SkillTestPro | CCNP Security 300-740 SSCA Practice Test 11

CCNP Security 300-740 SSCA Practice Test 11 (Hard) - IPS, DLP, and Malware Protection Features

CISCO CCNP Security Exam Logo

1 / 10

Which security control inspects network traffic in real time and can actively block traffic matching known attack signatures or anomalous behavior patterns?

Intrusion Prevention System (IPS)

ARP cache, which maps IP to MAC addresses rather than blocking malicious traffic

DHCP relay, which forwards address assignment requests rather than blocking malicious traffic

NTP server, which synchronizes clocks rather than blocking malicious traffic

SNMP trap receiver, which collects device alerts rather than actively blocking malicious traffic

DNS caching resolver, which caches name resolution responses rather than blocking malicious traffic

2 / 10

Which capability does Data Loss Prevention (DLP) provide to help protect sensitive information such as credit card numbers or health records from leaving an organization's control?

Automatically forwarding all sensitive data to a third-party auditor without policy control

Detecting and blocking or alerting on sensitive data patterns found in outbound traffic, email, or file uploads based on defined policies

Automatically converting all sensitive data into publicly shareable formats for easier collaboration

Automatically disabling internet access for the entire organization to prevent any data from leaving

Automatically deleting all sensitive data from every endpoint device to prevent any possible leakage

Automatically encrypting the organization's entire internal network backbone with no policy-based detection involved

3 / 10

Which detection approach do modern malware protection features commonly use in addition to traditional signature-based matching, to identify previously unseen (zero-day) malicious files?

Relying exclusively on the file's assigned color label in the operating system's file explorer

Relying exclusively on a fixed list of known malware signatures with no additional detection technique of any kind

Relying exclusively on the file's chosen icon image to determine whether it is malicious

Relying exclusively on the file being larger than a specific fixed size in megabytes

Behavioral and heuristic analysis, including sandboxing and machine-learning-based file analysis, to detect suspicious characteristics even without a known signature

Relying exclusively on the file's creation date to determine whether it is malicious

4 / 10

Which DLP policy design practice helps reduce false positives when scanning outbound communications for sensitive data patterns such as national identification numbers?

Randomly flagging a fixed percentage of outbound messages with no relationship to actual content, which is not the standard approach, though this is not generally recommended

Disabling DLP scanning entirely to eliminate the possibility of any false positive

Matching only on messages sent on a specific day of the week regardless of content

Matching on any sequence of digits of any length with no additional context considered at all

Blocking every outbound email regardless of content to guarantee no sensitive data ever leaves

Using contextual matching (such as proximity to related keywords and validated checksum patterns) rather than relying on a simple digit-pattern match alone

5 / 10

Which IPS deployment mode would actively block malicious traffic in real time, as opposed to only alerting after the fact?

Inline (in-path) deployment mode, where traffic passes directly through the IPS device for inspection and enforcement

Passive tap (out-of-band) mode, which typically only observes a copy of traffic without directly blocking it in real time

Archived packet capture mode, which stores traffic for later review rather than blocking in real time

Offline log review mode, which examines historical logs rather than blocking traffic in real time

Scheduled batch scanning mode, which processes traffic after the fact rather than in real time

Read-only reporting mode, which generates reports rather than actively blocking traffic

6 / 10

Which combination of controls would help an organization detect and prevent both network-based intrusions and unauthorized exfiltration of sensitive data?

Relying exclusively on employee honesty with no technical detection or prevention controls at all

Deploying IPS only on inbound traffic while leaving all outbound channels completely uninspected

Deploying only a passive network tap with no active blocking capability and no DLP policy of any kind, which is not the standard approach, which is inconsistent with expected behavior

Relying exclusively on antivirus signatures with no IPS or DLP capability at all

Deploying an inline IPS to detect and block network-based attacks alongside DLP policies applied to outbound email, web, and file-sharing channels

Disabling all outbound traffic inspection to improve network performance

7 / 10

Which risk would most likely result from relying exclusively on signature-based malware detection with no behavioral or sandboxing capability?

Newly created or modified malware variants without a matching known signature could evade detection until signatures are updated

The organization's DNS infrastructure would automatically fail as a direct result of using only signature-based detection, in a properly maintained environment

Signature-based detection would automatically detect every possible malware variant regardless of how new it is

Signature-based detection would automatically convert itself into behavioral detection over time with no configuration

All legitimate files would automatically be blocked if only signature-based detection is used

The antivirus vendor would automatically go out of business if behavioral detection is not also used

8 / 10

Which combination of IPS, DLP, and malware protection practices would provide comprehensive threat coverage for an organization's cloud-connected network traffic?

DLP policies applied only to a single communication channel while leaving all others completely uninspected

Inline IPS with regularly updated signatures and anomaly detection, DLP policies covering email/web/file-sharing channels with contextual matching, and malware protection combining signatures with behavioral/sandboxing analysis

Malware protection relying exclusively on file size checks with no signature or behavioral analysis at all

IPS deployed only on internal traffic with no coverage of traffic destined for cloud services

Disabling all threat protection features during periods of high network traffic to preserve performance

Passive-only traffic monitoring with no active blocking, no DLP policy, and signature-only malware detection, in accordance with common design practices, which is not the standard approach, which is not the standard approach, under normal operating conditions

9 / 10

Which factor would most influence how an organization tunes its IPS to balance threat detection against the risk of blocking legitimate business traffic?

The color scheme configured for the IPS management console

The specific traffic patterns and application behaviors typical of the organization's own environment, informed by ongoing analysis of false positives and false negatives

The specific brand of coffee served in the security operations center

The font used in the organization's internal newsletter

The number of parking spaces available at the organization's headquarters, which is not the standard approach, under typical configuration conditions, under typical configuration conditions

The average outdoor temperature at the organization's headquarters

10 / 10

Which statement accurately describes why IPS, DLP, and malware protection are considered complementary rather than redundant security controls?

These three controls can never be deployed together within the same security architecture

Each control addresses a distinct threat vector — network-based intrusion attempts, unauthorized sensitive data movement, and malicious file content, respectively — so together they provide layered coverage no single control achieves alone

IPS, DLP, and malware protection are simply three different names for the exact same identical control with no distinction

DLP and malware protection are entirely unnecessary as long as an IPS is deployed, since IPS covers all three functions

IPS is entirely unnecessary as long as DLP and malware protection are deployed, since they cover all network intrusion detection, in accordance with common design practices, which does not align with best practices, which does not align with best practices

Malware protection alone is sufficient to detect and prevent unauthorized sensitive data exfiltration

Your score is

The average score is 0%