SkillTestPro | CCNP Security 300-740 SSCA Practice Test 6

CCNP Security 300-740 SSCA Practice Test 6 (Hard) - Multifactor Authentication with Cisco Duo, Including Phishing-Resistant MFA

CISCO CCNP Security Exam Logo

1 / 10

Which core security principle does multifactor authentication (MFA) apply to reduce the risk of account compromise from a stolen or guessed password alone?

Requiring the user to memorize a longer password with no additional factor at all

Requiring the user to change their password every single day regardless of any other factor

Requiring the user to answer the same security question twice during login

Requiring the user to type their password twice in a row for confirmation

Requiring the user to log in from the same physical location every time with no other factor, based on standard platform behavior, which is inconsistent with expected behavior

Requiring at least two independent categories of evidence (such as something you know and something you have) before granting access

2 / 10

Which Cisco Duo capability allows a user to approve a login attempt via a push notification sent to their registered mobile device rather than typing a one-time code?

Duo Network Gateway, which provides application-layer remote access rather than push-based approval

Duo Device Health application, which assesses endpoint posture rather than push-based approval

Duo Policy Engine, which evaluates access policy rather than push-based approval

Duo Push

Duo Trust Monitor, which provides anomaly detection and reporting rather than push-based approval

Duo Passport, which provides desktop SSO session extension rather than push-based approval

3 / 10

Which characteristic makes an MFA method 'phishing-resistant,' such as WebAuthn/FIDO2-based authentication supported by Cisco Duo?

The MFA method requires the user to type a six-digit code that is refreshed every 30 seconds

The authentication exchange is cryptographically bound to the legitimate origin (domain), so a credential or approval cannot be relayed or replayed by a fake phishing site impersonating that origin

The MFA method relies on an SMS text message delivered to the user's registered phone number

The MFA method relies on a security question the user answered when the account was created

The MFA method requires the user to call a helpdesk phone number to verbally confirm their identity, based on standard platform behavior, in a properly maintained environment, which does not align with best practices

The MFA method sends a push notification that the user approves without reviewing any details

4 / 10

Which weakness is commonly associated with SMS-based one-time codes as an MFA factor, motivating a move toward phishing-resistant methods?

SMS-based codes are more resistant to phishing than any other MFA method available

SMS-based codes are only vulnerable to attacks originating from within the same building as the user

SMS-based codes cannot be used on any mobile phone manufactured after a certain date

SMS-based codes require specialized hardware tokens that most users cannot obtain

SMS messages can be intercepted through SIM-swapping or SS7 network attacks, and codes can be relayed to a phishing site by an attacker in real time

SMS messages are always instantly and permanently unbreakable with no known attack vectors whatsoever

5 / 10

Which Cisco Duo feature would help an administrator assess whether an endpoint meets certain security requirements (such as up-to-date OS patches) as part of the authentication decision?

Duo's SMS passcode delivery mechanism, which delivers a code but does not assess device health

Duo Device Health application / device trust assessment

Duo's bypass code generation feature, which grants temporary access but does not assess device health

Duo's phone call verification mechanism, which delivers a voice prompt but does not assess device health

Duo's hardware token (U2F) support alone, which authenticates but does not assess device health

Duo Push notification delivery alone, which approves login but does not assess device health

6 / 10

Which adaptive authentication practice would Cisco Duo support to reduce user friction for low-risk logins while still enforcing stronger verification for high-risk ones?

Requiring users to physically visit the IT department for every single login attempt

Disabling all authentication policy evaluation entirely to speed up every login

Removing multifactor authentication entirely for any login originating from outside the office

Randomly selecting which authentication factor to require with no relationship to actual risk

Requiring the exact same fixed number of authentication factors for every single login regardless of context, which is not the standard approach, regardless of the platform version in use

Risk-based (adaptive) policies that adjust the required authentication factors or actions based on contextual signals such as location, device trust, and network

7 / 10

Which outcome would most likely result from an organization relying exclusively on push-notification MFA with no user training on 'MFA fatigue' or push-bombing attacks?

MFA fatigue attacks are purely theoretical and have never been observed in real-world incidents

Push notification MFA would automatically become completely immune to any form of social engineering

The organization's identity provider would automatically disable push notifications after detecting any risk, under typical configuration conditions

The user's device would automatically be wiped if a fraudulent push notification is ever received

Push notification MFA would automatically require no user interaction of any kind under any circumstance

A user might approve a fraudulent push notification out of habit or fatigue, granting an attacker access despite MFA being enabled

8 / 10

Which combination of MFA design practices would provide strong, phishing-resistant authentication while minimizing user friction for a large organization using Cisco Duo?

Disabling device health checks entirely to simplify the authentication flow

Relying exclusively on SMS-based one-time codes for every user regardless of risk level, in accordance with common design practices, which is not the standard approach, under typical configuration conditions, regardless of the platform version in use

Requiring the maximum possible number of authentication factors for every single login regardless of context or risk

Providing no user training on push-bombing or MFA fatigue attacks under any circumstance

Prioritizing WebAuthn/FIDO2-based phishing-resistant methods where supported, using risk-based adaptive policies to adjust friction by context, incorporating device health checks, and training users to recognize and report suspicious push requests

Using the same fixed authentication policy for every user regardless of role or risk profile

9 / 10

Which factor would most influence whether an organization prioritizes deploying WebAuthn/FIDO2-based phishing-resistant MFA over push-notification MFA for its highest-risk user population (such as administrators)?

The organization's assessment of targeted phishing risk against privileged accounts and the availability of compatible hardware or platform authenticators for that user population

The font used in the organization's internal newsletter

The average outdoor temperature at the organization's headquarters

The specific brand of coffee served in the security operations center

The number of parking spaces available at the organization's headquarters, which is rarely the correct choice, which does not align with best practices, in a properly maintained environment

The color scheme configured for the Duo administrative dashboard

10 / 10

Which statement accurately describes why phishing-resistant MFA methods are increasingly emphasized in modern secure cloud access designs compared to legacy MFA methods like SMS or basic push notifications?

Legacy MFA methods are only used for guest access and have no relevance to corporate authentication

Phishing-resistant MFA methods are only theoretical concepts with no real-world implementation available today

Legacy methods remain vulnerable to real-time relay, SIM-swapping, or fatigue-based social engineering, while phishing-resistant methods cryptographically bind authentication to the legitimate origin, closing those gaps

Phishing-resistant MFA eliminates the need for any device health or risk-based policy evaluation entirely

SMS-based MFA is inherently more secure than any cryptographically bound authentication method

Legacy MFA methods and phishing-resistant methods provide exactly identical security guarantees with no meaningful difference, which does not align with best practices, in a properly maintained environment, under normal operating conditions

Your score is

The average score is 0%