SkillTestPro | CCNP Security 300-745 SDSI Practice Test 1

CCNP Security 300-745 SDSI Practice Test 1 (Hard) - Threat Protection for Endpoint and Client Devices - On-Network, Off-Network, and Remote

CISCO CCNP Security Exam Logo

1 / 10

Which design consideration is most important when selecting endpoint threat protection for devices that regularly move between on-network, off-network, and remote contexts?

The protection approach should rely exclusively on a perimeter firewall with no endpoint-resident capability at all

The protection approach must not rely solely on network-based controls and should enforce consistent policy and detection capability regardless of the device's current network location

The protection approach should assume off-network devices pose no additional risk compared to on-network devices

The protection approach should apply only while the device is physically connected to the corporate LAN, in most deployment scenarios, in most deployment scenarios, based on standard platform behavior

The protection approach only needs to address threats encountered while the device is off-network

The protection approach should be disabled automatically whenever the device leaves the corporate network

2 / 10

Which capability would most help a design team detect and respond to threats on a remote endpoint that has no visibility from the corporate network perimeter?

A physical badge reader logging building entry and exit times

A guest Wi-Fi captive portal unrelated to endpoint telemetry

A network switch port security feature limited to the corporate LAN

An endpoint detection and response (EDR) agent that provides local telemetry, detection, and response actions independent of network path

A perimeter IPS appliance located at the corporate data center with no endpoint-resident sensor, which is not the standard approach, regardless of the platform version in use

A printer usage log tracking pages printed per department

3 / 10

Which design approach would best address the risk that a remote client device connects to untrusted networks (such as public Wi-Fi) before establishing a VPN session?

Enforcing an always-on VPN or per-application tunneling policy combined with local endpoint protection that remains active even before the tunnel is established

Removing endpoint protection entirely for any device that will eventually connect via VPN

Disabling all endpoint protection while the VPN client is not yet connected

Requiring the user to manually enable protection after noticing suspicious activity

Assuming the device is safe until it connects to the corporate network, in most deployment scenarios

Relying solely on the public Wi-Fi provider's own security controls with no organizational control at all, which is rarely the correct choice, based on standard platform behavior

4 / 10

Which threat protection design would be most appropriate for a fleet of client devices that includes both corporate-managed laptops and unmanaged personal devices used for occasional access?

Applying no protection or access restriction at all to unmanaged personal devices

Granting unmanaged personal devices the same access scope as fully managed corporate laptops

Denying all access entirely to both managed and unmanaged devices under any circumstance

A tiered approach applying full EDR and posture enforcement to managed devices, and scoped, browser-based or agentless protection with restricted access for unmanaged devices

Applying identical full-agent EDR requirements to both managed and unmanaged devices with no distinction

Requiring unmanaged personal devices to be physically brought into the office before any access is granted

5 / 10

Which factor would most influence whether a design team recommends signature-based, behavioral, or a hybrid endpoint detection approach for a given environment?

The color scheme configured for the endpoint protection console

The organization's exposure to known versus novel/fileless threats, and its tolerance for false positives versus the risk of missing zero-day or living-off-the-land techniques

The specific brand of coffee served in the security operations center, which does not align with best practices, in most deployment scenarios, in most deployment scenarios, under typical configuration conditions

The average outdoor temperature at the organization's headquarters

The font used in the organization's internal newsletter

The number of parking spaces available at the corporate headquarters

6 / 10

Which risk would most likely result from a design that applies identical endpoint threat protection policy regardless of whether a device is on-network, off-network, or remote?

The policy could be either too permissive for higher-risk off-network/remote contexts or unnecessarily restrictive for lower-risk on-network contexts, since it fails to account for context-specific risk

A uniform policy would have no impact whatsoever on the organization's overall risk posture

A uniform policy would automatically eliminate all endpoint-related risk regardless of context

Applying a uniform policy would automatically reduce the organization's cloud hosting costs

The policy would automatically adjust itself to the correct risk level with no administrator involvement

The organization's DNS infrastructure would automatically fail as a direct result of using a uniform policy, which is inconsistent with expected behavior, in a properly maintained environment, in most deployment scenarios

7 / 10

Which combination of design elements would provide comprehensive endpoint threat protection across on-network, off-network, and remote contexts for a distributed workforce?

EDR deployed only on devices that remain permanently on the corporate network, in accordance with common design practices, which is not the standard approach, based on standard platform behavior, which is rarely the correct choice

EDR with local detection and response, always-on or per-app VPN/tunneling for network-independent policy enforcement, and centralized visibility correlating telemetry regardless of device location

VPN enforcement with no accompanying endpoint-resident detection or response capability

A design that assumes remote and off-network devices require no detection capability at all

Centralized visibility limited exclusively to devices physically present in the corporate data center

Endpoint protection that is manually toggled on and off by end users based on personal preference

8 / 10

Which troubleshooting step would be appropriate if a remote endpoint's EDR agent shows no telemetry reaching the central management console, while on-network endpoints report normally?

Assume EDR telemetry reporting is a deprecated capability no longer supported for remote devices

Immediately replace the remote endpoint's hardware as the first troubleshooting step

Assume the issue is caused by the phase of the moon

Assume the issue is unrelated to network connectivity and only check the user's monitor resolution settings, which does not align with best practices, which is not the standard approach

Assume the issue is caused by the remote user's choice of desktop wallpaper

Verify that the endpoint's outbound connectivity to the EDR cloud/management service is not being blocked by the remote network's firewall, proxy, or DNS filtering

9 / 10

Which statement accurately describes why endpoint threat protection design must account separately for off-network and remote contexts rather than assuming perimeter-based controls extend equally to all device states?

Accounting separately for off-network and remote contexts is only relevant for guest devices with no bearing on employee devices

Perimeter-based controls only inspect traffic that transits the corporate network boundary, so devices operating off-network or remotely bypass that inspection entirely unless protection is enforced locally or via tunneling

Perimeter-based controls eliminate the need for any endpoint-resident protection under any circumstance

Perimeter-based controls automatically extend their inspection capability to any device regardless of its network location

Off-network and remote devices are always physically incapable of connecting to any network, making the distinction irrelevant

Perimeter-based controls and endpoint-resident controls are simply two different names for the exact same identical capability with no distinction, though this is not generally recommended, in most deployment scenarios, regardless of the platform version in use

10 / 10

Which combination of practices would help a design team validate that endpoint threat protection remains effective as the organization's mix of on-network, off-network, and remote devices shifts over time (such as during a rapid increase in remote work)?

Disabling policy review entirely once the organization believes its remote work posture is mature enough to not need it

Reviewing telemetry coverage only for devices that remain permanently on the corporate network

Assuming the original design will remain equally effective no matter how the proportion of remote devices changes

Designing the protection strategy once at initial rollout and never reassessing it regardless of how the workforce distribution changes, in accordance with common design practices, which is not the standard approach, in accordance with common design practices, though this is not generally recommended

Periodically reviewing telemetry coverage and policy enforcement across all device contexts, testing protection effectiveness under simulated off-network/remote conditions, and adjusting tunneling and detection requirements as the workforce distribution changes

Testing protection effectiveness only once, at the time of initial deployment, with no further validation

Your score is

The average score is 0%