毎月、GOWUKAKUは1500人以上の受験者が試験準備を助けて、試験に合格するために受験者にご協力します
Designing Cisco Security Infrastructure 試験
最新更新時間: 2026/09/21
【秋学習応援セール｜10月限定キャンペーン】：300-745 最新真題を買う時、日本語版と英語版両方を同時に獲得できます。
実際の問題集を練習し、試験のポイントを了解し、テストに申し込むするかどうかを決めることができます。
さらに試験準備時間の35％を節約するには、300-745 問題集を使用してください。
Question No : 1
Refer to the exhibit.
A retail company recently deployed a file inspection feature using secure endpoint. The file inspection must detect and prevent the execution of malicious files on machines. During testing, logs showed that certain malicious files are still being executed despite the presence of the security measure. To understand why the threats are not being blocked, it is essential to investigate the configuration of secure endpoint policies.
Which configuration is allowing the files to execute?
正解:
Explanation:
In the provided exhibit of the Cisco Secure Endpoint (formerly AMP for Endpoints) console, the "Activity Details" pane on the right side provides the specific reason why the malicious file was allowed to execute. The log clearly states: "The file was not quarantined. In audit only mode." This indicates that while the system correctly identified the file (iodnxvg.exe) as malicious and categorized it with a threat name (W32.DFC.MalParent), it took no preventative action because of the policy configuration.
In Cisco Secure Endpoint, policies can be set to different modes. Audit Mode is typically used during the initial deployment or testing phase to gain visibility into what would be blocked without actually disrupting business operations. In this mode, the connector logs events and alerts administrators but does not move the file to a secure quarantine area. To fulfill the requirement of preventing the execution of malicious files, the security designer must change the policy from "Audit" to a protective mode, such as Protect or Quarantine. This ensures that the engine actively intervenes when a threat signature or suspicious behavior is detected.
While the file is confirmed as malicious (negating Option A) and the system is clearly active and logging (negating Option C), the lack of enforcement is a direct result of the specific operational mode selected.
Option B is incorrect because, although network blocking is a feature, the primary failure here is at the file execution/quarantine layer. This scenario emphasizes the importance of moving from a visibility-centric posture to an enforcement-centric posture in a mature secure infrastructure design.
Question No : 2
A developer is building new API functions for a cloud-based application. Before writing the code, the developer wants to ensure that destructive actions, including deleting and updating data, are properly protected by access control identifying sensitive fields such as those that contain passwords or personally identifiable information.
Which approach must be used to score the risks proactively?
正解:
Explanation:
In a DevSecOps environment, "shifting left" means identifying risks before a single line of application code is even executed. Open API Specification (OAS) Analysis is a proactive technique where the "contract" of the API (the YAML or JSON file defining its endpoints, methods, and data structures) is audited for security flaws.
By analyzing the OAS, security tools can proactively identify if "destructive" methods―like DELETE or PATCH―lack proper authorization scopes or if sensitive fields (like PII or passwords) are being exposed in responses where they shouldn't be. This allows the developer to "score" the risk based on the API's design before moving into the implementation phase.
While SAST (Static Application Security Testing) (Option B) is vital for finding vulnerabilities in written source code, it occurs after the code is written. SBOM (Software Bill of Materials) Generation (Option
C) tracks third-party libraries but doesn't analyze API logic. CSPM (Cloud Security Posture Management) (Option D) focuses on the misconfiguration of the cloud infrastructure (like open S3 buckets) rather than the internal logic of the API itself. OAS Analysis specifically addresses the developer's need to validate access controls and sensitive data handling during the design and definition stage of API development.
Question No : 3
An oil and gas company recently faced a security breach when an employee’s notepad, which contained critical login credentials, was stolen. The incident led to unauthorized access to a user account, which posed a significant risk to sensitive company data and operations. The company wants to adopt a security measure that enhances user account protection.
Which action must be taken to prevent breaches like this from happening in the future?
正解:
Explanation:
The scenario described―where physical theft of written credentials led to a breach―is a classic failure of single-factor authentication. To mitigate this risk, the company must implement Multi-Factor Authentication (MFA). MFA requires users to provide two or more verification factors to gain access to a resource, typically categorized as something you know (password), something you have (a smartphone or hardware token), or something you are (biometrics).
According to Cisco Security Infrastructure design best practices, MFA (such as Cisco Duo) ensures that even if an attacker possesses valid credentials (the "something you know" from the stolen notepad), they cannot gain access without the second factor (the "something you have"). This effectively neutralizes the threat of stolen passwords. Single Sign-On (SSO) (Option B) improves user experience and centralizes management but does not, by itself, stop an attacker who has the master password. Updating the RADIUS server (Option C) is a maintenance task that doesn't change the authentication logic, and a password expiration policy (Option D) would only limit the "shelf life" of the stolen credentials rather than preventing their initial use. MFA is the most robust architectural control for enhancing identity security and is a core pillar of a Zero Trust framework.
Question No : 4
A legal services company wants to prevent remote employees from accessing personal email and social media accounts while using corporate laptops.
Which security solution enforces the policy?
正解:
Explanation:
In the modern landscape of remote work, a legal services company must enforce acceptable use policies (AUP) regardless of where a corporate laptop is located. Cisco Umbrella is the ideal architectural solution for this requirement. Umbrella acts as a Secure Internet Gateway (SIG) that operates primarily at the DNS and web layer. When a remote employee attempts to access a personal email site or a social media platform, Umbrella intercepts the DNS request and checks it against the organization's defined security policy.
Cisco Umbrella provides granular Content Filtering capabilities, allowing administrators to block entire categories of websites, such as "Social Networking" or "Webmail," with a single click. This enforcement happens at the edge―before a connection is even established to the malicious or unauthorized site―making it highly efficient for remote users who may not be connected to the corporate VPN. While Cisco TrustSec (Option A) and RADIUS (Option B) are powerful for internal network segmentation and authentication, they do not inherently provide the URL/domain-based categorization required to block specific web content for remote clients. A network monitoring tool (Option D) provides visibility but lacks the active enforcement mechanism to block traffic. Therefore, Cisco Umbrella is the specified technology in the SDSI objectives for cloud-delivered web security and policy enforcement for a distributed workforce.
Question No : 5
A technology company has many remote workers who access corporate resources from various locations. The company must ensure that security policies are managed and enforced directly on endpoints, and endpoints are protected from threats regardless of location.
Which firewall architecture meets the requirements?
正解:
Explanation:
As organizations shift toward a "borderless" or hybrid work model, the traditional perimeter-based security model becomes insufficient. When employees work from home, coffee shops, or airports, they are no longer behind the enterprise's physical Next-Generation Firewall (NGFW) (Option A). To ensure that security policies are enforced "regardless of location," the security must move with the device.
A host-based firewall is a software-defined firewall that resides directly on the endpoint (laptop, workstation, or server). In the Cisco ecosystem, this is often a component of Cisco Secure Client or Cisco Secure Endpoint. Because the firewall is local to the operating system, it can enforce strict inbound and outbound traffic rules even when the user is not connected to a VPN. This protects the device from lateral movement threats on untrusted local networks (like a public Wi-Fi) and ensures that only authorized applications can communicate over the network.
While an NGFW (Option A) provides superior deep packet inspection for the corporate perimeter, and a Web Application Firewall (WAF) (Option C) protects web servers from application-layer attacks, neither provides the local, location-independent protection required for a distributed remote workforce. Implementing a host-based firewall aligns with the Zero Trust architecture promoted by Cisco, where the endpoint itself becomes a micro-perimeter capable of self-protection.
Question No : 6
An IT company operates an application in a SaaS model. The administrative tasks, such as customer
onboarding, within the application must be restricted to users who are on the corporate network where admins can access those functions via a web browser or a smartphone application.
Which application technology must be used to provide granular control based on function?
正解:
Explanation:
The requirement to restrict administrative tasks like "customer onboarding" to specific users based on their job function is a classic use case for Role-Based Access Control (RBAC). In the context of application security design, RBAC is the mechanism that maps a user's identity to a specific set of permissions within the application.
According to Cisco Security Infrastructure principles, RBAC ensures the principle of least privilege by ensuring that an "Admin" role has access to onboarding functions, while a "Support" or "Standard User" role does not. This control is independent of the network layer and is enforced at the application or identity provider level. While a VPC (Option A) or Security Groups (Option C) provide network-layer isolation and can ensure the user is on the corporate network (by filtering IP ranges), they cannot distinguish between different functions or actions performed within the application once the connection is established. A Service Mesh (Option D) is used for microservices communication and can provide some authorization, but RBAC is the primary architectural approach for defining "who can do what" within an application interface. Implementing RBAC allows the SaaS provider to secure sensitive administrative workflows, ensuring that only authorized personnel can modify customer data or system configurations.
Question No : 7
Which tool is used to collect, analyze, and visualize logs from network devices, endpoints, and other sources in an enterprise?
正解:
Explanation:
In the architectural design of a modern Security Operations Center (SOC), visibility is paramount. Splunk is a leading Security Information and Event Management (SIEM) and log management platform used to aggregate data from disparate sources across the enterprise. According to the Cisco SDSI v1.0 objectives, specifically within the "Risk, Events, and Requirements" domain, a central repository for telemetry is essential for incident response and threat hunting.
Splunk collects logs, metrics, and other data from network devices (firewalls, switches, routers), endpoints (laptops, servers), and cloud applications. It then indexes this data, allowing security analysts to perform complex searches, create visualizations, and build dashboards that provide a real-time view of the organization's security posture.
While Cisco offers native tools like Cisco Secure Cloud Analytics or Cloud Observability (Option B) for specific cloud and application performance monitoring, Splunk serves as the broader "single pane of glass" for the entire infrastructure. Cisco Email Security Appliance (Option A) and Cisco Web Security Appliance (Option C) are specialized security engines that generate logs but do not function as the overarching collection and analysis platform for the entire enterprise. By integrating Cisco security products with Splunk, organizations can correlate events―such as a blocked web request from a WSA and a malware alert from a Secure Endpoint―to identify a coordinated attack, fulfilling the Cisco SAFE requirement for pervasive visibility.
Question No : 8
A manufacturing company recently experienced a network-down scenario due to malware spread on the management network. The company wants to implement a solution to detect and mitigate a similar threat in the future and protect the overall network.
Which solution meets the requirements?
正解:
Explanation:
The spread of malware across a sensitive segment like the management network highlights a failure in host-level security and internal visibility. To detect and mitigate the spread of such threats and protect the overall network, Endpoint Detection and Response (EDR) is the most effective choice among the options. In the Cisco security ecosystem, the endpoint is often the last line of defense and the most critical source of telemetry for malware incidents.
By deploying an EDR solution like Cisco Secure Endpoint, the manufacturing company gains the ability to identify the "patient zero" of the infection. EDR uses advanced features like Device Traversal and Lateral Movement detection to see how malware moves from one machine to another over the management network. Once detected, the security team can use the EDR platform to initiate a "host isolation" command, effectively cutting off the infected device's communication with the rest of the network without physically unplugging it. While Encrypted Threat Analytics (ETA) (Option C) is a powerful network-based feature for detecting malware in encrypted traffic without decryption, EDR provides the most granular control and response capabilities specifically for malware residing on and spreading between hosts. RADIUS (Option B) and IPsec VPNs (Option D) focus on access control and encryption of data in transit, respectively, but do not provide the behavioral analysis needed to stop a running malware outbreak once the network has already been accessed.
Question No : 9
Employees in a healthcare organization could not access their devices when they returned to work after the weekend. The security team discovered that a threat actor had encrypted the devices.
Which security solution would mitigate the risk in future?
正解:
Explanation:
In the scenario described, the healthcare organization fell victim to a ransomware attack, where devices were encrypted to extort the organization. To mitigate such risks in the future, Endpoint Detection and Response (EDR) is the essential architectural component. According to the Cisco SDSI Secure Infrastructure domain, protecting endpoints requires more than just traditional antivirus; it necessitates a solution that provides deep visibility into file behavior and process execution.
A robust EDR solution, such as Cisco Secure Endpoint, continuously monitors all activity on the device. When ransomware attempts to initiate its encryption process, the EDR can detect the malicious behavioral pattern in real-time. It can then take automated actions, such as isolating the infected host from the network and "stopping" the encryption process before it spreads. Furthermore, Cisco's EDR provides retrospective security, allowing administrators to see how the malware arrived and which other devices it touched. While Option A (Password Policies) helps prevent credential theft and Option C (DLP) prevents data theft, they do not stop the technical process of disk encryption. Only EDR provides the necessary detection and automated response capabilities to handle modern file-less and polymorphic malware threats effectively. This aligns with the Cisco SAFE goal of securing the endpoint layer against advanced persistent threats (APTs) and ransomware variants.
Question No : 10
How is generative AI used in securing networks?
正解:
Explanation:
The integration of Artificial Intelligence (AI) and Generative AI (GenAI) into network security is a pivotal component of the Cisco SDSI v1.0 blueprint. While traditional security mechanisms rely on deterministic rules and static signatures, GenAI leverages large-scale telemetry data to understand the baseline behavior of a specific network environment. By processing vast amounts of flow logs, packet metadata, and user activity, AI models can detect unusual patterns―often referred to as anomalies―that signify sophisticated threats such as zero-day exploits, lateral movement, or slow-and-low data exfiltration.
In a modern security architecture, GenAI enhances the "Visibility and Monitoring" domain by identifying deviations that would be invisible to human analysts. For instance, if an application suddenly changes its communication frequency or connects to a previously unknown internal segment, the AI can flag this as a potential compromise. Unlike Option A or B, which focus on operational efficiency and performance, or Option C, which is a reporting and compliance function, the use of AI for behavioral analytics directly strengthens the threat detection lifecycle. Cisco products like Secure Network Analytics (Stealthwatch) and Cognitive Intelligence use these AI capabilities to transition from reactive defense to a proactive posture, reducing the window of opportunity for attackers and aligning with the Cisco SAFE principle of continuous monitoring and pervasive visibility.
Question No : 11
How is generative AI used in securing networks?
正解:
Explanation:
The Cisco SDSI v1.0 blueprint highlights the transformative role of AI and Machine Learning in modern security operations. Generative AI and advanced behavioral analytics are primarily used to enhance Threat Detection by identifying "unknown unknowns." While traditional systems rely on static signatures, GenAI can analyze vast amounts of telemetry data to build a baseline of "normal" behavior and then detect unusual patterns that signify a zero-day attack, data exfiltration, or lateral movement.
Generative AI models can synthesize complex log data and network flows to recognize subtle deviations that a human analyst might miss. For example, if a user account suddenly accesses an unusual set of servers at an odd hour, the AI can correlate this with other minor anomalies to flag a potential compromise. While AI can assist in compliance (Option C) by summarizing reports, its primary architectural value in securing the network lies in its predictive and detective capabilities. Options A and B relate more to general network optimization and traffic engineering rather than the core security function of threat mitigation. By integrating AI-driven anomaly detection, organizations move toward a proactive security model, reducing the "mean time to detect" (MTTD) and allowing automated systems to trigger defensive responses before a threat can escalate.
Question No : 12
A global energy company moved a monolithic application from the data center to public cloud. Over
time, the company added many capabilities to the application, and it is now difficult for the application team to scale it. The application owner decided to modernize the application by moving to a Kubernetes cluster. However, he wants to ensure that the new application architecture provides a container network interface that is scalable, offers options for cloud-native security, and helps with visibility and observability.
Which solution must be used to accomplish the task?
正解:
Explanation:
In the realm of modern application security and Kubernetes networking, Cilium has emerged as the industry-standard Container Network Interface (CNI) that leverages eBPF (extended Berkeley Packet Filter) technology. For a global company modernizing a monolithic app into microservices, Cilium provides the required scalability and high-performance networking by operating directly within the Linux kernel.
Unlike traditional Security Groups (Option A) which are often limited to IP-based rules at the cloud infrastructure level, or ENIs (Option C) which are AWS-specific hardware interfaces, Cilium provides identity-aware security. It understands Kubernetes labels and metadata, allowing for granular Layer 7 policy enforcement. Furthermore, Cilium addresses the "visibility and observability" requirement through its Hubble component, which provides deep insights into network flows, application dependencies, and security events without the overhead of traditional sidecar proxies. An Ingress Gateway (Option D) manages external traffic entering the cluster but does not provide the comprehensive pod-to-pod networking, eBPF-based security, or internal observability that a CNI like Cilium offers. Designing with Cilium aligns with Cisco's focus on cloud-native security and the use of eBPF for distributed firewalling and telemetry in modern application environments.
Question No : 13
The network security team of a private university is conducting a comprehensive audit to evaluate the security posture across the network infrastructure. During the review, the security team found that a trusted vendor disclosed serious vulnerabilities identified in a product that plays a crucial role in the university’s CI/CD pipeline. The security team must act promptly to mitigate the potential risks posed by these vulnerabilities.
Which action must the security team take first in response to the disclosure?
正解:
Explanation:
According to the Cisco Security Incident Response lifecycle and the NIST SP 800-61 standards referenced in the SDSI objectives, the very first step in responding to a third-party vulnerability disclosure is Identification and Validation. Before a team can patch, notify stakeholders, or monitor for exploits, they must perform an asset inventory check to confirm whether the specific vulnerable version of the product is actually running within their environment.
In a complex CI/CD pipeline, multiple tools and versions coexist. Jumping straight to patching (Option
D) without validation can lead to unnecessary downtime or "breaking" integrated workflows if the vulnerability doesn't actually apply to the version in use. Similarly, using an IDS (Option A) is a detection/monitoring step that follows the confirmation of risk. Notifying customers (Option B) is a later phase in the incident response process, usually reserved for confirmed breaches or significant service impacts. By confirming the presence and version of the software first, the security team can accurately assess the blast radius and prioritize remediation efforts based on the actual risk to the university's specific infrastructure. This systematic approach ensures that resources are allocated efficiently and that the security posture is managed based on verified data rather than assumptions.
Question No : 14
A telecommunications company recently introduced a hybrid working model. Based on the new policy, employees can work remotely for 2 days per week if corporate equipment is used. The IT department is preparing corporate laptops to support users during the remote working days.
Which solution must the IT department implement that provides secure connectivity to corporate resources and protects sensitive corporate data even if a laptop is stolen?
正解:
Explanation:
The Cisco Secure Client (formerly AnyConnect) is the comprehensive solution designed to handle the complexities of a hybrid workforce. To meet the company's requirements, Secure Client provides a secure VPN tunnel (SSL or IPsec) that ensures all traffic between the remote laptop and corporate resources is encrypted and authenticated.
Critically, for the scenario where a laptop is stolen, Secure Client integrates with various endpoint security modules. While it primarily handles secure connectivity, it is the platform that hosts features like Always-On VPN and management of disk encryption status. According to Cisco Security Infrastructure design principles, Secure Client acts as the unified agent on the endpoint that maintains the security posture and connectivity regardless of the user's location.
While Cisco Duo (Option B) provides essential Multi-Factor Authentication (MFA) to verify the user's identity, it does not provide the encrypted tunnel for data transit. ISE Posture (Option C) is a feature (often delivered via Secure Client) that checks the health of the device but doesn't provide the connectivity itself. Umbrella (Option D) protects the user from malicious sites and provides a roaming client for DNS/web security, but it does not replace the requirement for a secure tunnel to private corporate resources. Therefore, Secure Client is the holistic solution that bridges the gap between the remote user and the corporate data center while ensuring that the device remains under the organization's security umbrella.
Question No : 15
A video game company identified a potential threat of a SYN flood attack, which could disrupt the online gaming services and impact user experience. The attack can overwhelm network resources by exploiting the TCP handshake process, leading to server unavailability and degraded performance. To safeguard the company's infrastructure and ensure uninterrupted service, it is essential to enhance the security measures in place. The company must implement a solution that manages and mitigates the risk of such network-based attacks.
Which security product must be implemented to mitigate similar risks?
正解:
Explanation:
A SYN flood attack is a classic Denial-of-Service (DoS) technique that exploits the TCP three-way handshake. By sending a massive volume of SYN packets without completing the handshake, the attacker exhausts the target server's connection table. Cisco Secure Firewall (formerly Firepower) is the architectural component designed to mitigate these network-layer threats.
Cisco Secure Firewall utilizes features such as TCP Intercept and SYN Cookies to defend against these attacks. When a SYN flood is detected, the firewall can act as a proxy for the handshake, only passing the completed connection to the backend server once the three-way handshake is verified. This prevents the server's resources from being overwhelmed by "half-open" connections.
In contrast, Cisco Web Security Appliance (Option A) is focused on web-based (HTTP/HTTPS) threats and proxying, not low-level TCP flood mitigation. Cisco Umbrella (Option B) primarily provides DNS-layer security and Secure Internet Gateway (SIG) services, which are ineffective against a direct SYN flood targeting an on-premises or cloud-hosted gaming server. Cisco Secure Endpoint (Option C) protects individual hosts from malware but cannot protect the network infrastructure or the server's TCP stack from being saturated by high-volume flood traffic. Consequently, Cisco Secure Firewall is the essential product for managing and mitigating these infrastructure-level network attacks.