300-745 Designing Cisco Security Infrastructure (SDSI) Practice Questions
Prepare for 300-745 with more than an answer.
- 1
What is the primary security objective of implementing Control Plane Policing (CoPP) on a core routing device?
Show answer details
Correct answer: B
Control Plane Policing (CoPP) is a security feature designed to protect the control plane (the CPU and memory) of a network device. By applying QoS rate-limiting and filtering rules specifically to traffic destined to the router (such as routing protocol updates, ICMP, or management traffic), CoPP prevents DoS attacks or network anomalies from exhausting the device's CPU, ensuring it can continue routing data plane traffic efficiently.
- 2
A DevOps team is deploying a highly dynamic Kubernetes environment where application pods are created and destroyed frequently. The security architect needs to enforce granular, identity-based network access controls between these microservices with minimal performance overhead.
Which TWO architectures or technologies are most appropriate for this requirement? (Select TWO)
Show answer details
Correct answer: B, C
For highly dynamic Kubernetes environments, traditional perimeter firewalls create bottlenecks (hairpinning). A distributed firewall architecture places the enforcement point at the workload level. eBPF (Extended Berkeley Packet Filter) allows security and network visibility programs to run securely inside the Linux kernel without changing kernel source code or loading modules, providing high-performance, identity-aware microsegmentation at the pod level.
For highly dynamic Kubernetes environments, traditional perimeter firewalls create bottlenecks (hairpinning). A distributed firewall architecture places the enforcement point at the workload level. eBPF (Extended Berkeley Packet Filter) allows security and network visibility programs to run securely inside the Linux kernel without changing kernel source code or loading modules, providing high-performance, identity-aware microsegmentation at the pod level.
- 3
A company is launching a new e-commerce web application. During penetration testing, the application was found to be highly vulnerable to SQL injection (SQLi) and Cross-Site Scripting (XSS) attacks. Which security architecture feature is specifically designed to mitigate these Layer 7 application logic attacks?
Show answer details
Correct answer: C
A Web Application Firewall (WAF) is purpose-built to inspect HTTP/HTTPS traffic at Layer 7 and protect web applications against specific logic attacks, such as SQL injection (SQLi), Cross-Site Scripting (XSS), and other OWASP Top 10 vulnerabilities. While a Next-Gen Firewall (NGFW) or IPS provides broad network protection, a WAF deeply understands web application structures, cookies, and parameters to block these specific exploits.
- 4
A global enterprise is shifting to a hybrid work model. The current architecture uses a centralized VPN concentrator at headquarters. Remote users complain about slow access to cloud applications like Microsoft 365 and Salesforce due to traffic hairpinning. Furthermore, contractors using BYOD devices require access to specific internal web apps, but installing a full VPN client on their unmanaged devices is prohibited by policy.
Which architectural modification best addresses both the performance issue for cloud apps and the secure access requirement for contractors?
Show answer details
Correct answer: B
A SASE architecture solves the hairpinning issue by moving security inspection to the cloud edge, allowing remote workers direct, secure access to SaaS apps (like M365) without routing through headquarters. For the contractors on BYOD devices, clientless ZTNA (often delivered via a browser-based portal within the SASE framework) allows granular, application-specific access to internal web apps without requiring a VPN agent installation.
- 5
An organization is transitioning from a traditional VPN architecture to a Zero Trust Network Access (ZTNA) model. Which approach best demonstrates the principle of continuous trust when securing remote endpoints?
Show answer details
Correct answer: B
Continuous trust (or continuous adaptive risk and trust assessment - CARTA) moves away from point-in-time authentication. Instead of verifying a user or device only at the initial login, the system continuously evaluates the device's security posture, location, and user behavior throughout the session. If the risk level changes (e.g., malware is detected or the user moves to a high-risk location), access can be dynamically revoked or restricted.
- 6
A multinational financial institution is redesigning its email security architecture to combat a surge in Business Email Compromise (BEC) and ransomware delivered via malicious attachments. The current environment relies solely on the default protections provided by their cloud email provider.
The security architect must select a comprehensive design that addresses both spoofing of executive domains and zero-day malware dropping payloads.
Which combination of technologies provides the optimal architectural defense against these specific threats?
Show answer details
Correct answer: B
To combat BEC (which relies heavily on domain spoofing), DMARC with a 'p=reject' policy is the industry standard, as it ensures that emails claiming to be from the organization actually align with SPF and DKIM validations. To combat ransomware via zero-day attachments, Cisco Secure Email Threat Defense (which integrates via API to cloud providers like Microsoft 365) provides advanced malware analysis, sandboxing, and retrospective security to catch payloads that bypass native cloud email filters.
