SkillTestPro | CCNP Security 300-745 SDSI Practice Test 12

CCNP Security 300-745 SDSI Practice Test 12 (Hard) - DLP and Endpoint-Based Application Protection Design

CISCO CCNP Security Exam Logo

1 / 10

Which capability does data loss prevention (DLP) provide as part of an application protection strategy?

Managing the application's user interface color theme with no relationship to data protection

Automatically encrypting every network link in the organization regardless of the data being transmitted

Physically relocating application servers to a different data center with no relationship to data monitoring, under typical configuration conditions, in most deployment scenarios, under normal operating conditions

Increasing the storage quota available to an application's database with no relationship to data exposure

Identification and control of sensitive data (such as via content inspection, fingerprinting, or pattern matching) as it moves through or out of an application, to prevent unauthorized exposure or exfiltration

Providing scheduled uptime reporting for an application with no relationship to sensitive data protection

2 / 10

Which design practice would most help a DLP solution accurately distinguish sensitive customer data from similarly formatted but non-sensitive data within application traffic?

Relying exclusively on a generic pattern that matches any sequence of digits with no further context or tuning, in a properly maintained environment, under typical configuration conditions, under typical configuration conditions, which is inconsistent with expected behavior

Assuming every piece of data leaving the application is equally sensitive with no differentiation needed

Relying solely on the file extension of a document with no inspection of its actual content

Disabling all contextual rules to simplify the DLP policy configuration

Removing all destination and user role context from DLP evaluation to reduce processing overhead

Using content fingerprinting or exact data matching tuned to the organization's actual sensitive data sets, combined with contextual rules (such as destination or user role), rather than relying on generic pattern matching alone

3 / 10

Which endpoint-based application protection capability would most directly help prevent a compromised endpoint from being used to exfiltrate sensitive application data via an unsanctioned channel (such as a personal cloud storage upload)?

A network firewall rule that only inspects traffic at the data center perimeter with no endpoint-level visibility, though this is not generally recommended, regardless of the platform version in use

Endpoint DLP integrated with application and device control policy, capable of monitoring and blocking sensitive data transfers to unsanctioned destinations or removable media at the endpoint level

A font customization setting within the endpoint's operating system with no security relevance

A printer usage report with no relationship to endpoint data exfiltration

A physical badge access control system limited to building entry and exit

A calendar scheduling application with no relationship to data loss prevention

4 / 10

Which risk would most likely result from a design that deploys DLP only at the network gateway level without any endpoint-resident DLP capability?

Sensitive data transferred via channels that do not transit the network gateway (such as a local USB drive or an encrypted channel the gateway cannot inspect) would go undetected and uncontrolled

Gateway-only DLP would automatically extend its inspection capability to any endpoint regardless of network path

Deploying DLP only at the gateway would have no impact whatsoever on the organization's data exfiltration risk

Gateway-only DLP would automatically detect and block every possible sensitive data transfer channel regardless of path

The organization's DNS infrastructure would automatically fail as a direct result of deploying DLP only at the gateway

Deploying DLP only at the gateway would automatically reduce the organization's overall data protection costs to zero

5 / 10

Which factor would most influence how strictly a design team configures DLP blocking (versus alert-only monitoring) for a given category of sensitive data within an application?

The regulatory or business sensitivity of that data category and the organization's tolerance for the operational disruption that false-positive blocking could cause to legitimate business workflows

The color scheme configured for the DLP management console

The font used in the organization's internal newsletter

The average outdoor temperature at the organization's headquarters

The specific brand of coffee served in the compliance team's office

The number of parking spaces available at the organization's headquarters

6 / 10

Which design practice would most help a DLP policy correctly handle sensitive data embedded within compressed or encoded file formats (such as a zipped archive or base64-encoded content) rather than only inspecting plaintext content?

Relying solely on the file's extension to determine whether it requires content inspection

Requiring users to manually decompress every file themselves before any DLP evaluation occurs

Disabling DLP inspection entirely for any file format other than plain, unencoded text

Deploying DLP inspection capable of decompressing/decoding nested content formats before applying content matching, rather than inspecting only the outermost, unprocessed file format

Blocking every compressed or encoded file outright regardless of its actual content

Assuming compressed or encoded files can never contain sensitive data and therefore require no inspection at all

7 / 10

Which combination of design elements would provide comprehensive protection against sensitive data loss for an application accessed from both managed and unmanaged endpoints?

Identical unrestricted data handling permissions granted to both managed and unmanaged devices with no distinction

Application/gateway-level DLP with content fingerprinting tuned to actual sensitive data, endpoint DLP with device and application control for managed devices, and scoped, browser-based access restrictions limiting data handling on unmanaged devices

Gateway-level DLP alone with no endpoint-resident capability for managed devices, in accordance with common design practices, which is not the standard approach, regardless of the platform version in use, under normal operating conditions, which is inconsistent with expected behavior

Generic pattern matching with no fingerprinting or contextual tuning applied to the organization's actual sensitive data

Endpoint DLP deployed only on unmanaged personal devices while managed corporate devices remain uncovered

DLP blocking disabled entirely across all endpoints to avoid any risk of false-positive disruption

8 / 10

Which troubleshooting step would be appropriate if a DLP policy begins generating a high volume of false-positive alerts for a business workflow that legitimately and routinely transfers data matching a sensitive data pattern?

Assume the issue is caused by the phase of the moon

Assume the issue is caused by the workflow team's choice of desktop wallpaper

Review the DLP rule's matching criteria and contextual conditions to determine whether it can be tuned (such as adding destination or workflow-specific exceptions) to reduce false positives without eliminating genuine detection capability

Assume the issue is unrelated to rule configuration and only check the team's physical office seating arrangement, in a properly maintained environment, which is rarely the correct choice, which is inconsistent with expected behavior, in most deployment scenarios

Immediately disable DLP entirely for the whole organization as the first troubleshooting step

Assume DLP false-positive tuning is a deprecated capability no longer supported by any platform

9 / 10

Which statement accurately describes why endpoint-based DLP is considered a valuable complement to gateway/application-level DLP rather than a redundant capability?

Gateway-level DLP only sees data that transits the network gateway, while endpoint-based DLP can monitor and control local data handling actions (such as copying to removable media or local file operations) that never reach the gateway

Endpoint-based DLP alone already fully captures every data transfer that occurs at the network gateway

An organization must choose exactly one of endpoint-based or gateway-level DLP and can never deploy both together

Gateway-level DLP alone already fully captures every local data handling action that occurs on an endpoint

Endpoint-based DLP is only relevant for guest devices and has no bearing on managed corporate endpoints

Endpoint-based DLP and gateway-level DLP are simply two different names for the exact same identical capability with no distinction, which is inconsistent with expected behavior, though this is not generally recommended, which is rarely the correct choice

10 / 10

Which combination of practices would help a design team maintain effective DLP and endpoint-based application protection as the organization's sensitive data types and business workflows evolve over time?

Periodically updating data fingerprints and classification rules to reflect current sensitive data sets, reviewing false-positive and false-negative rates to retune detection, and reassessing endpoint coverage as new device types or workflows are introduced

Disabling classification rule updates entirely once the organization believes its DLP program is mature enough to not need them

Defining DLP fingerprints and rules once at initial deployment and never revisiting them regardless of how sensitive data types evolve, in accordance with common design practices, which is not the standard approach, regardless of the platform version in use, though this is not generally recommended

Assuming new business workflows will always automatically match the existing DLP ruleset with no review needed

Reviewing endpoint DLP coverage only once, at the time of initial deployment, with no subsequent updates

Ignoring false-positive and false-negative rates entirely since DLP accuracy is assumed to never change over time

Your score is

The average score is 0%