Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Which tool is used by a SOC analyst to quarantine an endpoint?
In the event of a confirmed compromise, a SOC analyst must act quickly to prevent lateral movement. Cisco XDR (Extended Detection and Response) is the integrated security platform designed to provide cross-layered detection and automated response actions across the network, endpoint, and cloud. One of the most critical response actions within XDR is the ability to quarantine or isolate an endpoint.
Cisco XDR integrates with endpoint security agents (like Cisco Secure Client) and network infrastructure (like Cisco ISE). From a single interface, an analyst can trigger a 'Host Isolation' command. This command instructs the endpoint agent to block all network traffic except for communication with the security console, effectively putting the device in digital quarantine. This is much faster and more effective than manually tracking down the device. A flow collector (Option A) and syslog (Option B) are diagnostic tools used for visibility and logging; they cannot take active enforcement actions. A load balancer (Option C) manages traffic distribution for applications and is irrelevant to endpoint containment. Cisco XDR fulfills the SDSI objective of 'Securing Infrastructure through Automation,' allowing SOC teams to mitigate threats at scale through coordinated response workflows.
A company published software that had a security vulnerability, and an attacker used the vulnerability to steal critical information from the environment. The issue was reported by the security team, and the administrator was instructed to run shift-left security tests before publishing the software. Which component of the software development pipeline must be recommended to run the tests?
In the context of the Cisco SDSI v1.0 blueprint, 'shifting left' refers to the practice of integrating security testing as early as possible in the Software Development Life Cycle (SDLC). The most effective component of the pipeline for running these early tests is Source Code Management (SCM). By integrating security tools directly into the SCM system (such as GitHub, GitLab, or Bitbucket), developers can identify vulnerabilities while the code is still being written or during the initial commit phase.
Techniques such as Static Application Security Testing (SAST) and secret scanning are typically triggered at the SCM level through pull requests or commit hooks. This allows the security team to identify flawed logic or hardcoded credentials before the code is ever compiled or moved to the build stage. While Continuous Deployment (Option A) handles the final release of the software, it is too late in the pipeline for a 'shift-left' approach to be most effective. Software Bill of Materials (SBOM) analysis (Option C) is a specific task focused on dependency management, and Cloud Security Posture Management (CSPM) (Option B) focuses on the runtime environment rather than the application code itself. Utilizing SCM as the primary checkpoint ensures that security becomes a foundational part of the development process, reducing the risk of vulnerable software reaching production environments.
A manufacturing company experienced a security breach that resulted in sales data being compromised. An engineer participating in the investigation must identify who logged into the sales system during the affected period. Which approach must be used to gather the information?
In the aftermath of a security breach, forensic investigators rely on the Accounting portion of AAA (Authentication, Authorization, and Accounting) to reconstruct a timeline of events. While Authentication verifies identity and Authorization defines permissions, Accounting is the specific framework used to track user activity, including login/logout times and the specific commands executed during a session.
According to Cisco Security Infrastructure design objectives, implementing a centralized AAA solution (such as Cisco Identity Services Engine (ISE) or a TACACS+/RADIUS server) is critical for accountability. In this scenario, the engineer would query the AAA logs to identify exactly 'who' accessed the sales system during the compromise period. SNMP (Option A) is primarily for network monitoring and performance data, not granular user access logs. NACM (Option B) is an access control model for NETCONF but doesn't provide the broad auditing required here. PKI (Option D) provides the certificates used for digital signatures and encryption but does not log the historical 'session' data needed for the investigation. Therefore, AAA is the fundamental architectural requirement for ensuring non-repudiation and providing the audit trail necessary to satisfy risk management and incident response requirements.
A retail company is facing a series of cyberattacks targeting web servers, which results in disruptions to online services. Upon investigation, the security team identified that these attacks involved invalid HTTP request headers, which were used to exploit vulnerabilities in the web application. To safeguard the company websites against similar threats in the future, the security team must deploy a security solution specifically designed to detect and block such malicious web traffic. Which security product must be used to protect the websites from similar attacks?
The cyberattacks described target the application layer (Layer 7), specifically exploiting vulnerabilities through malformed HTTP headers. A Web Application Firewall (WAF) is the specialized security solution required to mitigate these threats. Unlike standard firewalls that inspect traffic at the network and transport layers (IPs and Ports), a WAF performs deep inspection of HTTP/HTTPS traffic.
A WAF---such as those integrated into the Cisco Secure Firewall or cloud-native WAF services---understands the structure of web requests. It can identify and block sophisticated attacks like SQL injection, Cross-Site Scripting (XSS), and the specific 'invalid HTTP request headers' mentioned in the scenario. By applying a set of rules (often based on the OWASP Top 10), the WAF filters out malicious requests before they reach the web server. Antivirus software (Option A) and Host-based firewalls (Option D) protect the server's operating system from malware and unauthorized connections but cannot inspect the logic of a web request. A Traditional Firewall (Option B) would simply see the traffic as 'allowed' on Port 443 and pass it through. Implementing a WAF is a critical architectural requirement in the Cisco SDSI 'Applications' domain to protect customer-facing web services from exploitation.
An employee of a pharmaceutical company accidentally checked in code that contains AWS secret keys to a public GitHub repository, which exposes production resources to attackers. Which mitigation strategy must a security engineer recommend to prevent future reoccurrence?
Accidental exposure of sensitive credentials, such as API keys or AWS secrets, is a major risk in modern DevOps environments. To prevent such incidents from occurring, the most effective technical control is the implementation of a Source Code Management (SCM) precommit hook. A precommit hook is a script that runs locally on a developer's machine before a commit is finalized and pushed to a remote repository.
According to Cisco's DevSecOps design principles, precommit hooks can be configured to scan the code for specific patterns that resemble secrets (e.g., regex for AWS Access Key IDs). If the scanner detects a secret, it automatically aborts the commit, forcing the developer to remove or properly encrypt the sensitive data before the code can leave their local machine. This provides an immediate 'shift-left' safety net that stops the leak at the source.
While a Web Application Firewall (WAF) (Option A) protects against external attacks and Port Security (Option B) manages Layer 2 access, neither can prevent a developer from pushing code to GitHub. A phishing education campaign (Option C) is beneficial for general security awareness but does not provide the automated, technical enforcement required to block credential leakage. By configuring precommit hooks, the pharmaceutical company establishes a proactive defense mechanism that significantly reduces the risk of credential exposure and aligns with the automation objectives of the Cisco SDSI curriculum.
A global marketing firm, based in California with customers on every continent, suffered a data breach that exposed employee and customer PII. Which regulations is the company in danger of violating?
The General Data Protection Regulation (GDPR) is a comprehensive data privacy law in the European Union (EU) that has a significant global reach. For a California-based marketing firm with customers on every continent, any breach involving the Personally Identifiable Information (PII) of European residents triggers immediate and severe legal exposure under GDPR. This regulation is unique because of its extraterritorial application; it mandates that any entity---regardless of its physical headquarters---must comply if they offer goods or services to, or monitor the behavior of, individuals located within the EU.
In the event of a data breach, GDPR requires organizations to notify the relevant supervisory authority within 72 hours and, in cases of high risk, notify the affected individuals without undue delay. Failure to implement adequate technical and organizational measures to protect data can result in astronomical fines of up to 20 million or 4% of annual global turnover, whichever is higher. While other frameworks like NIST SP 800-53 (often confused with ISO in Option A) or ISO 27001 (Option D) provide the architectural standards and controls to prevent such incidents, they are voluntary standards or frameworks, not legally binding regulations that a company 'violates' in the same sense as GDPR. FedRAMP (Option B) is specific to US federal government cloud service providers and would not typically apply to a private marketing firm's global operations. Thus, GDPR represents the primary regulatory threat for a global firm handling international PII.
Exam domains verified against: Official Cisco 300-745 exam guide, last checked October 2026.
Design and evaluate network security architectures including perimeter defense, segmentation, VPN and tunneling technologies such as SD-WAN, IPsec, MPLS, GRE, DMVPN, and public cloud tunnels. Select security approaches for endpoints, identity with MFA and passwordless options, email threats, and firewall architectures from traditional to next-generation and distributed models.
Sample question from this domain above: Q6
Select security solutions such as firewalls, SSL offloading and decryption, DLP, and endpoint protections based on application and flow data. Design segmentation and microsegmentation for cloud-native applications, microservices, containers, and serverless architectures. Address emerging technology impacts including generative AI, machine learning, and quantum computing.
Describe how the SOC leverages incident handling and incident response tools in security operations. Modify designs to mitigate identified risks and adapt security architecture following incidents. Apply security frameworks including MITRE CAPEC, NIST SP 800-37, and SAFE in the design lifecycle and match regulatory compliance requirements to business scenarios.
Describe the functions, uses, and role of AI in securing network infrastructure and threat detection. Select features required for automated security architecture including API tooling, Infrastructure as Code, monitoring, container scanning, security telemetry, alerting, and SOAR. Implement workflows and pipelines to minimize risk from automated deployments.
Sample question from this domain above: Q3
Common questions about the exam itself
