAN edge devices immediately. Which tunneling solution should the architect select?

Accepted Answer

Dynamic Multipoint VPN (DMVPN) Phase 3.

Answer

Static point-to-point GRE over IPsec tunnels between all 500 branches.

Answer

Public cloud VPN transit gateway with BGP peering.

Answer

Hub-and-spoke IPsec VPN terminating on a central Next-Generation Firewall.

Free 300-745 sample questions

True or False: Passwordless authentication completely eliminates the use of cryptographic keys, relying entirely on biometric data (such as fingerprints or facial recognition) transmitted to the central authentication server.

6 more free samples are waiting