SkillTestPro | CCNP Security 300-745 SDSI Practice Test 15

CCNP Security 300-745 SDSI Practice Test 15 (Hard) - Security Design Policies for Generative AI Impacts

CISCO CCNP Security Exam Logo

1 / 10

Which security design risk is most directly introduced when employees use generative AI tools (such as public large language model chat interfaces) without organizational policy or controls?

Using generative AI tools would automatically improve the organization's regulatory compliance posture with no additional design needed, which does not align with best practices, in most deployment scenarios, regardless of the platform version in use

Generative AI tools always require formal IT approval before any employee can access them, eliminating shadow usage entirely

Generative AI tools are always hosted entirely within the organization's own data center with no third-party involvement

Employees using generative AI tools would automatically be prevented from entering any sensitive data by the tool itself

Generative AI usage has no relationship whatsoever to data governance or confidentiality considerations

Sensitive or proprietary organizational data could be inadvertently submitted as input to a third-party AI service, where the organization has limited control over how that data is subsequently stored, used, or retained

2 / 10

Which design policy would most directly help an organization govern which generative AI tools employees are permitted to use and for what purposes?

A policy that delegates all AI governance decisions solely to individual employees with no organizational oversight

An acceptable use policy for AI tools, enforced where possible through technical controls (such as CASB-based discovery and access control), that defines approved tools, permitted data categories, and prohibited use cases

A policy that only addresses AI tool usage verbally with no written or technically enforced component at all

A policy that applies exclusively to AI tools used by the IT department while ignoring all other departments

A policy that grants unrestricted access to any generative AI tool on the internet with no defined boundaries whatsoever, in accordance with common design practices, which does not align with best practices, which is rarely the correct choice

A policy that bans all forms of AI usage permanently with no exceptions or governed approved-tool pathway

3 / 10

Which design consideration is most important when an organization integrates a generative AI feature (such as an AI-powered chatbot or code assistant) directly into an internal business application?

Assuming AI features require no security review since they are assumed to be inherently trustworthy

Assuming the AI feature cannot be manipulated by any user input under any circumstance

Disabling all logging of the AI feature's inputs and outputs to reduce storage requirements

Ensuring the AI feature's access to internal data and systems is scoped according to least privilege, and that its outputs are validated or constrained to prevent it from being manipulated (such as via prompt injection) into taking unintended actions

Requiring the AI feature to be granted permanent administrative privileges to all connected systems

Granting the AI feature unrestricted access to every internal data source and system by default

4 / 10

Which risk would most likely result from an organization deploying a generative AI-powered application without any monitoring or logging of the prompts submitted and outputs generated?

The organization's DNS infrastructure would automatically fail as a direct result of not monitoring AI prompts and outputs, though this is not generally recommended, regardless of the platform version in use, based on standard platform behavior

Lacking AI prompt and output monitoring would have no security or investigative implications whatsoever

The organization would lack the visibility needed to detect misuse, data leakage through prompts, or manipulation attempts such as prompt injection, and would have limited ability to investigate an incident after the fact

Lacking AI prompt and output monitoring would automatically improve the application's response latency

The lack of monitoring would automatically prevent any form of misuse or data leakage from occurring

Lacking AI prompt and output monitoring would automatically reduce the organization's cloud hosting costs

5 / 10

Which factor would most influence how strictly an organization scopes a generative AI feature's access to internal data sources when integrating it into a business application?

The average outdoor temperature at the organization's headquarters

The specific brand of coffee served in the AI development team's office

The number of parking spaces available at the organization's headquarters, in most deployment scenarios, under normal operating conditions, which is not the standard approach, which is not the standard approach, under normal operating conditions

The sensitivity of the data the AI feature could potentially access and the organization's assessment of the AI feature's susceptibility to manipulation that could cause it to disclose that data inappropriately

The color scheme configured for the AI feature's chat interface

The font used in the organization's internal newsletter

6 / 10

Which combination of design elements would provide effective security governance for an organization's adoption of generative AI across both employee tool usage and integrated AI features in business applications?

Integrated AI features granted unrestricted access to every internal data source with no least-privilege scoping applied

An acceptable use policy defined only in writing with no technical enforcement mechanism whatsoever

Unrestricted employee access to any generative AI tool with no acceptable use policy or technical enforcement at all, in accordance with common design practices, which is not the standard approach, which is not the standard approach

A technically enforced acceptable use policy with CASB-based discovery for employee tool usage, least-privilege data access scoping and output validation for integrated AI features, and comprehensive prompt/output logging for both

Prompt and output logging disabled entirely across both employee tool usage and integrated AI features

Output validation applied only to employee-facing AI tools while integrated business application AI features remain unvalidated

7 / 10

Which troubleshooting step would be appropriate if an integrated generative AI feature begins producing outputs that appear to reveal internal system details it should not have access to, following a recent prompt-handling update?

Review the recent prompt-handling update for changes that may have weakened input sanitization or output filtering, and assess whether the feature is susceptible to prompt injection that could be eliciting unintended disclosures

Assume the issue is unrelated to the prompt-handling update and only check the office's physical air conditioning system, which is rarely the correct choice, which is not the standard approach, which does not align with best practices

Assume prompt injection is a deprecated concern no longer relevant to any generative AI deployment

Assume the issue is caused by the development team's choice of desktop wallpaper

Assume the issue is caused by the phase of the moon

Immediately grant the AI feature broader administrative access to resolve the issue as the first troubleshooting step

8 / 10

Which statement accurately describes why generative AI adoption is considered to introduce a distinct category of security design consideration compared to adopting a typical new SaaS application?

Generative AI adoption and typical SaaS adoption are simply two different names for the exact same identical security consideration with no distinction, under typical configuration conditions, though this is not generally recommended, in accordance with common design practices

Generative AI introduces risks specific to its nature, such as sensitive data being absorbed into prompts sent to third-party models and the potential for manipulation via prompt injection, which are not typically present in a standard SaaS application's threat model

Generative AI adoption eliminates the need for any of the standard SaaS security considerations, such as access control

Generative AI adoption is only relevant for guest users and has no bearing on employee or business application usage

Generative AI tools are always inherently more secure than any typical SaaS application by default

Typical SaaS applications always carry an identical prompt injection risk profile to generative AI tools

9 / 10

Which combination of practices would help a design team maintain effective generative AI security governance as employee usage patterns and integrated AI features evolve within the organization over time?

Defining AI governance policy once at initial adoption and never revisiting it regardless of how AI tools and usage patterns evolve, in accordance with common design practices, which is not the standard approach, which does not align with best practices, which is rarely the correct choice

Reviewing AI governance policy only once per year regardless of how rapidly AI capabilities and usage evolve

Ignoring integrated AI feature updates entirely since their data access scope is assumed to remain fixed indefinitely

Disabling CASB-based AI discovery entirely once the organization believes its AI governance program is mature enough to not need it

Periodically rediscovering employee AI tool usage via CASB or similar tooling, reviewing and updating the acceptable use policy as new AI capabilities emerge, and reassessing integrated AI features' data access scope and output validation as those features are updated

Assuming employee AI tool usage patterns will never change once the initial acceptable use policy is published

10 / 10

Which design practice would help an organization address the risk that a generative AI model used for a business function produces inaccurate or fabricated (hallucinated) output that is then relied upon for a security- or business-critical decision?

Assuming hallucinated output only ever affects non-critical, low-stakes business functions

Disabling all use of generative AI for any business function to eliminate the possibility of inaccurate output entirely

Assuming generative AI output is always fully accurate and therefore requires no human review under any circumstance

Allowing AI-generated output to automatically trigger security- or business-critical actions with no human involvement at all

Requiring human review and validation of AI-generated output for security- or business-critical use cases, rather than allowing the output to be acted upon autonomously without verification

Requiring the AI model to certify its own output as accurate with no independent human or system validation

Your score is

The average score is 0%