A technology company has many remote workers who access corporate resources from various locations. The company must ensure that security policies are managed and enforced directly on endpoints, and endpoints are protected from threats regardless of location. Which firewall architecture meets the requirements?
Answer(s): B
As organizations shift toward a "borderless" or hybrid work model, the traditional perimeter-based security model becomes insufficient. When employees work from home, coffee shops, or airports, they are no longer behind the enterprise's physical Next-Generation Firewall (NGFW) (Option A). To ensure that security policies are enforced "regardless of location," the security must move with the device.A host-based firewall is a software-defined firewall that resides directly on the endpoint (laptop, workstation, or server). In the Cisco ecosystem, this is often a component of Cisco Secure Client or Cisco Secure Endpoint. Because the firewall is local to the operating system, it can enforce strict inbound and outbound traffic rules even when the user is not connected to a VPN. This protects the device from lateral movement threats on untrusted local networks (like a public Wi-Fi) and ensures that only authorized applications can communicate over the network.While an NGFW (Option A) provides superior deep packet inspection for the corporate perimeter, and a Web Application Firewall (WAF) (Option C) protects web servers from application-layer attacks, neither provides the local, location-independent protection required for a distributed remote workforce. Implementing a host-based firewall aligns with the Zero Trust architecture promoted by Cisco, where the endpoint itself becomes a micro-perimeter capable of self-protection.
A legal services company wants to prevent remote employees from accessing personal email and social media accounts while using corporate laptops. Which security solution enforces the policy?
Answer(s): C
In the modern landscape of remote work, a legal services company must enforce acceptable use policies (AUP) regardless of where a corporate laptop is located. Cisco Umbrella is the ideal architectural solution for this requirement. Umbrella acts as a Secure Internet Gateway (SIG) that operates primarily at the DNS and web layer. When a remote employee attempts to access a personal email site or a social media platform, Umbrella intercepts the DNS request and checks it against the organization's defined security policy.Cisco Umbrella provides granular Content Filtering capabilities, allowing administrators to block entire categories of websites, such as "Social Networking" or "Webmail," with a single click. This enforcement happens at the edge—before a connection is even established to the malicious or unauthorized site—making it highly efficient for remote users who may not be connected to the corporate VPN. While Cisco TrustSec (Option A) and RADIUS (Option B) are powerful for internal network segmentation and authentication, they do not inherently provide the URL/domain-based categorization required to block specific web content for remote clients. A network monitoring tool (Option D) provides visibility but lacks the active enforcement mechanism to block traffic. Therefore, Cisco Umbrella is the specified technology in the SDSI objectives for cloud-delivered web security and policy enforcement for a distributed workforce.
An oil and gas company recently faced a security breach when an employee’s notepad, which contained critical login credentials, was stolen. The incident led to unauthorized access to a user account, which posed a significant risk to sensitive company data and operations. The company wants to adopt a security measure that enhances user account protection. Which action must be taken to prevent breaches like this from happening in the future?
Answer(s): A
The scenario described—where physical theft of written credentials led to a breach—is a classic failure of single-factor authentication. To mitigate this risk, the company must implement Multi-Factor Authentication (MFA). MFA requires users to provide two or more verification factors to gain access to a resource, typically categorized as something you know (password), something you have (a smartphone or hardware token), or something you are (biometrics).According to Cisco Security Infrastructure design best practices, MFA (such as Cisco Duo) ensures that even if an attacker possesses valid credentials (the "something you know" from the stolen notepad), they cannot gain access without the second factor (the "something you have"). This effectively neutralizes the threat of stolen passwords. Single Sign-On (SSO) (Option B) improves user experience and centralizes management but does not, by itself, stop an attacker who has the master password. Updating the RADIUS server (Option C) is a maintenance task that doesn't change the authentication logic, and a password expiration policy (Option D) would only limit the "shelf life" of the stolen credentials rather than preventing their initial use. MFA is the most robust architectural control for enhancing identity security and is a core pillar of a Zero Trust framework.
A developer is building new API functions for a cloud-based application. Before writing the code, the developer wants to ensure that destructive actions, including deleting and updating data, are properly protected by access control identifying sensitive fields such as those that contain passwords or personally identifiable information. Which approach must be used to score the risks proactively?
In a DevSecOps environment, "shifting left" means identifying risks before a single line of application code is even executed. Open API Specification (OAS) Analysis is a proactive technique where the "contract" of the API (the YAML or JSON file defining its endpoints, methods, and data structures) is audited for security flaws.By analyzing the OAS, security tools can proactively identify if "destructive" methods—like DELETE or PATCH—lack proper authorization scopes or if sensitive fields (like PII or passwords) are being exposed in responses where they shouldn't be. This allows the developer to "score" the risk based on the API's design before moving into the implementation phase.While SAST (Static Application Security Testing) (Option B) is vital for finding vulnerabilities in written source code, it occurs after the code is written. SBOM (Software Bill of Materials) Generation (Option C) tracks third-party libraries but doesn't analyze API logic. CSPM (Cloud Security Posture Management) (Option D) focuses on the misconfiguration of the cloud infrastructure (like open S3 buckets) rather than the internal logic of the API itself. OAS Analysis specifically addresses the developer's need to validate access controls and sensitive data handling during the design and definition stage of API development.
Refer to the exhibit.A retail company recently deployed a file inspection feature using secure endpoint. The file inspection must detect and prevent the execution of malicious files on machines. During testing, logs showed that certain malicious files are still being executed despite the presence of the security measure. To understand why the threats are not being blocked, it is essential to investigate the configuration of secure endpoint policies. Which configuration is allowing the files to execute?
Answer(s): D
In the provided exhibit of the Cisco Secure Endpoint (formerly AMP for Endpoints) console, the "Activity Details" pane on the right side provides the specific reason why the malicious file was allowed to execute. The log clearly states: "The file was not quarantined. In audit only mode." This indicates that while the system correctly identified the file (iodnxvg.exe) as malicious and categorized it with a threat name (W32.DFC.MalParent), it took no preventative action because of the policy configuration.In Cisco Secure Endpoint, policies can be set to different modes. Audit Mode is typically used during the initial deployment or testing phase to gain visibility into what would be blocked without actually disrupting business operations. In this mode, the connector logs events and alerts administrators but does not move the file to a secure quarantine area. To fulfill the requirement of preventing the execution of malicious files, the security designer must change the policy from "Audit" to a protective mode, such as Protect or Quarantine. This ensures that the engine actively intervenes when a threat signature or suspicious behavior is detected.While the file is confirmed as malicious (negating Option A) and the system is clearly active and logging (negating Option C), the lack of enforcement is a direct result of the specific operational mode selected. Option B is incorrect because, although network blocking is a feature, the primary failure here is at the file execution/quarantine layer. This scenario emphasizes the importance of moving from a visibility-centric posture to an enforcement-centric posture in a mature secure infrastructure design.
Post your Comments and Discuss Cisco 300-745 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 300-745 content, but please register or login to continue.