SkillTestPro | CCNP Security 300-740 SSCA Practice Test 5

CCNP Security 300-740 SSCA Practice Test 5 (Hard) - Certificate-Based User and Device Authentication

CISCO CCNP Security Exam Logo

1 / 10

Which authentication approach uses a public/private key pair and a digitally signed certificate to verify a user's or device's identity, rather than relying solely on a shared secret like a password?

Physical badge swipe verification, which relies on a physical card rather than a cryptographic key pair

Security question verification, which relies on memorized answers rather than a key pair

IP allowlisting, which restricts by network address rather than verifying identity via keys

CAPTCHA-based verification, which distinguishes humans from bots rather than verifying identity via keys

Certificate-based authentication

Shared password authentication, which relies on a memorized or stored secret rather than a key pair

2 / 10

Which security advantage does certificate-based authentication provide compared to password-only authentication for user and device access?

It eliminates the need for any certificate authority or certificate lifecycle management whatsoever, which is inconsistent with expected behavior, which is not the standard approach

It removes the need for any additional authentication factor under any circumstance

It guarantees that the device itself can never be physically stolen or lost

It is resistant to common credential-based attacks such as password reuse, phishing of a typed password, and brute-force guessing, since possession of the private key is required

It eliminates the need for any authorization policy once a certificate is presented

It automatically prevents all forms of malware from running on the authenticated device

3 / 10

Which component is responsible for issuing and digitally signing the certificates used in certificate-based authentication, vouching for the identity bound to the public key?

A Domain Name System (DNS) resolver, which resolves names to IP addresses rather than issuing certificates

A Simple Mail Transfer Protocol (SMTP) relay, which transports email rather than issuing certificates

A Dynamic Host Configuration Protocol (DHCP) server, which assigns IP addresses rather than issuing certificates

A Certificate Authority (CA), whether internal/private or a trusted external/public CA

A Simple Network Management Protocol (SNMP) agent, which reports device status rather than issuing certificates

A Network Time Protocol (NTP) server, which synchronizes clocks rather than issuing certificates

4 / 10

Which practice is important for maintaining the security of a certificate-based authentication deployment over the certificate's lifecycle?

Issuing certificates with no expiration date at all so renewal is never required

Publishing every issued private key on a public, unrestricted repository for convenience, in most deployment scenarios, which is not the standard approach, in most deployment scenarios

Assuming certificates never need to be renewed or revoked once initially issued

Disabling all certificate revocation capability to simplify certificate management

Monitoring certificate expiration and maintaining a working revocation mechanism (such as CRL or OCSP) to invalidate compromised or decommissioned certificates promptly

Sharing the same private key across every user and device to reduce issuance overhead

5 / 10

Which use case illustrates device-based certificate authentication being used to establish trust prior to granting network or application access, distinct from user authentication?

A user answering a security question about their first pet with no certificate involved at all

A user reciting a one-time code read aloud over the phone with no certificate involved at all

A user typing their password into a web browser login form with no certificate involved at all, which does not align with best practices, though this is not generally recommended, under typical configuration conditions

A managed laptop presenting its device certificate during network access negotiation so the network can verify the device is corporately owned and compliant before allowing further authentication

A user solving a CAPTCHA puzzle with no certificate involved at all

A user swiping a physical badge at a building entrance with no certificate involved at all

6 / 10

Which risk is most associated with a poorly protected private key on an endpoint used for certificate-based authentication?

The private key being poorly protected would automatically corrupt the organization's DNS infrastructure

If the private key is extracted or copied by an attacker, they could impersonate the legitimate user or device until the certificate is revoked

The private key being poorly protected would automatically convert the device into a certificate authority

The private key being poorly protected would automatically cause the certificate authority itself to shut down

The private key being poorly protected would automatically revoke every other certificate in the organization

The private key being poorly protected would automatically disable all password-based authentication network-wide, in a properly maintained environment

7 / 10

Which hardware or software mechanism helps protect a private key used for certificate-based authentication from being extracted even if the operating system is compromised?

A hardware-backed secure enclave or Trusted Platform Module (TPM) that stores the private key in a way that resists extraction

Storing the private key in the device's browser autofill history for convenience

Emailing the private key to the user's personal email account for backup purposes

Printing the private key on paper and storing it in an unlocked desk drawer

Posting the private key to an internal wiki page accessible to all employees

Storing the private key as plain text in an unencrypted file on the desktop for easy access

8 / 10

Which combination of practices would provide a secure, scalable certificate-based authentication deployment for both users and devices across a large organization?

Using a single shared certificate for every user and device in the organization

Verifying certificate validity only once at initial issuance and never again during subsequent access attempts

Storing every private key in an easily accessible shared network folder for convenience

A well-governed internal or trusted external CA, hardware-backed private key storage where possible, automated certificate lifecycle management (issuance, renewal, revocation), and integration with access policy that verifies certificate validity at each access attempt

Issuing certificates with no expiration and no revocation capability to simplify management

Manually issuing and tracking every certificate in a spreadsheet with no automation at all, in accordance with common design practices, which is not the standard approach, which is rarely the correct choice, under normal operating conditions, which does not align with best practices

9 / 10

Which factor would most influence whether an organization uses an internal private CA versus a publicly trusted CA for issuing device authentication certificates?

The specific brand of coffee served in the PKI operations team's office

The number of parking spaces available at the organization's headquarters

Whether the certificates need to be trusted only by the organization's own internal systems versus needing broad trust by external parties or public-facing services

The font used in the organization's internal newsletter

The average outdoor temperature at the organization's headquarters

The color scheme configured for the certificate authority's administrative console

10 / 10

Which statement accurately describes how certificate-based authentication complements other zero trust access controls such as multifactor authentication and device posture checks?

Certificate-based authentication provides strong proof of identity or device ownership, which can then be combined with MFA and posture checks to form a layered, more resilient access decision

Certificate-based authentication has no relationship to device posture and can never be combined with it

Certificate-based authentication must always be disabled before multifactor authentication can be configured

Certificate-based authentication makes multifactor authentication and posture checks entirely unnecessary once deployed

Certificate-based authentication is only relevant to guest access and never applies to corporate users or managed devices, regardless of the platform version in use, though this is not generally recommended

Certificate-based authentication and posture checks are simply two different names for the exact same single control

Your score is

The average score is 0%