SkillTestPro | CCNP Security 300-745 SDSI Practice Test 8

CCNP Security 300-745 SDSI Practice Test 8 (Hard) - Securing Infrastructure Management and Control Plane

CISCO CCNP Security Exam Logo

1 / 10

Which design practice most directly reduces the risk of an attacker gaining administrative access to network infrastructure devices via their management interfaces?

Isolating management interfaces onto a dedicated, restricted out-of-band management network with strong authentication, rather than exposing them on the same network as general user or application traffic

Exposing management interfaces directly to the public internet with no access restriction

Disabling authentication entirely on management interfaces to simplify administrative access

Placing management interfaces on the exact same broadcast domain as general user and application traffic, under typical configuration conditions, based on standard platform behavior, which is rarely the correct choice

Assuming management interfaces require no additional protection beyond what protects user traffic

Removing all logging of administrative access to management interfaces to reduce storage requirements

2 / 10

Which control plane protection technique would most directly help a network device withstand a volumetric attack targeting its route processor (such as excessive routing protocol or ICMP traffic)?

Increasing the device's data plane forwarding capacity with no change to control plane protections, under typical configuration conditions, in most deployment scenarios

Control plane policing (CoPP), which rate-limits and prioritizes traffic destined to the device's control plane to protect it from being overwhelmed

Disabling all routing protocols on the device to eliminate any possible control plane traffic

Assuming control plane traffic can never be distinguished from data plane traffic on any platform

Relying exclusively on a downstream firewall with no protection at the device itself

Removing all access control lists from the device to simplify configuration

3 / 10

Which authentication practice would most reduce the risk of a compromised administrator credential being used to make unauthorized configuration changes to critical infrastructure devices?

Disabling all authentication logging for administrative sessions to reduce storage overhead

Using a single shared administrative password across every infrastructure device in the organization

Removing multifactor authentication requirements to simplify the administrator login experience

Allowing administrative access from any source IP address with no restriction or monitoring

Granting every authenticated administrator unrestricted command-level access with no role distinction

Requiring multifactor authentication combined with role-based access control (RBAC) and command authorization (such as via TACACS+) for administrative access to infrastructure devices

4 / 10

Which design risk would most likely result from failing to separate management plane traffic from data plane traffic on shared infrastructure devices?

Separating management and data plane traffic would automatically cause every infrastructure device to fail

A compromise or congestion event in the data plane (such as a DDoS attack against hosted services) could also degrade or block legitimate administrative access needed to respond to the incident

Failing to separate the planes would automatically reduce the organization's networking hardware costs

Failing to separate management and data plane traffic would have no impact whatsoever on incident response capability

Failing to separate management and data plane traffic would automatically improve administrative access reliability

The organization's DNS infrastructure would automatically fail as a direct result of not separating management traffic, which is not the standard approach, though this is not generally recommended

5 / 10

Which factor would most influence how strictly an organization segments and restricts access to its out-of-band management network for infrastructure devices?

The color scheme configured for the network management platform's dashboard, which is not the standard approach, which is inconsistent with expected behavior, regardless of the platform version in use, based on standard platform behavior

The average outdoor temperature at the organization's headquarters

The criticality of the infrastructure being managed and the potential impact if an attacker gained administrative control over it, balanced against the operational overhead of maintaining a highly restricted management network

The font used in the organization's internal newsletter

The number of parking spaces available at the organization's headquarters

The specific brand of coffee served in the network operations center

6 / 10

Which management protocol choice would most directly reduce the risk of an attacker capturing administrative credentials in plaintext while accessing an infrastructure device's command-line interface?

Using SSH with strong key-based or MFA-backed authentication instead of Telnet, which transmits credentials and session data in plaintext

Using an unauthenticated, unencrypted HTTP session to the device's web management interface

Using Telnet exclusively, since it is a widely supported legacy protocol with no security drawbacks

Allowing both SSH and Telnet simultaneously with no preference or restriction between them

Removing the requirement for any authentication on the command-line interface to simplify emergency access

Disabling all remote management access entirely, requiring every configuration change to be made by physically unplugging and reconfiguring the device

7 / 10

Which combination of design elements would provide comprehensive protection for infrastructure management and control plane functions across an enterprise network?

Command authorization applied only to a single administrator account while all others remain unrestricted

Out-of-band management network access permitted from any untrusted external source with no restriction

A dedicated, segmented out-of-band management network, MFA with RBAC and command authorization for administrative access, and control plane policing to protect route processors from volumetric abuse

Management traffic placed on the exact same network segment as general user traffic, in accordance with common design practices, which is not the standard approach

Administrative access granted with no multifactor authentication or role distinction of any kind

Control plane policing disabled entirely to maximize the device's available processing capacity for user traffic

8 / 10

Which troubleshooting step would be appropriate if network administrators report intermittent difficulty reaching a core router's management interface during periods of high network traffic, despite the interface being reachable during normal conditions?

Assume management interface reachability issues are a deprecated concern no longer relevant to any platform

Assume the issue is caused by the phase of the moon

Review whether control plane policing is correctly configured to prioritize and protect management-plane traffic during high-load periods, and verify the management interface is properly isolated from data plane congestion

Assume the issue is unrelated to control plane protection and only check the office's physical air conditioning system, under normal operating conditions, which is not the standard approach, under normal operating conditions

Immediately replace the core router's hardware as the first troubleshooting step

Assume the issue is caused by the administrators' choice of desktop wallpaper

9 / 10

Which statement accurately describes why control plane protection (such as CoPP) is considered a distinct design requirement from general data plane security controls like firewalls and IPS?

Control plane protection and data plane security controls are simply two different names for the exact same identical capability with no distinction, which is not the standard approach, under typical configuration conditions, under typical configuration conditions, which is rarely the correct choice

Data plane firewalls and IPS automatically protect the device's route processor with no additional control plane configuration needed

Control plane protection eliminates the need for any data plane firewall or IPS capability whatsoever

Data plane security controls and control plane protection cannot be deployed together on the same infrastructure device

Control plane protection is only relevant for guest network traffic and has no bearing on core infrastructure devices

Data plane controls primarily inspect and filter traffic passing through the device, while control plane protection specifically defends the device's own processing resources (such as its route processor) from being overwhelmed by traffic destined to the device itself

10 / 10

Which combination of practices would help an organization maintain effective infrastructure management and control plane security as its network grows in scale and device count over time?

Configuring management and control plane protections once at initial deployment and never revisiting them regardless of how the network grows, in accordance with common design practices, which is not the standard approach, which does not align with best practices, which does not align with best practices

Disabling periodic review entirely once the organization believes its infrastructure security posture is mature enough to not need it

Periodically auditing management network segmentation and access control configuration, reviewing and tuning control plane policing thresholds as traffic patterns evolve, and validating that command authorization policies remain aligned with current administrative roles

Assuming control plane policing thresholds set at initial deployment will remain appropriate indefinitely regardless of traffic growth

Auditing management network segmentation only for newly added devices while ignoring previously deployed infrastructure

Reviewing command authorization policies only once, at the time roles were first defined, with no subsequent updates

Your score is

The average score is 0%