The Cisco 300-745 exam validates your ability to design secure network infrastructure aligned with modern security frameworks and organizational risk profiles. This exam is intended for network professionals pursuing the Cisco Certified Network Professional Security credential who need to demonstrate expertise in planning, architecting, and implementing security solutions. This page provides a structured overview of the exam syllabus, question formats, and practical preparation strategies to help you study effectively and build confidence before test day.
Use this topic map to guide your study for Cisco 300-745 (Designing Cisco Security Infrastructure) within the Cisco Certified Network Professional and Cisco Certified Network Professional Security path.
The 300-745 exam uses a mix of question types to assess both foundational knowledge and applied reasoning in security design scenarios. Questions progress in difficulty and reflect real-world decision-making contexts.
Questions are weighted toward practical application, so expect scenarios that combine multiple topics and require you to justify your design choices.
Effective preparation balances topic review, practice questions, and timed practice tests. Structure your study around the four core domains and build connections between infrastructure, applications, risk management, and automation.
Explore other Cisco certifications: view all Cisco exams.
Strengthen your preparation with up-to-date resources from validexamdumps.com. These materials align to 300-745 and cover practical scenarios with clear explanations.
Visit the exam page to download the PDF, Online Practice Test, or get a bundle discount for both formats: Designing Cisco Security Infrastructure.
Secure Infrastructure and Risk/Events/Requirements typically account for the largest portion of the exam, as they form the foundation of security design. However, all four domains are tested, and questions often blend multiple topics, so balanced preparation across all areas is essential for success.
In practice, you start with Risk/Events/Requirements to understand business drivers and compliance mandates. You then design Secure Infrastructure to address those requirements, integrate Applications security to protect data and services, and layer in AI/Automation/DevSecOps to enable continuous monitoring and faster response. This end-to-end flow is reflected in scenario-based exam questions.
Hands-on experience with Cisco security products (firewalls, IDS/IPS, threat defense) and design tools strengthens your ability to answer scenario questions and simulation items. Prioritize labs that involve architecture design decisions, policy configuration, and interpreting security event outputs rather than memorizing command syntax.
Many candidates focus too heavily on product features and miss the design reasoning behind them. Avoid choosing answers based solely on technical correctness; instead, select options that best align with stated business requirements, risk tolerance, and compliance constraints. Also, read scenario details carefully, as subtle differences in requirements often change the correct answer.
In your final week, avoid introducing new topics; instead, review weak areas identified in practice tests and re-read explanations for questions you answered incorrectly. Do one full-length timed practice test to confirm your pacing and build confidence, then spend remaining time on targeted review of high-value concepts rather than re-studying material you already know well.
A company published software that had a security vulnerability, and an attacker used the vulnerability to steal critical information from the environment. The issue was reported by the security team, and the administrator was instructed to run shift-left security tests before publishing the software. Which component of the software development pipeline must be recommended to run the tests?
In the context of the Cisco SDSI v1.0 blueprint, 'shifting left' refers to the practice of integrating security testing as early as possible in the Software Development Life Cycle (SDLC). The most effective component of the pipeline for running these early tests is Source Code Management (SCM). By integrating security tools directly into the SCM system (such as GitHub, GitLab, or Bitbucket), developers can identify vulnerabilities while the code is still being written or during the initial commit phase.
Techniques such as Static Application Security Testing (SAST) and secret scanning are typically triggered at the SCM level through pull requests or commit hooks. This allows the security team to identify flawed logic or hardcoded credentials before the code is ever compiled or moved to the build stage. While Continuous Deployment (Option A) handles the final release of the software, it is too late in the pipeline for a 'shift-left' approach to be most effective. Software Bill of Materials (SBOM) analysis (Option C) is a specific task focused on dependency management, and Cloud Security Posture Management (CSPM) (Option B) focuses on the runtime environment rather than the application code itself. Utilizing SCM as the primary checkpoint ensures that security becomes a foundational part of the development process, reducing the risk of vulnerable software reaching production environments.
========
Refer to the exhibit.
A software developer noticed that the application source code had been found on the internet. To avoid such an incident from happening again, the developer applied a DLP policy to prevent from uploading source code into generative AI tool like ChatGPT. When testing the policy, the developer noticed that it is still possible for the source code to be uploaded. Which action must the developer take to prevent this issue?
In the provided exhibit of the Cisco Data Loss Prevention (DLP) Policy interface (likely within Cisco Umbrella or a similar cloud security gateway), the reason for the policy's failure to stop the upload is clearly visible in the 'Action' column. The rule named 'ChatGPT Source Code' is currently configured with the action set to Monitor.
According to the Cisco SDSI v1.0 objectives regarding application and data security, the Monitor action is designed for visibility and auditing. It allows the traffic to pass through while generating a log entry for security analysts to review. This is often used during an initial 'discovery' phase to understand how data is moving without disrupting business processes. However, to fulfill the requirement of preventing the unauthorized upload of sensitive data---such as application source code---the policy must be enforcement-centric.
By selecting Option D, the developer changes the action from 'Monitor' to Block. In 'Block' mode, the DLP engine will actively intercept the web request to ChatGPT, inspect the content for 'Source Code' classifications, and drop the connection if a match is found, thereby preventing the data from leaving the corporate environment. While moving rules (Option B) can resolve conflicts if a 'Block' rule is superseded by an 'Allow' rule higher in the list, the primary issue here is the non-restrictive action of the specific rule itself. Modifying data classifications (Option C) is unnecessary if the engine is already correctly identifying the source code, as evidenced by the successful monitoring logs mentioned in the scenario. Changing the action to Block is the definitive step to ensure data integrity and prevent intellectual property theft.
A manufacturing company recently experienced a network-down scenario due to malware spread on the management network. The company wants to implement a solution to detect and mitigate a similar threat in the future and protect the overall network. Which solution meets the requirements?
The spread of malware across a sensitive segment like the management network highlights a failure in host-level security and internal visibility. To detect and mitigate the spread of such threats and protect the overall network, Endpoint Detection and Response (EDR) is the most effective choice among the options. In the Cisco security ecosystem, the endpoint is often the last line of defense and the most critical source of telemetry for malware incidents.
By deploying an EDR solution like Cisco Secure Endpoint, the manufacturing company gains the ability to identify the 'patient zero' of the infection. EDR uses advanced features like Device Traversal and Lateral Movement detection to see how malware moves from one machine to another over the management network. Once detected, the security team can use the EDR platform to initiate a 'host isolation' command, effectively cutting off the infected device's communication with the rest of the network without physically unplugging it. While Encrypted Threat Analytics (ETA) (Option C) is a powerful network-based feature for detecting malware in encrypted traffic without decryption, EDR provides the most granular control and response capabilities specifically for malware residing on and spreading between hosts. RADIUS (Option B) and IPsec VPNs (Option D) focus on access control and encryption of data in transit, respectively, but do not provide the behavioral analysis needed to stop a running malware outbreak once the network has already been accessed.
Network administrators at a medical facility cannot log in to network devices because of excessive resource consumption and high CPU utilization. The situation has led to delays in routine maintenance and troubleshooting, which affects overall network performance. An engineer must optimize the handling of traffic to reduce the impact and maintain consistent access and operational efficiency. Which approach must be implemented to meet the requirement?
The scenario described---where high CPU utilization prevents administrators from accessing device management interfaces---is a classic indication that the device's Control Plane is being overwhelmed by malicious or malformed traffic (such as a DoS attack or a routing loop). To protect the 'brains' of the network device, Control Plane Policing (CoPP) must be implemented.
CoPP allows an engineer to define filter and rate-limit policies specifically for traffic destined for the CPU. By categorizing traffic into different classes (e.g., routing protocols, management traffic like SSH, and 'catch-all' untrusted traffic), CoPP ensures that critical management and control traffic is prioritized while excessive or suspicious traffic is dropped before it can impact the device's performance. This maintains operational efficiency even during a traffic spike or attack. While AAA (Option B) handles authentication and RBAC (Option D) manages permissions once a user is logged in, neither can prevent the CPU exhaustion that blocks the login attempt in the first place. SNMP (Option C) is used for monitoring but does not provide active traffic policing. Within the Cisco SDSI framework, CoPP is a fundamental 'Self-Defending Network' feature required to ensure the availability and resilience of the core infrastructure.
========
A financial company uses a remote access solution that directs all traffic over a secure tunnel. The company recently received some large ISP bills from the headquarter location. According to traffic analysis during the investigation, most of the network traffic was due to employees spending a lot of time on video conferences provided by a SaaS collaboration company. What must the company modify to reduce the cost without negatively impacting security or employee experience?
In a Full Tunnel VPN configuration, all traffic from the remote client is sent to the VPN headend before being routed to its final destination. This often results in 'hairpinning,' where high-bandwidth latency-sensitive traffic, such as video conferencing, travels to the corporate data center only to be sent back out to the internet, doubling the bandwidth consumption at the headquarter's ISP link.
To resolve this, the company should implement Split-Exclude tunneling. This configuration allows the VPN administrator to define specific applications or IP ranges---in this case, the SaaS video platform---that should bypass the secure tunnel and go directly to the internet via the user's local ISP. This significantly reduces the load on the corporate headquarter's internet connection and often improves the 'employee experience' by reducing latency for the video stream. Unlike Option A, which degrades quality, or Option C/D, which disrupts workflow and security posture, split-excluding trusted SaaS traffic maintains a high security standard for internal resources while optimizing infrastructure costs. This aligns with the Cisco SDSI objective of designing scalable and cost-effective remote access solutions using Cisco Secure Client (AnyConnect) and Firepower Threat Defense (FTD) policies.
========
