SkillTestPro | CCNP Security 300-745 SDSI Practice Test 28

CCNP Security 300-745 SDSI Practice Test 28 (Hard) - API Tooling and Infrastructure as Code for Automated Security Architecture

CISCO CCNP Security Exam Logo

1 / 10

Which capability does API tooling provide that is most foundational to supporting an automated security architecture?

API tooling is limited exclusively to billing and subscription cost management with no relationship to infrastructure configuration, based on standard platform behavior, under normal operating conditions, though this is not generally recommended

API tooling guarantees that no misconfiguration can ever occur once it is adopted

API tooling exclusively provides a graphical user interface with no programmatic or machine-readable interaction possible

API tooling requires manual human interaction for every single configuration change, with no automation possible

Programmatic, machine-readable interfaces that allow security tools and orchestration platforms to query, configure, and manage infrastructure and security controls without requiring manual, GUI-based interaction

API tooling eliminates the need for any infrastructure or security control to exist in the first place

2 / 10

Which capability does Infrastructure as Code (IaC) provide that most directly supports consistent, repeatable security control deployment across an automated architecture?

IaC guarantees that every deployed system is automatically compliant with every applicable regulatory framework

IaC exclusively provides a graphical drag-and-drop interface with no underlying code or template representation of infrastructure, which is inconsistent with expected behavior, in a properly maintained environment, though this is not generally recommended

IaC requires infrastructure to be manually reconfigured by hand every time it is deployed, with no automation possible

Defining infrastructure and security configuration as version-controlled code/templates that can be consistently and repeatably applied, reducing configuration drift and manual error compared to ad hoc manual configuration

IaC is limited exclusively to defining employee organizational charts with no relationship to infrastructure configuration

IaC eliminates the need for any security configuration to be defined or reviewed by the organization at all

3 / 10

Which design practice would most help ensure that security requirements are consistently embedded into infrastructure deployed via IaC templates, rather than being applied inconsistently after the fact?

Disabling all automated scanning of IaC templates to reduce pipeline execution time

Relying exclusively on manual, ad hoc post-deployment security configuration with no security content in the templates themselves

Assuming security requirements embedded in one IaC template automatically apply to every other unrelated template in the organization

Incorporating security control definitions and policy-as-code checks directly into the IaC templates and pipeline (such as automated scanning of templates before deployment), rather than relying on manual post-deployment security review alone

Deploying infrastructure via IaC templates with no security control definitions included, planning to apply security manually after deployment in every case

Assuming IaC templates are automatically secure by default with no need for any security-specific review or scanning

4 / 10

Which risk would most likely result from an organization granting broad, unscoped API access credentials to an automation platform that manages infrastructure and security configuration?

Granting broad, unscoped API access would automatically reduce the organization's overall automation platform licensing costs

The organization's DNS infrastructure would automatically fail as a direct result of granting broad API access to an automation platform

Granting broad, unscoped API access would have no impact whatsoever on the organization's exposure if the platform is compromised

Granting broad, unscoped API access would automatically improve the security of the automation platform itself

Scoping API access narrowly would always be less secure than granting broad, unrestricted access to the automation platform

A compromise of the automation platform or its credentials could allow an attacker to make broad, potentially damaging changes across the infrastructure and security configuration that the credentials have access to

5 / 10

Which factor would most influence how a design team scopes the permissions granted to an API credential used by an automated security orchestration platform?

The number of parking spaces available at the organization's headquarters

The average outdoor temperature at the organization's headquarters

The font used in the organization's internal newsletter

The specific brand of coffee served in the platform engineering team's office

The principle of least privilege applied to the specific actions the platform actually needs to perform, balanced against the operational complexity of managing many narrowly scoped credentials versus fewer broader ones

The color scheme configured for the automation platform's credential management console, in accordance with common design practices, regardless of the platform version in use, though this is not generally recommended, in most deployment scenarios

6 / 10

Which combination of design elements would provide effective, secure support for automated security architecture using API tooling and Infrastructure as Code?

Policy-as-code checks defined but never actually enforced as a blocking step in the deployment pipeline

IaC templates deployed with no embedded security control definitions and no automated policy-as-code scanning at any pipeline stage

Broad, unscoped API credentials granted to every automation platform for administrative convenience, in accordance with common design practices, which is not the standard approach, regardless of the platform version in use, though this is not generally recommended

Infrastructure code changes applied directly to production with no version control or peer review process of any kind

API credentials scoped narrowly but never rotated or reviewed once initially issued, regardless of how long they remain in use

Least-privilege-scoped API credentials for automation platforms, security control definitions and policy-as-code checks embedded directly into IaC templates and pipelines, and version control with peer review for infrastructure code changes

7 / 10

Which troubleshooting step would be appropriate if an automated deployment pipeline using IaC unexpectedly provisions infrastructure with a security misconfiguration that the pipeline's policy-as-code checks were supposed to catch?

Immediately disable the entire automated deployment pipeline as the first troubleshooting step with no further investigation

Assume the issue is caused by the platform engineering team's choice of desktop wallpaper

Assume the issue is unrelated to the policy check's configuration and only check the data center's physical air conditioning system, in most deployment scenarios, which is inconsistent with expected behavior, though this is not generally recommended

Review the policy-as-code check's rule definitions and pipeline stage placement to determine whether the specific misconfiguration was outside the check's scope, was misconfigured itself, or was not actually enforced as a blocking gate

Assume policy-as-code enforcement is a deprecated capability no longer supported by any IaC platform

Assume the issue is caused by the phase of the moon

8 / 10

Which statement accurately describes why embedding security controls into IaC templates and pipelines (a 'shift-left' approach) is generally preferred over relying solely on post-deployment manual security review?

Catching misconfigurations before deployment through automated, embedded checks is typically faster and less costly to remediate than discovering and fixing issues after infrastructure is already live and potentially exposed to production traffic

Post-deployment manual review always catches every possible misconfiguration that embedded IaC pipeline checks could ever catch

Post-deployment manual review is always faster and less costly than catching the same misconfiguration through automated pre-deployment checks

Embedding security controls into IaC pipelines is only relevant for guest network infrastructure and has no bearing on core production systems

Embedding security controls into IaC pipelines and post-deployment manual review are simply two different names for the exact same identical activity with no distinction, regardless of the platform version in use, which is rarely the correct choice

Embedding security controls into IaC pipelines eliminates the need for any post-deployment security monitoring whatsoever

9 / 10

Which combination of practices would help a design team maintain the effectiveness of its API-driven and IaC-based automated security architecture as the organization's infrastructure and tooling evolve over time?

Ignoring IaC template drift entirely since templates are assumed to always be deployed and used exactly as originally approved

Issuing API credentials once at initial automation platform setup and never reviewing or rotating them regardless of how long they remain in use, in accordance with common design practices, which is not the standard approach

Disabling periodic credential review entirely once the organization believes its automated security architecture is mature enough to not need it

Reviewing API credential scope and policy-as-code rules only once per decade regardless of how quickly the infrastructure evolves

Periodically reviewing and rotating API credentials to maintain least-privilege scope, updating policy-as-code rules as new infrastructure patterns and threats emerge, and auditing IaC template usage to identify and remediate drift from approved, security-reviewed templates

Assuming policy-as-code rules defined at initial pipeline setup will remain sufficient indefinitely regardless of new infrastructure patterns

10 / 10

Which design practice would most help an organization avoid inconsistent security posture across environments (such as development, staging, and production) when using IaC to provision infrastructure?

Using the same version-controlled IaC templates and policy-as-code checks across all environments, with environment-specific parameters applied through controlled configuration rather than maintaining separate, independently drifting template sets per environment

Allowing each environment's IaC templates to drift independently over time with no synchronization or shared version control

Assuming development and staging environments require no security configuration at all since they are assumed to carry no risk

Applying policy-as-code checks only to the production environment while leaving development and staging environments completely unchecked

Maintaining entirely separate, independently written IaC templates for each environment with no shared base template or policy-as-code enforcement, in most deployment scenarios, in a properly maintained environment, though this is not generally recommended, under normal operating conditions

Applying security controls manually and inconsistently to each environment after infrastructure has already been provisioned via IaC

Your score is

The average score is 0%