合格保証付きクイズ2026年最新の実際に出る検証済みの300-745無料試験問題集 [Q23-Q38]

合格保証付きクイズ2026年最新の実際に出る検証済みの300-745無料試験問題集

無料CCNP Security 300-745究極な学習ガイド（更新されたのは73問があります)

質問 # 23
A technology company recently onboarded a new customer in the medical space. The customer needs a solution to provide data integrity across remote sites. Which solution must be used to meet this requirement?

A. authentication
B. data masking
C. hashing
D. preshared key

正解：C

解説：
In the context of theCisco Security Infrastructure (300-745 SDSI)objectives, ensuringdata integrityis a fundamental requirement, particularly in the healthcare sector where the accuracy of medical records at remote sites is critical for patient safety.Hashingis the primary mathematical process used to verify that data has not been altered or tampered with during transit between locations.
Hashing works by applying a cryptographic algorithm (such as SHA-256) to a data set to produce a fixed-size string of characters called a "hash" or "checksum." When data is sent from one remote site to another, the sender calculates a hash of the original data. Upon arrival, the receiving site recalculates the hash using the same algorithm. If the two hashes match exactly, the receiver is assured that the data is identical to the original and has maintained its integrity. Even a single-bit change in the original data would result in a completely different hash value.
WhileAuthentication(Option D) andPreshared Keys(Option C) are essential for verifying the identity of the sites and establishing secure tunnels (like IPsec VPNs), they do not, by themselves, provide the mathematical proof of content integrity.Data Masking(Option B) is a privacy technique used to hide sensitive information from unauthorized viewers, but it does not prevent or detect data corruption or unauthorized modifications.
Therefore, hashing is the specified technical control for achieving verifiable data integrity across distributed infrastructures.

質問 # 24
A retail company is facing a series of cyberattacks targeting web servers, which results in disruptions to online services. Upon investigation, the security team identified that these attacks involved invalid HTTP request headers, which were used to exploit vulnerabilities in the web application. To safeguard the company websites against similar threats in the future, the security team must deploy a security solution specifically designed to detect and block such malicious web traffic. Which security product must be used to protect the websites from similar attacks?

A. antivirus software
B. web application firewall
C. traditional firewall
D. host-based firewall

正解：B

解説：
The cyberattacks described target theapplication layer (Layer 7), specifically exploiting vulnerabilities through malformed HTTP headers. AWeb Application Firewall (WAF)is the specialized security solution required to mitigate these threats. Unlike standard firewalls that inspect traffic at the network and transport layers (IPs and Ports), a WAF performs deep inspection of HTTP/HTTPS traffic.
A WAF-such as those integrated into theCisco Secure Firewallor cloud-native WAF services-understands the structure of web requests. It can identify and block sophisticated attacks like SQL injection, Cross-Site Scripting (XSS), and the specific "invalid HTTP request headers" mentioned in the scenario. By applying a set of rules (often based on the OWASP Top 10), the WAF filters out malicious requests before they reach the web server.Antivirus software(Option A) andHost-based firewalls(Option D) protect the server's operating system from malware and unauthorized connections but cannot inspect the logic of a web request. A Traditional Firewall(Option B) would simply see the traffic as "allowed" on Port 443 and pass it through.
Implementing a WAF is a critical architectural requirement in the Cisco SDSI "Applications" domain to protect customer-facing web services from exploitation.

質問 # 25
A furniture company recently discovered that the endpoint detection and response configuration flagged several malicious files on company-managed laptops. The company must enhance security to prevent known malicious files from being delivered to the network and endpoints. The new solution must enhance the company's ability to inspect and filter incoming traffic effectively.
Which security product must be used to accomplish this goal?

A. traditional firewall
B. host-based firewall
C. next-generation firewall
D. eBPF

正解：C

解説：
A next-generation firewall (NGFW) inspects and filters incoming traffic with deep packet inspection, intrusion prevention, and advanced malware filtering. This prevents known malicious files from reaching the network and endpoints, complementing the company's EDR solution.

質問 # 26
A restaurant distribution center recently suffered a password spray attack targeting the Cisco Secure Firepower Threat Defense VPN headend. The attack attempts to gain unauthorized access by trying common passwords across many accounts. The attack poses a significant security threat to the organization's remote access infrastructure. To enhance the security of the VPN setup and minimize the risk of similar attacks in the future, the IT security team must implement effective mitigation measures. Which technique effectively reduces the risk of this type of attack?

A. Enable AAA authentication for the DefaultWEBVPN and DefaultRAGroup Connection Profiles.
B. Disable group aliases in the connection profiles.
C. Implement an access list to block addresses from the previous password spray attack.
D. Change the AAA authentication method from RADIUS to TACACS+.

正解：A

解説：
In the context of Designing Cisco Security Infrastructure, protecting Remote Access VPN (RAVPN) against brute-force and password spray attacks is a critical objective. On Cisco Firepower Threat Defense (FTD) and Adaptive Security Appliance (ASA) platforms, theDefaultWEBVPNGroupandDefaultRAGroupare the landing points for any connection request that does not specify a valid Group Alias or Group URL. Attackers frequently target these default profiles because they are often left with "None" as the authentication method, allowing the attacker to probe for valid usernames without immediate rejection.
By selectingOption D, the security designer ensures that any attempt to access the VPN via these default profiles requires valid AAA credentials. According to Cisco's hardened design guides, it is best practice to point these default profiles to a "sinkhole" AAA server or a local database with no users. This forces the password spray attack to fail at the initial authentication phase before any sensitive information is leaked or unauthorized access is granted. While Option A (ACLs) provides a temporary fix, it is ineffective against distributed attacks using rotating IP addresses. Option B (Disabling aliases) is a good obfuscation technique but doesn't stop an attacker from hitting the default profile. Option D provides a structural mitigation that aligns with theCisco SAFEarchitectural principle of reducing the attack surface by securing every possible entry vector into the private infrastructure.

質問 # 27
An engineering company's Chief Financial Officer recently fall victim to a phishing scam by responding to an urgent email. The mail appeared to be from a trusted business partner, and it requested sensitive tax information. The incident led to significant financial and reputational damage. To prevent similar occurrences in the future, the security team must implement an effective mitigation strategy. Which mitigation strategy must the security team implement to prevent similar occurrences in the future?

A. upstream traffic filter
B. granular port security strategy
C. data loss prevention strategy
D. targeted education campaign

正解：D

解説：
A targeted education campaign directly addresses phishing by training employees, especially high-value targets like executives, to recognize social engineering attempts. While technical controls help, phishing primarily exploits human behavior, so awareness and training are the most effective preventive measures.

質問 # 28
Refer to the exhibit. A retail company recently deployed a file inspection feature using secure endpoint. The file inspection must detect and prevent the execution of malicious files on machines. During testing, logs showed that certain malicious files are still being executed despite the presence of the security measure. To understand why the threats are not being blocked, it is essential to investigate the configuration of secure endpoint policies. Which configuration is allowing the files to execute?

A. Policy must block the network connections.
B. Policy rule is disabled.
C. Policy rule is in audit mode.
D. Files are not malicious.

正解：C

解説：
The exhibit shows that the malicious file was detected but not quarantined with the note "In audit only mode." This indicates that the secure endpoint policy was set to audit mode, which only logs detections instead of blocking execution. To prevent malicious files from running, the policy must be switched from audit mode to enforcement (block) mode.

質問 # 29
Which two approaches support secure communication in containerized microservices architectures? (Choose two.)

A. Service Mesh with policy enforcement
B. Shared service account credentials
C. Mutual TLS between services
D. Static NAT entries

正解：A、C

解説：
Mutual TLS (mTLS) provides encrypted communication and mutual authentication between services. A service mesh enforces centralized security policies and automates secure communication across microservices.

質問 # 30
Refer to the exhibit. In addition to SSL decryption, which firewall feature allows malware to be blocked?

A. SSL Offloading
B. URL Filtering
C. File Inspection
D. DLP

正解：C

解説：
In the exhibit, SSL decryption is already enabled, which allows encrypted traffic to be inspected.
To block malware hidden within decrypted traffic, the next required feature is File Inspection. This function analyzes files passing through the firewall to detect and stop malicious content.

質問 # 31
A company published software that had a security vulnerability, and an attacker used the vulnerability to steal critical information from the environment. The issue was reported by the security team, and the administrator was instructed to run shift-left security tests before publishing the software. Which component of the software development pipeline must be recommended to run the tests?

A. cloud security posture management
B. continuous deployment
C. source code management
D. software bill of material analysis

正解：C

解説：
Shift-left security means running security tests earlier in the development lifecycle. By integrating tests in the source code management stage (e.g., Git repositories), vulnerabilities can be detected and fixed before software is built and deployed, reducing the risk of publishing insecure code.

質問 # 32
A security engineer on an application design team must choose a framework of attack patterns to evaluate during threat modeling. Which framework provides the common set of attacks?

A. SOC2
B. Cisco SAFE
C. GDPR
D. MITRE CAPEC

正解：D

質問 # 33
A developer is building new API functions for a cloud-based application. Before writing the code, the developer wants to ensure that destructive actions, including deleting and updating data, are properly protected by access control identifying sensitive fields such as those that contain passwords or personally identifiable information. Which approach must be used to score the risks proactively?

A. SBOM Generation
B. CSPM
C. SAST
D. Open API Specification Analysis

正解：D

解説：
Open API Specification Analysis evaluates API definitions before code is written, identifying risky endpoints (such as delete or update functions) and sensitive fields (like PII or passwords). This allows developers to proactively score risks and apply proper access controls early in the design phase.

質問 # 34
A product manager is focused on maintaining the security integrity of a microservice-based application as new features are developed and integrated. To ensure that known software vulnerabilities are not introduced into the product, it is crucial to implement a robust application security technique. The technique must be applied during the build phase of the software development lifecycle, which allows the team to proactively identify and address vulnerability risks before deployment. Which application security technique must be applied to accomplish the goal?

A. Open API specification analysis
B. secret detection
C. infrastructure as code scanning
D. container scanning

正解：D

解説：
In a microservices-based architecture, applications are typically packaged into containers to ensure consistency across different environments. According to theDesigning Cisco Security Infrastructure (SDSI) objectives, securing the software development lifecycle (SDLC) requires integrating security checks as far
"left" as possible.Container scanningis the specific technique used during the build phase to inspect container images for known software vulnerabilities (CVEs) within the bundled libraries, binaries, and dependencies.
When a developer initiates a build, the container scanning tool cross-references the layers of the image against vulnerability databases. If a high-risk vulnerability is detected in a base image or a third-party library, the build can be automatically failed, preventing the vulnerable code from ever reaching the registry or production environment. This directly addresses the product manager's goal of ensuring known vulnerabilities are not introduced. WhileSecret Detection(Option A) is vital for finding leaked API keys or passwords, and Infrastructure as Code (IaC) scanning(Option C) ensures the environment configuration is secure, neither specifically targets the software vulnerabilities within the application package itself. Similarly,Open API specification analysis(Option D) focuses on the contract and security of the interface rather than the underlying software vulnerabilities. By implementing container scanning, organizations align with Cisco's DevSecOps framework, which emphasizes automated, policy-driven security within the CI/CD pipeline to maintain the integrity of cloud-native applications.

質問 # 35
A software development company relies on GitHub for managing the source code and is committed to maintaining application security. The company must ensure that known software vulnerabilities are not introduced to the application. The company needs a capability within GitHub that can analyze semantic versioning and flag any software components that pose security risks. Which GitHub feature must be used?

A. Artifact attestations
B. Sealed boxes
C. GitHub Actions
D. Depend-a-bot

正解：D

解説：
In modern DevSecOps, managing third-party dependencies is a major security challenge.Dependabot(often stylized as Depend-a-bot) is the specific GitHub feature designed to automate the identification and updating of vulnerable dependencies. It works by scanning the application's manifest files (like package.json or requirements.txt) and analyzing thesemantic versioningof the included libraries.
When a known vulnerability (CVE) is reported in a specific version of a library used by the application, Dependabot flags the security risk and alerts the development team. Most importantly, it can automatically generate pull requests to upgrade the dependency to the minimum secure version that resolves the vulnerability. This ensures that the application remains secure without requiring manual tracking of every third-party component.
WhileGitHub Actions(Option C) can be used to run security scanners (like SAST tools), it is a general automation framework, not a dedicated dependency analysis tool.Artifact attestations(Option D) are used to prove the provenance and integrity of a build, andSealed boxes(Option B) is not a standard GitHub security feature related to vulnerability scanning. Utilizing Dependabot directly supports the Cisco SDSI objective of
"Securing the CI/CD pipeline" by proactively managing the Software Bill of Materials (SBOM) and ensuring that vulnerable components do not reach the production environment.

質問 # 36
A legal services company wants to prevent remote employees from accessing personal email and social media accounts while using corporate laptops. Which security solution enforces the policy?

A. Cisco Umbrella
B. RADIUS server
C. network monitoring tool
D. Cisco TrustSec

正解：A

解説：
Cisco Umbrella provides DNS-layer security and content filtering, allowing organizations to block categories such as personal email and social media. This enforces acceptable-use policies for remote employees regardless of where they connect, ensuring corporate devices comply with security requirements.

質問 # 37
A logistics company wants to deploy an application in the cloud using cloud native techniques.
The company must ensure that the development, testing, and production environments are as identical as possible with the lowest risk of the development and testing environments impacting production. Which solution must be used to accomplish the task?

A. service quotas
B. lambda functions
C. network access control list
D. separate cloud accounts

正解：D

解説：
Using separate cloud accounts for development, testing, and production ensures strong isolation between environments. This prevents accidental impact on production while maintaining consistent, cloud-native deployments across all stages with minimal risk.

質問 # 38
......

Cisco 300-745 認定試験の出題範囲：

トピック	出題範囲
トピック 1	Artificial Intelligence, Automation, and DevSecOps: Explores AI's role in securing network infrastructure, selecting tools for automated security architectures such as SOAR, IaC, and API tooling, and integrating security into DevSecOps workflows and pipelines to minimize deployment risk.
トピック 2	Applications: Focuses on selecting security solutions to protect applications and designing secure architectures for cloud-native, containerized, and serverless environments using segmentation. Also addresses security design impacts of emerging technologies like AI, ML, and quantum computing.
トピック 3	Secure Infrastructure: Covers selecting security approaches for endpoints, identities, email, and modern environments like hybrid work, IoT, SaaS, and multi-cloud. Includes choosing VPN tunneling solutions, securing management planes, and selecting the appropriate firewall architecture based on business needs.
トピック 4	Risk, Events, and Requirements: Covers SOC incident handling and response tools, modifying security designs to mitigate or respond to incidents, and applying frameworks like MITRE CAPEC, NIST SP 800-37, and SAFE. Includes matching regulatory and compliance requirements to business scenarios.