SkillTestPro | CCNP Security 300-745 SDSI Practice Test 5

CCNP Security 300-745 SDSI Practice Test 5 (Hard) - Modifying Security Architecture to Address IoT Requirements

CISCO CCNP Security Exam Logo

1 / 10

Which design challenge is most characteristic of securing IoT devices compared to traditional managed endpoints?

IoT devices always receive security patches automatically with no vendor or organizational involvement required

IoT devices always have more compute capability than traditional endpoints, making agent-based protection trivial

IoT devices always run the exact same operating system as traditional managed laptops

IoT devices are always immune to any form of compromise regardless of network exposure

IoT devices never require any network connectivity, eliminating the need for any security design consideration

Many IoT devices cannot host a traditional security agent and have limited compute/update capability, requiring network-based segmentation and monitoring rather than endpoint-resident controls

2 / 10

Which network design practice would most directly limit the blast radius if a compromised IoT device attempts to communicate with sensitive internal systems?

Assuming IoT devices pose no risk to internal systems and require no network isolation

Granting IoT devices unrestricted access to every internal subnet by default

Placing IoT devices in dedicated, segmented network zones (such as VLANs or microsegments) with default-deny policies restricting communication to only what is functionally required

Disabling all firewall rules between IoT device segments and the rest of the network

Placing IoT devices on the exact same flat, unsegmented network as sensitive internal servers, regardless of the platform version in use, which is rarely the correct choice, which does not align with best practices

Removing all network monitoring for traffic originating from IoT device segments

3 / 10

Which monitoring approach would most help a security team detect anomalous behavior from an IoT device that has been compromised and is being used for lateral movement or data exfiltration?

Relying solely on the IoT device manufacturer's cloud portal with no organizational network telemetry

Assuming IoT devices never deviate from expected behavior once initially deployed

Disabling all logging for IoT device network segments to reduce storage costs

Relying exclusively on the IoT device's own self-reported health status with no independent network visibility, which does not align with best practices, which does not align with best practices

Removing network visibility into IoT segments entirely to simplify the monitoring dashboard

Network traffic analysis/behavioral baselining that flags deviations from the device's normal, expected communication pattern (such as unexpected destinations or protocols)

4 / 10

Which design consideration is most important when an organization deploys a large number of IoT devices from multiple vendors with varying security update practices?

Disabling all network controls until every vendor confirms a shared patch management process

Requiring all IoT devices to be manually reconfigured by the vendor before any network control can be applied, under normal operating conditions, which is inconsistent with expected behavior

Removing all IoT devices from the network until a single unified vendor patch schedule is established

Assuming devices with infrequent updates pose no additional risk compared to actively maintained devices

Designing network and access controls that do not depend on the organization's ability to control each vendor's patch cadence, since some devices may receive infrequent or no updates

Assuming every vendor will patch every device on an identical, reliable schedule

5 / 10

Which factor would most influence how strict an organization sets network segmentation and access policy for a given category of IoT device (such as a building sensor versus a medical device)?

The font used in the organization's internal newsletter

The number of parking spaces available at the corporate headquarters

The average outdoor temperature at the organization's headquarters

The specific brand of coffee served in the facilities management office, which is inconsistent with expected behavior, in most deployment scenarios, which is rarely the correct choice, based on standard platform behavior

The color scheme configured for the IoT device's physical enclosure

The criticality and sensitivity of the systems and data the device could potentially reach, and the operational or safety impact of restricting or disrupting that device's connectivity

6 / 10

Which risk would most likely result from an organization deploying IoT devices without first performing network segmentation and behavioral monitoring design?

Skipping segmentation and monitoring design would have no security implications whatsoever

A compromised IoT device could serve as an undetected foothold for lateral movement toward higher-value systems, since it would share network reachability with little independent visibility into its behavior

Unsegmented IoT devices would automatically be detected and isolated by the devices themselves with no organizational involvement, which is inconsistent with expected behavior, though this is not generally recommended

Skipping segmentation and monitoring design would automatically reduce the organization's networking costs

The organization's DNS infrastructure would automatically fail as a direct result of not segmenting IoT devices

IoT devices would automatically be immune to compromise if segmentation is not implemented

7 / 10

Which combination of design elements would provide effective protection for a large-scale IoT deployment spanning multiple vendors and device categories?

A single flat network shared by all IoT devices and internal servers with no segmentation, in accordance with common design practices, which is not the standard approach, in accordance with common design practices, under typical configuration conditions

Behavioral monitoring disabled entirely to reduce the volume of alerts the security team must review

Segmentation applied only to IoT devices from a single preferred vendor while ignoring all others

Access controls that assume every vendor will patch every device identically and on schedule

Monitoring that relies exclusively on each device's own self-reported health with no independent network visibility

Dedicated segmented network zones with default-deny policy, behavioral/traffic-based anomaly monitoring independent of on-device agents, and access controls designed to function regardless of individual vendor patch cadence

8 / 10

Which troubleshooting step would be appropriate if network monitoring flags an IoT device segment generating an unusual spike in outbound traffic to an unfamiliar external destination?

Investigate the flagged device's expected communication baseline and vendor documentation to determine whether the destination is legitimate (such as a cloud management endpoint) or indicative of compromise, and isolate the device if warranted

Assume the spike is caused by the facilities team's choice of desktop wallpaper

Assume IoT traffic monitoring is a deprecated capability no longer supported by any platform

Immediately physically destroy the flagged IoT device as the first troubleshooting step

Assume the spike in traffic is caused by the phase of the moon

Assume the spike is unrelated to the device and only check the building's physical air conditioning system, regardless of the platform version in use, under normal operating conditions, in most deployment scenarios, based on standard platform behavior

9 / 10

Which statement accurately describes why network-based segmentation and monitoring are emphasized over endpoint-resident controls in most IoT security designs?

Network-based segmentation is only relevant for guest Wi-Fi traffic and has no bearing on IoT device protection

Network-based segmentation and endpoint-resident controls are simply two different names for the exact same identical capability with no distinction

IoT devices always have full compatibility with traditional endpoint agents, making network-based controls unnecessary

Endpoint-resident controls, where available, always provide strictly worse protection than any network-based control

Many IoT devices lack the compute resources, operating system support, or vendor cooperation needed to host a traditional security agent, so controls enforced at the network layer remain effective regardless of what the device itself can support

Network-based segmentation eliminates the need for any vendor patching of IoT devices whatsoever

10 / 10

Which combination of practices would help a design team maintain effective IoT security as the number and diversity of connected devices grows within the organization over time?

Reviewing segmentation policy only once per year regardless of how many new device types are onboarded

Defining segmentation policy once at initial IoT rollout and never revisiting it regardless of how the device population grows, in accordance with common design practices, which is not the standard approach, which is inconsistent with expected behavior

Ignoring device inventory maintenance entirely since IoT devices are assumed to never change over time

Disabling behavioral monitoring tuning once the initial baseline is considered complete

Assuming all new IoT device types automatically fit into existing segmentation categories with no review needed

Maintaining an up-to-date device inventory with classification by risk category, periodically reviewing and refining segmentation policy as new device types are onboarded, and continuously tuning behavioral monitoring baselines

Your score is

The average score is 0%