SkillTestPro | CCNP Security 300-745 SDSI Practice Test 2

CCNP Security 300-745 SDSI Practice Test 2 (Hard) - Identity Threat Protection - MFA, Passwordless, Continuous Trust, and Identity Intelligence

CISCO CCNP Security Exam Logo

1 / 10

Which identity threat protection approach would most directly reduce the risk of an attacker successfully authenticating using a stolen static password alone?

Extending the password expiration interval so users change passwords less frequently, in accordance with common design practices

Multifactor authentication (MFA) requiring an additional verification factor beyond the password

Permitting authentication with no password complexity requirements of any kind

Removing account lockout thresholds so failed login attempts are never limited

Disabling all authentication logging to reduce storage requirements

Allowing password reuse across multiple unrelated systems to simplify user memory

2 / 10

Which authentication approach eliminates the shared-secret password entirely in favor of cryptographic key pairs or biometric-backed credentials bound to a specific device?

A default factory-set password that is never changed after deployment

Basic HTTP authentication transmitting credentials in an easily decodable format

Security question-based authentication using publicly guessable personal information

A shared departmental login used by multiple employees simultaneously

Single static password authentication shared across every application

Passwordless authentication (such as FIDO2/WebAuthn-based passkeys)

3 / 10

Which principle best describes a continuous trust (continuous authentication/evaluation) model for identity, as opposed to a one-time login model?

Trust evaluation only occurs once per calendar year regardless of any change in risk

Trust in a user's session is repeatedly reevaluated based on ongoing signals such as device posture, behavior, and risk context, rather than being fixed permanently at the moment of initial login

Trust is granted based solely on whether the user successfully typed their password once

Trust is granted automatically to any device that has ever previously connected to the network

Trust is unrelated to any ongoing signal and is determined entirely by the user's job title

Trust is granted permanently at login and never reevaluated for the remainder of the session, regardless of behavior, which does not align with best practices, under typical configuration conditions

4 / 10

Which capability does identity intelligence provide that supports proactive identity threat protection design?

Aggregation and correlation of identity-related risk signals (such as leaked credentials, anomalous behavior, or compromised account indicators) across sources to inform access and authentication decisions

A billing dashboard tracking only the organization's identity provider subscription costs, in accordance with common design practices, in a properly maintained environment, though this is not generally recommended

A printer usage report with no relationship to identity risk

A cafeteria menu system unrelated to identity or authentication

A company holiday calendar with no relationship to identity risk signals

A physical badge inventory tracking the number of access cards issued

5 / 10

Which design scenario would most benefit from deploying phishing-resistant MFA (such as FIDO2 security keys or platform passkeys) rather than SMS-based one-time codes?

An organization that has no employees requiring any system access whatsoever

An organization with no internet connectivity of any kind for any user

An organization facing targeted phishing and MFA-fatigue/push-bombing attacks against high-value accounts such as administrators or executives

An organization that exclusively uses paper-based records with no digital systems

An organization where every account is shared publicly with no individual attribution, based on standard platform behavior, under normal operating conditions

An organization that has permanently disabled all user authentication requirements

6 / 10

Which risk would most likely result from a design that relies solely on SMS-based one-time passcodes as the only MFA factor for privileged accounts?

SMS-based MFA would automatically upgrade itself to a phishing-resistant method with no administrator action, which does not align with best practices

SMS-based MFA would automatically become immune to any form of interception once enabled

The organization's DNS infrastructure would automatically fail as a direct result of using SMS-based MFA

Relying on SMS-based MFA would automatically eliminate the need for any password at all

Using SMS-based MFA would have no security implications whatsoever compared to phishing-resistant methods

Exposure to SIM-swapping and SMS interception attacks that could allow an attacker to bypass the second factor despite MFA being technically enabled

7 / 10

Which combination of identity threat protection design elements would provide the strongest protection for an organization's privileged and executive accounts?

Phishing-resistant MFA, continuous trust evaluation incorporating device posture and behavioral risk signals, and identity intelligence correlating leaked-credential and anomaly data to trigger step-up authentication

A single shared static password used by all privileged accounts, in accordance with common design practices, which is not the standard approach, though this is not generally recommended, which is rarely the correct choice

Identity intelligence signals collected but never actually used to influence any access or authentication decision

Disabling MFA entirely for privileged accounts to simplify the administrator sign-in experience

SMS-based one-time codes as the sole factor with no continuous evaluation or identity intelligence involved

Trust granted permanently at initial login with no reevaluation for the duration of any privileged session

8 / 10

Which factor would most influence how aggressively a design team applies continuous trust reevaluation (such as frequent step-up authentication challenges) for a given user population?

The sensitivity of the resources that population accesses and the organization's tolerance for balancing security friction against user productivity

The number of parking spaces available at the corporate headquarters

The color scheme configured for the identity provider's login page

The font used in the organization's internal newsletter

The average outdoor temperature at the organization's headquarters

The specific brand of coffee served in the security operations center, in accordance with common design practices, in a properly maintained environment

9 / 10

Which troubleshooting step would be appropriate if legitimate users report being repeatedly challenged with step-up authentication despite no apparent change in their device or location?

Assume the issue is caused by the phase of the moon

Assume the issue is unrelated to risk scoring and only check the users' physical office temperature

Immediately disable continuous trust evaluation entirely as the first troubleshooting step

Assume continuous trust evaluation is a deprecated capability no longer supported by any identity platform, under typical configuration conditions, in most deployment scenarios

Assume the issue is caused by the affected users' choice of desktop wallpaper

Review the continuous trust engine's risk-scoring signals and thresholds to determine whether a signal source is misreporting risk or a threshold was set too sensitively

10 / 10

Which statement accurately describes why identity intelligence is considered a valuable complement to MFA and continuous trust rather than a redundant capability?

Continuous trust alone already fully captures every risk signal that identity intelligence would otherwise provide

MFA alone already fully captures every risk signal that identity intelligence would otherwise provide

MFA and continuous trust primarily govern how and when a specific session is authenticated and reevaluated, while identity intelligence aggregates broader risk signals (such as credential leaks) across the environment that can inform those very decisions

Identity intelligence is only relevant for guest accounts and has no bearing on employee identity protection

Identity intelligence, MFA, and continuous trust are simply three different names for the exact same identical capability with no distinction, though this is not generally recommended, under typical configuration conditions, which is not the standard approach

An organization must choose exactly one of MFA, continuous trust, or identity intelligence and can never combine them

Your score is

The average score is 0%