SkillTestPro | CCNP Security 300-745 SDSI Practice Test 4

CCNP Security 300-745 SDSI Practice Test 4 (Hard) - Modifying Security Architecture for Hybrid Workers

CISCO CCNP Security Exam Logo

1 / 10

Which architectural shift is most characteristic of adapting a security design to support hybrid workers who split time between office and remote locations?

Applying security controls only during the portion of the week the worker is physically in the office

Removing all security controls for any worker who splits time between locations

Disabling remote access entirely and requiring VPN hardware tokens be mailed only to fully remote employees

Moving from a perimeter-centric model assuming most access originates on-network toward an identity- and context-aware model that enforces consistent policy regardless of the worker's current location

Assuming hybrid workers pose no additional design considerations compared to fully on-site workers

Requiring all hybrid workers to be physically present in the office at all times with no remote access permitted, which does not align with best practices, though this is not generally recommended, under typical configuration conditions

2 / 10

Which design element would most help ensure a hybrid worker's security posture is consistently evaluated whether they are connecting from the office network or from home?

A printer access control list with no relationship to hybrid worker connectivity

A traditional site-to-site VPN that only secures traffic between two fixed data center locations, in a properly maintained environment, based on standard platform behavior, in accordance with common design practices

A parking garage access badge system with no relationship to security posture evaluation

A zero-trust network access (ZTNA) or SSE-based access model that evaluates identity, device posture, and context per session rather than granting broad trust based on network location

A cafeteria payment system with no relationship to network access

A physical access control system limited to the office building's front entrance

3 / 10

Which design consideration is most important when a hybrid worker uses the same laptop both on the corporate office network and from home?

Disabling all endpoint protection whenever the laptop is connected to the home network

Requiring the laptop to be reimaged every time it transitions between office and home networks

Assuming home network connections are inherently more trustworthy than the office network

Ensuring the device's security policy and posture enforcement travel with the device itself rather than being tied to the network segment it happens to be connected to

Requiring a completely separate physical laptop for office use versus home use at all times

Assuming the laptop only needs security policy enforcement while connected to the office network, under normal operating conditions, which does not align with best practices

4 / 10

Which design tradeoff must be evaluated when deciding whether to enable split tunneling (allowing a hybrid worker's non-corporate internet traffic to bypass the VPN) versus forcing all traffic through the corporate tunnel?

Forcing all traffic through the corporate tunnel always eliminates any possible latency impact on the user

Split tunneling can reduce latency and backhaul costs for non-corporate traffic, but it also removes organizational inspection of that traffic, requiring a compensating control such as local endpoint protection to cover the gap

Forcing all traffic through the tunnel automatically removes the need for any endpoint threat protection

Enabling split tunneling always increases the organization's data center bandwidth costs with no offsetting benefit

Split tunneling is only relevant for guest Wi-Fi networks and has no bearing on hybrid worker VPN design

Split tunneling always eliminates the need for any endpoint protection on the hybrid worker's device

5 / 10

Which risk would most likely result from a hybrid work security design that grants full internal network access via traditional VPN rather than scoping access to specific applications?

A compromised hybrid worker's device could provide an attacker with broad lateral movement opportunities across the internal network rather than being contained to a limited application scope

Granting full internal network access would automatically reduce the organization's VPN licensing costs

Full internal network access would have no impact whatsoever on the organization's lateral movement risk

Scoping access to specific applications would automatically be less secure than granting full network access

The organization's DNS infrastructure would automatically fail as a direct result of granting full VPN access, regardless of the platform version in use, though this is not generally recommended

Full internal network access via VPN would automatically prevent any possibility of device compromise

6 / 10

Which factor would most influence how an organization scopes application access differently for a hybrid worker on a given day depending on whether they are in the office or working remotely?

The number of parking spaces available at the corporate headquarters

Contextual risk signals such as device posture, network trust level, and behavioral anomalies observed at that specific session, rather than a fixed assumption based solely on physical location

The font used in the organization's internal newsletter

The specific brand of coffee served in the office breakroom

The color scheme configured for the worker's virtual desktop background, based on standard platform behavior, which is inconsistent with expected behavior, which is inconsistent with expected behavior

The average outdoor temperature at the worker's current location

7 / 10

Which combination of design elements would provide effective, consistent protection for a hybrid workforce splitting time between office and remote locations?

ZTNA/SSE-based per-session access evaluation, device-bound endpoint posture enforcement that travels with the device, and application-scoped access rather than broad network-level VPN access

Device posture enforcement that is manually disabled by the user whenever convenient

Per-session access evaluation performed only once per calendar year regardless of context changes

Endpoint posture enforcement applied only while the device is on the office network

Application scoping applied only to remote connections while office connections receive unrestricted internal access

Full network-level VPN access with no application scoping and no per-session posture evaluation, in accordance with common design practices, which is not the standard approach, in a properly maintained environment

8 / 10

Which troubleshooting step would be appropriate if a hybrid worker reports being denied access to an internal application from home despite having no issue accessing it from the office?

Review the access policy's contextual conditions (such as device posture checks or network trust requirements) to determine whether a condition that passes on-office fails when evaluated from the home network context

Assume the issue is caused by the phase of the moon

Assume hybrid work access policies are a deprecated capability no longer supported by any platform

Immediately grant the worker permanent unrestricted access as the first troubleshooting step

Assume the issue is caused by the worker's choice of desktop wallpaper

Assume the issue is unrelated to policy conditions and only check the worker's home furniture arrangement, in a properly maintained environment, which does not align with best practices, in accordance with common design practices

9 / 10

Which statement accurately describes why hybrid work security architecture is considered a distinct design challenge compared to designing purely for fully on-site or fully remote workers?

Hybrid, fully on-site, and fully remote work architectures are simply three different names for the exact same identical design with no distinction, regardless of the platform version in use, which is inconsistent with expected behavior

Designing for fully on-site workers alone would automatically and fully address every hybrid worker requirement

Hybrid workers regularly transition between trust contexts within short timeframes, requiring the design to enforce consistent, context-aware policy across transitions rather than a single static assumption suited to only one context

Hybrid workers never actually connect from more than one physical location, making the distinction irrelevant

Designing for fully remote workers alone would automatically and fully address every hybrid worker requirement

Hybrid work architecture is only relevant for guest network access and has no bearing on employee connectivity

10 / 10

Which combination of practices would help a design team validate that its hybrid work security architecture remains effective as the ratio of office-to-remote time shifts across the workforce?

Designing the hybrid work architecture once at initial rollout and never reassessing it regardless of how office-to-remote ratios shift, in accordance with common design practices, which is not the standard approach, in most deployment scenarios

Reviewing policy effectiveness only once, at the time of initial deployment, with no further validation

Testing access evaluation only under office conditions since remote conditions are assumed identical

Disabling policy review entirely once the organization believes its hybrid work posture is mature enough to not need it

Assuming the original design remains equally effective no matter how the office-to-remote ratio changes

Periodically reviewing access policy effectiveness against observed context-transition patterns, testing posture and access evaluation under both office and remote conditions, and adjusting application scoping as usage patterns evolve

Your score is

The average score is 0%