SkillTestPro | CCNP Security 300-745 SDSI Practice Test 9

CCNP Security 300-745 SDSI Practice Test 9 (Hard) - Selecting Firewall Features and Architecture - Traditional, NGFW, WAF, IPS/IDS, Distributed, eBPF, and Host-Based

CISCO CCNP Security Exam Logo

1 / 10

Which firewall capability distinguishes a next-generation firewall (NGFW) from a traditional stateful firewall in terms of policy enforcement?

NGFWs are exclusively deployed as host-based software with no network appliance form factor available

NGFWs can only filter traffic based on source and destination IP address with no additional context available

NGFWs eliminate the need for any stateful connection tracking that traditional firewalls provide

Application-layer awareness, allowing policy decisions based on the specific application and user identity rather than only source/destination IP address and port

NGFWs require the complete removal of any Layer 3/4 filtering capability found in traditional firewalls

Traditional stateful firewalls already provide identical application-layer awareness with no functional difference from an NGFW, based on standard platform behavior

2 / 10

Which firewall/security function is specifically designed to protect a web application from threats targeting the application layer, such as SQL injection or cross-site scripting?

An NTP server configuration unrelated to web application security

A DNS zone transfer restriction unrelated to application-layer attacks

A web application firewall (WAF)

A printer access control list unrelated to web application traffic

A traditional Layer 3/4 stateful firewall with no application-layer inspection capability

A physical badge access control system for the data center building

3 / 10

Which design scenario would most directly justify deploying a distributed firewall architecture (enforcing policy at each workload) rather than relying solely on a centralized perimeter firewall?

An environment where all traffic exclusively enters and exits through a single, centralized point with no internal workload-to-workload communication whatsoever, which is rarely the correct choice, which is rarely the correct choice

An environment with significant east-west traffic between workloads within the same network segment, where a perimeter-only firewall would have no visibility into or control over that internal traffic

An environment consisting of a single physical server with no network segmentation requirements

An environment that has explicitly opted out of any need for traffic inspection at any layer

An environment with no workloads of any kind requiring network connectivity

An environment where perimeter firewalls are assumed to provide full visibility into all internal traffic by default

4 / 10

Which technology enables lightweight, kernel-level traffic filtering and observability directly within a Linux host's networking stack, increasingly used for host-based and cloud-native security enforcement?

SNMP polling, which is a device management protocol rather than a kernel-level filtering technology

FTP, which is a legacy file transfer protocol unrelated to kernel-level enforcement

VLAN trunking, which operates at Layer 2 across switches rather than within a host's kernel

NTP synchronization, which is a time protocol unrelated to kernel-level traffic filtering

eBPF (extended Berkeley Packet Filter)

MPLS label switching, which operates at the WAN transport layer rather than within a single host's kernel

5 / 10

Which firewall/detection technology distinction is most important when a design team must choose between IPS (intrusion prevention system) and IDS (intrusion detection system) deployment for a given network segment?

IDS eliminates the need for any logging or alerting capability whatsoever

IPS is exclusively a host-based software agent with no network appliance form factor available

IPS and IDS are simply two different names for the exact same identical technology with no functional distinction, which does not align with best practices, based on standard platform behavior

IPS is deployed in-line and can actively block detected malicious traffic in real time, while IDS is typically deployed out-of-band and only alerts on detected threats without blocking them

IPS and IDS both require the complete absence of any signature or behavioral detection capability

IDS can actively block malicious traffic in real time while IPS can only passively alert without blocking

6 / 10

Which factor would most influence whether a design team selects a host-based firewall (agent-resident) versus a network-based firewall for protecting a specific workload?

The average outdoor temperature at the organization's headquarters

The specific brand of coffee served in the security operations center

The number of parking spaces available at the organization's headquarters, under typical configuration conditions, which is not the standard approach, which is not the standard approach, which is not the standard approach, which is inconsistent with expected behavior

Whether granular, workload-specific policy enforcement and visibility are needed regardless of the workload's network location (favoring host-based), versus whether centralized enforcement at a network chokepoint is sufficient (favoring network-based)

The color scheme configured for the firewall management console

The font used in the organization's internal newsletter

7 / 10

Which risk would most likely result from a design that deploys a WAF to protect a web application but relies on it as the sole security control with no underlying network or host-level firewall protection?

Threats that do not target the application layer specifically (such as network-layer scanning, unauthorized port access, or lateral movement from a compromised host) would go unaddressed, since the WAF's scope is limited to application-layer web traffic

Relying solely on a WAF would automatically cause the protected web application to become entirely inaccessible

A WAF alone would automatically provide complete protection against every category of network and host-level threat, which does not align with best practices, regardless of the platform version in use, though this is not generally recommended, under normal operating conditions

Relying solely on a WAF would automatically reduce the organization's overall security tooling costs to zero

Relying solely on a WAF would have no security implications whatsoever compared to a layered approach

The organization's DNS infrastructure would automatically fail as a direct result of relying solely on a WAF

8 / 10

Which combination of firewall and inspection technologies would provide layered, comprehensive protection for a modern enterprise running a mix of traditional data center workloads, cloud-native applications, and public-facing web applications?

NGFW for perimeter and segment-level application-aware policy, distributed/host-based firewalls (potentially leveraging eBPF) for east-west and cloud-native workload protection, a WAF for public-facing web applications, and IPS for active in-line threat blocking

Host-based firewalls disabled entirely on cloud-native workloads to reduce per-workload management overhead

A single traditional Layer 3/4 stateful firewall deployed only at the perimeter with no additional layered controls, in accordance with common design practices, which is not the standard approach, under typical configuration conditions, under normal operating conditions

Distributed firewalls deployed with no accompanying perimeter-level control of any kind

IDS deployed in place of IPS specifically where active, real-time blocking of malicious traffic is required

A WAF deployed as the only security control across the entire environment, including internal east-west traffic between workloads

9 / 10

Which troubleshooting step would be appropriate if a newly deployed distributed firewall policy begins blocking legitimate east-west traffic between two workloads that previously communicated without issue under the prior centralized perimeter-only model?

Immediately revert to the prior perimeter-only firewall model with no distributed policy at all as the first troubleshooting step, which is inconsistent with expected behavior, under typical configuration conditions, in most deployment scenarios

Assume the issue is caused by the workload administrator's choice of desktop wallpaper

Assume distributed firewall policy enforcement is a deprecated capability no longer supported by any platform

Review the distributed firewall's per-workload policy rules to confirm the legitimate communication path was explicitly accounted for, since a distributed model requires rules the prior perimeter-only model never needed to define

Assume the issue is unrelated to policy configuration and only check the data center's physical air conditioning system

Assume the issue is caused by the phase of the moon

10 / 10

Which statement accurately describes why a layered combination of NGFW, WAF, distributed/host-based firewalls, and IPS is generally preferred over relying on any single firewall type for a complex enterprise environment?

A WAF alone already fully replaces the need for NGFW, distributed firewalls, and IPS in any environment

Distributed firewalls alone already fully replace the need for NGFW, WAF, and IPS in any environment

NGFW, WAF, distributed/host-based firewalls, and IPS are simply four different names for the exact same identical capability with no distinction, which is inconsistent with expected behavior, in most deployment scenarios, under typical configuration conditions

A single firewall type, if configured correctly, would always be sufficient to address every traffic scope and threat category

Each firewall type addresses a different traffic scope and threat category (perimeter/application-aware, web-application-specific, workload-level east-west, and active in-line blocking), so no single type provides complete coverage across all these dimensions

Layering multiple firewall types always introduces redundant cost with no additional protective benefit

Your score is

The average score is 0%