CCNP Security 300-740 SSCA Practice Test 19

Correct Answer: DNS security (DNS-layer protection, such as Cisco Umbrella)
Explanation: DNS security inspects and enforces policy on DNS queries to block malicious domains before a connection is established, unlike a WAF (HTTP/HTTPS inspection), a DLP tool (outbound content inspection), a TCP-payload-focused IPS, a Certificate Authority (certificate issuance), or an NTP server (clock sync).

Correct Answer: It prevents the connection from being established at all, stopping malware command-and-control communication or phishing site access earlier and with less overhead than deeper packet inspection
Explanation: Blocking at DNS resolution stops connections before they're established, providing earlier, lower-overhead protection against C2 or phishing sites, unlike guaranteeing malware can never occur through any vector, eliminating the need for endpoint protection, auto-encrypting allowed traffic, guaranteeing zero false positives, or requiring physical disconnection per query.

Correct Answer: Threat-intelligence-based domain category blocking (such as blocking categories like malware, phishing, and command-and-control domains)
Explanation: Threat-intelligence-based category blocking (malware, phishing, C2 domains) targets known-bad domains while allowing general browsing, unlike blocking the entire internet by default, allowing everything with no filtering, blocking by TLD extension alone, blocking by registration date alone, or blocking by a website's color scheme.

Correct Answer: Deploying a roaming DNS security client or equivalent mechanism that enforces DNS policy regardless of the user's network location, including public Wi-Fi
Explanation: A roaming DNS security client enforces policy regardless of network location, including public Wi-Fi, unlike assuming policy only matters in the office, disabling DNS security off-VPN, assuming public Wi-Fi provides equivalent protection, requiring manual unmanaged configuration, or assuming remote employees never resolve DNS queries.

Correct Answer: A compromised device could still successfully resolve and communicate with a command-and-control domain if the malware itself evades antivirus detection, since DNS-layer blocking would not be present to independently intercept the resolution
Explanation: Without DNS-layer security, a device compromised by malware that evades antivirus could still reach a C2 domain since no independent DNS-layer check exists, unlike assuming antivirus alone is fully equivalent, that DNS infrastructure fails, that antivirus automatically gains DNS inspection capability, that all C2 domains are always caught by antivirus, or that lacking DNS security causes universal compromise.

Correct Answer: Enforcing DNS-layer policy for on-network traffic through the organization's security stack, deploying a roaming DNS security client for off-network devices, and keeping threat intelligence feeds updated
Explanation: Enforcing DNS policy on-network, deploying a roaming client off-network, and keeping threat intelligence current together protect both office and remote employees, unlike protecting only on-network traffic, using rarely-updated threat intelligence, disabling security for non-corporate devices, leaving enablement to individual choice, or covering only one threat category.

Correct Answer: The organization's risk tolerance, industry-specific compliance requirements, and the business need for employees to access certain categories of websites
Explanation: Risk tolerance, compliance requirements, and legitimate business need for certain site categories most influence DNS category policy configuration, which is unrelated to the dashboard's color scheme, SOC coffee brand, headquarters parking space count, an internal newsletter's font, or outdoor temperature.

Correct Answer: Review the domain's current threat-intelligence categorization and, if it has been misclassified, submit it for recategorization or add a specific policy exception
Explanation: Reviewing the domain's threat categorization and submitting for recategorization or adding a specific exception is the appropriate targeted fix, unlike disabling DNS security organization-wide, dismissing the report without investigation, assuming the domain must be malicious with no review, replacing the entire platform, or disabling DNS resolution on the device.

Correct Answer: DNS security provides an early, lightweight layer of protection at the name-resolution stage, complementing deeper application-layer inspection provided by SWG, DLP, and CASB for traffic that does proceed
Explanation: DNS security provides an early, lightweight protection layer at name resolution that complements deeper SWG/DLP/CASB inspection for traffic that proceeds, unlike claiming it replaces those controls, that it's identical to SWG, that it's guest-only, that it must be disabled before configuring other controls, or that it operates at the application layer rather than name resolution.

Correct Answer: Centrally managed DNS security policy enforced consistently for on-network and roaming users, regularly updated threat intelligence, a defined process for handling miscategorized domains, and periodic review of blocked/allowed category lists against business needs
Explanation: Centrally managed, consistently enforced policy, current threat intelligence, a miscategorization process, and periodic category review together provide mature DNS security governance, unlike a static one-time policy, protecting only on-network devices, stale threat intelligence, no miscategorization process, or unreviewed policy changes by any employee.