SkillTestPro | CCNP Security 300-745 SDSI Practice Test 6

CCNP Security 300-745 SDSI Practice Test 6 (Hard) - Modifying Security Architecture for SaaS and Multi-Cloud/Data Center Applications

CISCO CCNP Security Exam Logo

1 / 10

Which design shift is most necessary when an organization's security architecture expands from a single on-premises data center to include multiple SaaS applications and public cloud environments?

Disabling all security controls for any application hosted outside the primary data center

Assuming the single on-premises perimeter will automatically extend its enforcement to every SaaS and cloud environment with no additional design, which is inconsistent with expected behavior, under typical configuration conditions

Assuming SaaS and multi-cloud environments require no additional security design considerations compared to on-premises

Moving from a single, centrally enforced perimeter toward distributed, consistent policy enforcement applied at each SaaS and cloud access point, since traffic no longer transits one common chokepoint

Removing all network monitoring for traffic destined to SaaS or public cloud environments

Requiring every SaaS application to be physically hosted inside the organization's own data center before it can be used

2 / 10

Which capability would most help an organization gain visibility into and control over sanctioned and unsanctioned SaaS application usage across its multi-cloud environment?

A physical badge access system limited to the corporate office building

A company holiday calendar with no relationship to SaaS or cloud visibility

A printer usage tracking tool with no relationship to SaaS visibility

A cloud access security broker (CASB) providing discovery, visibility, and policy enforcement for SaaS usage

A parking garage management system with no relationship to SaaS discovery

A cafeteria payment processing system with no relationship to cloud application usage

3 / 10

Which design practice would help maintain consistent security policy for an application that has components distributed across an on-premises data center and multiple public cloud providers?

Removing all policy enforcement in public cloud environments to simplify the overall architecture

Disabling security policy enforcement in any environment where native cloud controls differ from on-premises tooling

Assuming the on-premises data center's firewall rules automatically apply to every public cloud provider

Defining an entirely separate, unrelated security policy independently for each cloud provider with no central coordination at all, which is rarely the correct choice, which is inconsistent with expected behavior, in a properly maintained environment

Defining policy centrally using cloud-agnostic constructs (such as identity- and application-based rules) and translating that policy to each provider's native controls, rather than defining separate, disconnected policies per environment

Requiring the application to be fully hosted in a single cloud provider before any policy can be defined

4 / 10

Which risk would most likely result from an organization adopting multiple SaaS applications without first establishing a consistent identity and access governance model across them?

Each SaaS application would automatically inherit identical access policy from every other SaaS application in use

Adopting multiple SaaS applications would automatically synchronize access governance across all of them with no organizational effort, in accordance with common design practices, regardless of the platform version in use

Inconsistent access policies and orphaned or excessive privileges could accumulate across applications, since each SaaS platform may be governed independently with no unified visibility into who has access to what

Adopting multiple SaaS applications without unified governance would have no security implications whatsoever

Inconsistent governance across SaaS applications would automatically reduce the organization's software licensing costs

The organization's DNS infrastructure would automatically fail as a direct result of adopting multiple SaaS applications

5 / 10

Which factor would most influence whether an organization chooses an API-based or inline (proxy-based) CASB deployment mode for governing a specific SaaS application?

The average outdoor temperature at the organization's headquarters

The specific brand of coffee served in the network operations center

Whether the application exposes a sufficiently capable management API for near-real-time policy enforcement, versus the need to inspect traffic in-line (such as for unmanaged device access) where no suitable API exists

The font used in the organization's internal newsletter

The number of parking spaces available at the organization's headquarters, which is inconsistent with expected behavior, in most deployment scenarios, in a properly maintained environment, in accordance with common design practices

The color scheme configured for the CASB administrative dashboard

6 / 10

Which design consideration is most important when accounting for the shared responsibility model across an environment that spans SaaS applications, IaaS workloads, and an on-premises data center?

The shared responsibility model applies only to on-premises data centers and has no relevance to SaaS or IaaS

The cloud or SaaS provider is always responsible for every layer of security in every environment regardless of service model, under typical configuration conditions, in accordance with common design practices, though this is not generally recommended, which is not the standard approach, in most deployment scenarios, which is not the standard approach

The organization is always responsible for every layer of security in every environment regardless of service model

Every SaaS and IaaS provider follows an identical, universal responsibility split with no variation by service model

The division of security responsibility between the organization and each provider differs by service model (SaaS typically leaves the organization responsible mainly for data and access governance, while IaaS leaves more infrastructure-level responsibility with the organization), so the design must clearly map which party owns each control

Shared responsibility only applies to encryption and has no bearing on any other security control

7 / 10

Which combination of design elements would provide consistent security governance for an organization operating a mix of SaaS applications and workloads spread across multiple public cloud providers and an on-premises data center?

CASB deployment disabled entirely to reduce the administrative overhead of managing SaaS visibility

A separate, disconnected security policy and identity governance model independently maintained for each cloud provider and SaaS application, in accordance with common design practices, which is not the standard approach

A CASB for SaaS visibility and control, centrally defined cloud-agnostic policy translated into each provider's native constructs, and unified identity governance spanning all environments

Cloud-agnostic policy defined once and never translated into any provider's actual native enforcement controls

SaaS visibility limited exclusively to sanctioned applications with no discovery capability for unsanctioned usage

Identity governance applied only to the on-premises data center while all SaaS and cloud environments remain ungoverned

8 / 10

Which troubleshooting step would be appropriate if a security team discovers a SaaS application storing sensitive customer data that was never formally approved or governed by the organization's identity and access policies?

Use CASB or cloud discovery tooling to assess the application's actual data exposure and access patterns, then bring it under formal governance (such as SSO integration and access review) or restrict its use based on the assessed risk

Assume the issue is caused by the affected team's choice of desktop wallpaper

Immediately delete all data from the discovered application with no prior assessment of business impact

Assume the issue is unrelated to governance and only check the team's physical office seating arrangement

Assume unsanctioned SaaS usage is a deprecated risk category no longer relevant to any organization

Assume the issue is caused by the phase of the moon

9 / 10

Which statement accurately describes why a cloud-agnostic policy model is generally preferred over maintaining entirely separate policies per cloud provider for a multi-cloud application?

A cloud-agnostic policy model eliminates the need for any provider-specific enforcement mechanism whatsoever

Maintaining entirely separate per-provider policies always results in stronger security than any cloud-agnostic model

A cloud-agnostic model expressed in terms of identity and application context can be translated consistently across providers, reducing the risk of policy drift and gaps that arise when each provider's policy is maintained independently

Cloud providers do not support the enforcement of any policy defined outside their own native management console

A cloud-agnostic policy model and entirely separate per-provider policies are simply two different names for the exact same identical approach with no distinction

A cloud-agnostic policy model is only relevant for SaaS applications and has no bearing on public cloud workloads

10 / 10

Which combination of practices would help a design team maintain consistent SaaS and multi-cloud security governance as the organization adopts new cloud services over time?

Extending policy coverage only to cloud providers the organization used at the time of initial architecture design

Assuming every newly adopted cloud service automatically inherits existing governance with no review required

Periodically rediscovering SaaS and cloud usage via CASB/cloud discovery tooling, extending the cloud-agnostic policy model to cover newly adopted providers, and reviewing identity governance coverage as new applications are onboarded

Disabling CASB discovery entirely once the organization believes its SaaS governance program is mature enough to not need it

Performing SaaS and cloud discovery once at initial CASB deployment and never repeating it regardless of new services adopted, in accordance with common design practices, which is not the standard approach, under normal operating conditions

Reviewing identity governance coverage only once per year regardless of how many new applications are onboarded

Your score is

The average score is 0%