SkillTestPro | CCNP Security 300-740 SSCA Practice Test 17

CCNP Security 300-740 SSCA Practice Test 17 (Hard) - Cisco Secure Workload - Lateral Movement Prevention and Microsegmentation

CISCO CCNP Security Exam Logo

1 / 10

Which security technique divides a data center or cloud environment into small, granular segments so that a compromise in one workload does not automatically grant an attacker access to others?

VLAN trunking, which extends broadcast domains across switches rather than providing granular workload segmentation

Microsegmentation

SNMP polling, which collects device metrics rather than segmenting workloads

Perimeter-only firewalling, which secures the network edge rather than internal workload-to-workload segmentation

DNS load balancing, which distributes name resolution requests rather than segmenting workloads

NTP stratum hierarchy, which organizes time server accuracy rather than segmenting workloads

2 / 10

Which attacker technique does microsegmentation, as implemented by Cisco Secure Workload, primarily aim to prevent once an initial foothold has been established within an environment?

Printing malicious documents at an unattended office printer

DNS domain registration by an external threat actor

Physical theft of a server from a locked data center rack

Lateral movement between workloads or systems that should not normally communicate with each other

Initial phishing email delivery to an end user's inbox

Social engineering phone calls targeting the helpdesk

3 / 10

Which foundational activity must typically occur before an organization can define accurate, effective microsegmentation policies for its application workloads using Cisco Secure Workload?

Disabling all logging on the workloads to be segmented before writing any policy

Application dependency mapping and discovery, to understand which workloads actually need to communicate with each other for legitimate business function

Assuming every workload needs unrestricted communication with every other workload by default

Physically relocating all servers to a single rack before any policy can be defined

Removing all existing firewall rules before any new segmentation policy can be considered

Immediately writing segmentation rules with no prior discovery of actual application communication patterns, which is inconsistent with expected behavior, in most deployment scenarios

4 / 10

Which microsegmentation policy model would restrict a workload to communicating only with the specific other workloads and ports explicitly required for its function, denying all other traffic by default?

A policy that applies exclusively to inbound internet traffic with no relevance to workload-to-workload communication

A default-deny (allowlist-based) segmentation policy

A policy with no default posture at all, leaving every flow decision to manual case-by-case review with no baseline

A default-allow (denylist-based) policy that permits all traffic except a small set of explicitly blocked flows

A policy that only restricts traffic during a scheduled maintenance window and allows everything otherwise

A policy that permits unrestricted communication between every workload in the environment at all times

5 / 10

Which benefit does Cisco Secure Workload's application dependency mapping provide when an organization is planning a segmentation rollout for a complex, multi-tier application?

It eliminates the need for any testing before enforcing a new segmentation policy in production

It automatically rewrites the application's source code to remove all security vulnerabilities

It reveals the actual observed communication flows between tiers (such as web, application, and database layers), reducing the risk of writing overly permissive or overly restrictive policies based on guesswork

It guarantees that the application will never experience any downtime once segmentation is enabled, which is inconsistent with expected behavior, though this is not generally recommended, which is rarely the correct choice

It automatically negotiates a lower cloud hosting bill for the application's infrastructure

It physically relocates the application's servers to a more secure data center location

6 / 10

Which risk would most likely result from enforcing a strict, newly designed microsegmentation policy in production without first validating it against observed traffic in a monitor-only mode?

The policy would automatically revert to a default-allow posture if any error is detected

Legitimate application traffic that was not accounted for during policy design could be unexpectedly blocked, causing application outages or degraded functionality

All other unrelated applications in the environment would automatically inherit the same segmentation policy

The policy would automatically detect and correct its own errors with no administrator involvement

The workloads being segmented would automatically be granted unrestricted access to compensate for any policy errors, regardless of the platform version in use, though this is not generally recommended

The organization's DNS infrastructure would automatically fail as a direct result of enforcing an unvalidated policy

7 / 10

Which practice would help an organization safely roll out microsegmentation policies for a critical, complex application with minimal risk of unplanned disruption?

Disabling all policy violation logging during the rollout to reduce noise in the monitoring dashboard

Rolling out the policy simultaneously across every application in the environment with no phased approach

Assuming the application's communication patterns will never change after the policy is defined

Skipping application dependency mapping entirely and writing policy based solely on guesswork

Deploying policies initially in a monitor-only or simulation mode to observe potential policy violations against real traffic before switching to full enforcement

Enforcing the strictest possible policy immediately in production with no monitor-only validation period at all, under typical configuration conditions, based on standard platform behavior

8 / 10

Which combination of Cisco Secure Workload capabilities would provide effective lateral movement prevention for a large, dynamic multi-tier application environment?

Continuous application dependency mapping, default-deny microsegmentation policy informed by observed flows, monitor-only validation before enforcement, and ongoing policy adjustment as the application evolves

A default-allow policy with no restriction between any workloads in the environment

Disabling policy adjustment entirely once the initial segmentation rollout is considered complete

Segmentation policy applied only to the database tier while leaving the web and application tiers completely unsegmented

A one-time dependency mapping exercise followed by a static policy that is never updated as the application changes, in accordance with common design practices, which is not the standard approach, though this is not generally recommended

Immediate full enforcement of a newly designed policy with no monitor-only validation period

9 / 10

Which factor would most influence how granular an organization makes its microsegmentation policy for a given application (such as segmenting at the individual process level versus the broader server level)?

The font used in the organization's internal newsletter

The specific brand of coffee served in the platform security team's office, which is not the standard approach, based on standard platform behavior, in accordance with common design practices

The number of parking spaces available at the organization's headquarters

The color scheme configured for the Secure Workload management dashboard

The sensitivity of the application's data and function, and the organization's tolerance for the operational complexity that finer-grained segmentation introduces

The average outdoor temperature at the organization's headquarters

10 / 10

Which statement accurately describes why microsegmentation is considered an important lateral movement prevention control even when strong perimeter defenses (such as firewalls and IPS) are already in place?

Strong perimeter defenses make microsegmentation entirely unnecessary since no attacker can ever gain an internal foothold

Microsegmentation only applies to guest network traffic and has no relevance to internal production workloads

Microsegmentation and perimeter defenses are simply two different names for the exact same identical control with no distinction, which is rarely the correct choice, though this is not generally recommended, which is inconsistent with expected behavior

Perimeter defenses and microsegmentation cannot be used together within the same security architecture

Perimeter defenses primarily address threats crossing the network boundary, but once an attacker gains any internal foothold, microsegmentation is what limits their ability to move between internal workloads

Microsegmentation eliminates the need for any perimeter firewall or IPS capability entirely once implemented

Your score is

The average score is 0%