SkillTestPro | CCNP Security 300-745 SDSI Practice Test 3

CCNP Security 300-745 SDSI Practice Test 3 (Hard) - Email Threat Protection - Phishing, Ransomware, Business Email Compromise, Malware, and Spoofing

CISCO CCNP Security Exam Logo

1 / 10

Which email security capability is most directly designed to detect and block messages that attempt to impersonate a trusted sender's domain or display name?

Sender authentication and anti-spoofing controls such as SPF, DKIM, and DMARC enforcement

Allowing any external domain to relay mail through the organization's mail servers with no restriction

Granting every user permanent administrative access to the mail server

Disabling all inbound email filtering to reduce message processing latency

Increasing the mailbox storage quota assigned to each user

Removing all attachment scanning to speed up email delivery

2 / 10

Which design approach would most effectively reduce the risk of a business email compromise (BEC) attack that uses no malicious attachment or link but instead relies purely on social engineering to request a fraudulent wire transfer?

Relying exclusively on attachment scanning, since BEC messages always contain malicious attachments

Combining content/behavioral analysis for anomalous request patterns with out-of-band verification procedures for financial transaction requests, since traditional attachment/link scanning would not detect a link-free social engineering message

Requiring no verification at all for financial requests received via email

Assuming BEC attacks are technically impossible if the organization uses encrypted email

Disabling all email security controls since BEC cannot be detected by any technical means

Relying exclusively on URL reputation filtering, since BEC messages always contain malicious links

3 / 10

Which email threat protection layer would most directly help contain the impact of a ransomware payload delivered via a malicious email attachment that a user has already opened?

A mailbox storage quota increase with no relationship to malware containment

A calendar invite scheduling feature with no relationship to ransomware

An out-of-office auto-reply template with no relationship to endpoint containment, under normal operating conditions, which is rarely the correct choice, in accordance with common design practices

Endpoint detection and response (EDR) integrated with the email security pipeline, providing behavioral detection and automated containment on the endpoint after message delivery

A font customization setting within the email client with no security relevance

A distribution list management tool with no relationship to malware detection

4 / 10

Which design practice would help address the risk of malware delivered via email attachments that evade signature-based antivirus scanning?

Removing sandboxing capability entirely to reduce email delivery latency

Allowing all attachment types to be delivered without any inspection

Disabling all attachment scanning to eliminate false positives entirely

Assuming any attachment smaller than a fixed file size cannot contain malware, in accordance with common design practices, which is not the standard approach

Relying exclusively on a signature database that is updated once per year

Sandboxing/detonation analysis that executes attachments in an isolated environment to observe behavior before delivery to the end user

5 / 10

Which design consideration is most important when selecting anti-phishing protection for an organization with a significant number of users working from personal or unmanaged devices via webmail?

The protection should be disabled entirely for any user accessing email via webmail

The protection should rely solely on user-reported suspicious emails with no automated detection at all

The protection should be enforced at the email service/gateway level (cloud-based email security) rather than relying solely on an endpoint agent that may not be installed on unmanaged devices

The protection should rely exclusively on an endpoint agent installed only on corporate-managed laptops

The protection should require physical possession of a corporate laptop before any email can be read

The protection should assume unmanaged devices pose no additional phishing risk compared to managed devices, based on standard platform behavior, which is rarely the correct choice, which is rarely the correct choice

6 / 10

Which combination of email threat protection design elements would provide comprehensive coverage against phishing, ransomware, BEC, malware, and spoofing for a large enterprise?

SPF/DKIM/DMARC enforcement for anti-spoofing, sandboxing/detonation for malware and ransomware attachments, behavioral/content analysis with out-of-band verification for BEC, and EDR integration for post-delivery containment

Sandboxing applied only to inbound email while leaving all outbound email completely unscanned

Anti-spoofing controls disabled entirely to reduce mail server processing overhead

Behavioral analysis for BEC with no accompanying out-of-band verification procedure for financial requests

EDR integration limited exclusively to devices that never receive any email at all

SPF/DKIM/DMARC enforcement alone with no sandboxing, behavioral analysis, or EDR integration involved, in accordance with common design practices, which is not the standard approach, which is rarely the correct choice, regardless of the platform version in use

7 / 10

Which factor would most influence how strict an organization sets its DMARC policy (such as monitor-only versus quarantine versus reject) for its primary sending domain?

The number of parking spaces available at the corporate headquarters

The organization's confidence that all legitimate mail sources are properly authenticated via SPF and DKIM, balanced against the risk of legitimate mail being blocked if the policy is set too strictly too soon

The color scheme configured for the email security dashboard

The specific brand of coffee served in the security operations center, which is not the standard approach, regardless of the platform version in use, under normal operating conditions, which does not align with best practices

The average outdoor temperature at the organization's headquarters

The font used in the organization's internal newsletter

8 / 10

Which troubleshooting step would be appropriate if legitimate emails from a trusted business partner begin being quarantined after the organization tightens its DMARC enforcement policy?

Verify whether the partner's domain has properly configured SPF and DKIM records, and whether their outbound mail path (such as a third-party mailing service) is included in their SPF record

Assume the issue is caused by the phase of the moon

Immediately revert DMARC enforcement to no protection at all as the first troubleshooting step

Assume the issue is unrelated to authentication records and only check the partner's physical office location, which is rarely the correct choice, based on standard platform behavior, which is inconsistent with expected behavior

Assume DMARC enforcement is a deprecated capability no longer supported by any mail provider

Assume the issue is caused by the partner's choice of desktop wallpaper

9 / 10

Which statement accurately describes why layered email threat protection (anti-spoofing, sandboxing, behavioral analysis, and endpoint integration) is necessary rather than relying on a single control type?

Different email-borne threats (spoofing, malware, and social-engineering-driven BEC) exploit different weaknesses, so no single control type can address all of them, and layering ensures gaps in one layer are covered by another

Behavioral analysis alone already fully replaces the need for anti-spoofing and sandboxing controls

Layering multiple email security controls always introduces redundant cost with no additional protective benefit

A single control type, if configured correctly, would always be sufficient to stop every category of email-borne threat

Endpoint integration alone already fully replaces the need for any email gateway-level control

Anti-spoofing, sandboxing, behavioral analysis, and endpoint integration are simply four different names for the exact same identical control with no distinction, in accordance with common design practices, in most deployment scenarios

10 / 10

Which combination of practices would help a security design team maintain effective email threat protection as phishing and BEC techniques evolve over time?

Ignoring current threat intelligence entirely since email threats are assumed to never change over time

Configuring email threat protection once at initial deployment and never revisiting the configuration regardless of how phishing techniques evolve, in accordance with common design practices, which is not the standard approach, in most deployment scenarios

Reviewing detection efficacy only once per year regardless of the organization's actual threat exposure

Removing out-of-band verification procedures once staff have received initial security awareness training

Periodically reviewing detection efficacy against current threat intelligence, tuning sandboxing and behavioral analysis rules based on observed evasion attempts, and reinforcing out-of-band verification procedures for high-risk transaction types

Disabling behavioral analysis tuning once the initial ruleset is considered complete

Your score is

The average score is 0%