300-745 Practice Questions

Cisco XDR (Extended Detection and Response) is a security operations platform designed to provide comprehensive visibility and response capabilities across multiple security domains, including endpoints, network, cloud, and email. A core function of XDR for a Security Operations Center (SOC) analyst is to orchestrate and execute response actions to mitigate threats. This includes the ability to isolate or "quarantine" a compromised endpoint directly from the XDR console. This action leverages an integrated endpoint agent (like Cisco Secure Endpoint) to sever the device's network connections, preventing lateral movement and further damage.

A. flow collector: A flow collector gathers and analyzes network traffic metadata (like NetFlow). It is a tool for visibility and investigation, not for taking direct enforcement actions on an endpoint.

B. syslog: Syslog is a standard protocol for forwarding log messages. A syslog server aggregates logs for analysis and alerting but does not have the native capability to quarantine a device.

C. load balancer: A load balancer's purpose is to distribute network traffic across multiple servers to optimize performance and availability. It is not a security tool for endpoint remediation.

---

1. Cisco XDR At-A-Glance. (Document ID: C45-744494-02, Published: 2023). In the "What you can do with Cisco XDR" section, it states, "Accelerate response actions such as isolating endpoints, blocking domains, and more with just one click." This directly confirms that endpoint isolation (quarantine) is a primary function.

2. Cisco Secure Endpoint User Guide. (Published: Latest Version). In the chapter on "Computers," the section "Isolating and Deisolating an Endpoint" describes the mechanism: "You can isolate a computer from the network to perform an investigation without the risk of the endpoint propagating a threat through the network." Cisco XDR uses this underlying capability as an orchestrated response.

3. Cisco XDR Data Sheet. (Document ID: C22-239000-00, Published: 2023). Under the "Key benefits" section, it lists "Remediate threats with confidence," and the text explains that analysts can "take decisive response actions in a single click from a single console," which includes endpoint quarantine.

Data integrity ensures that information has not been altered in an unauthorized manner during transmission. Hashing is the fundamental cryptographic process used to provide data integrity. A hashing algorithm creates a unique, fixed-length string of characters, known as a hash value or message digest, from the original data. This hash is sent along with the data. The receiving end recalculates the hash from the received data and compares it to the original hash. If they match, the data's integrity is verified. In secure communications like IPsec used in SD-WAN, this is often implemented using a Hashed Message Authentication Code (HMAC), which combines a secret key with the hash function to also provide message authentication.

B. data masking: This is a data security technique used to create a structurally similar but inauthentic version of an organization's data, primarily for privacy in non-production environments.

C. preshared key: A preshared key (PSK) is a shared secret used for authentication between two parties to establish a secure connection, not for verifying the integrity of the data itself.

D. authentication: This is the process of verifying the identity of a user or device. While essential for security, it does not guarantee that the data exchanged has not been tampered with.

1. Cisco SD-WAN Security Configuration Guide, Cisco IOS XE Release 17.x: In the section "Configure Security Parameters in a Security Policy," the guide specifies the integrity mechanism. It states, "For integrity, you can configure one of the Secure Hash Algorithms: SHA-1 HMAC or SHA-2 HMAC." This directly links hashing algorithms (SHA) to the data integrity function within a Cisco SD-WAN solution.

2. NIST Special Publication 800-131A Revision 2, "Transitioning the Use of Cryptographic Algorithms and Key Lengths" (December 2018): Table 3, "Strength and supported usage for approved hash functions," outlines the approved hash functions (e.g., SHA-256, SHA-384) for digital signatures and other applications requiring data integrity. Section 4 explicitly discusses the role of hash functions in providing integrity.

3. Cisco, "IP Security (IPsec) Protocol": In the documentation describing IPsec services, it states, "Data integrity: The IPsec receiver can check whether data was modified in transit... IPsec uses a hash algorithm, such as SHA, to provide data integrity." This is from official Cisco vendor documentation explaining the core security protocol.

An Intrusion Prevention/Detection System (IPS/IDS) is the most suitable technology to meet the specified requirements. It actively monitors network traffic for malicious activity and policy violations. Modern IPS/IDS solutions provide deep packet inspection to protect against network-based attacks, offer detailed visibility into application and communication patterns, and use behavioral analysis and baselining to perform anomaly detection. This is crucial for IoT environments where traffic is often predictable, making deviations from the norm a strong indicator of a compromise or attack. While often integrated into Next-Generation Firewalls (NGFWs), the core technology that provides these specific functions is the IPS/IDS engine.

A. zone-based firewall: A zone-based firewall provides stateful inspection and segmentation but lacks the advanced deep packet inspection and behavioral analysis needed for anomaly detection.

B. transparent firewall: A transparent firewall simplifies deployment at Layer 2 but does not inherently provide the required visibility, anomaly detection, or advanced threat protection capabilities.

C. traditional firewall: A traditional firewall is limited to Layer 3/4 filtering (IP addresses and ports) and cannot perform the deep inspection or anomaly detection required for modern IoT threats.

1. Cisco, Cisco ISA 3000 Series Ruggedized Appliances Data Sheet. "Threat detection and mitigation with Cisco Firewall Intrusion Prevention System (IPS) and security intelligence feeds." This document explicitly states that the industrial appliance designed for environments like smart factories uses an IPS for threat detection, which is a core requirement.

2. Cisco, Deploying Cisco Cyber Vision with the Cisco Secure Firewall, Document ID: 724151, Section: "Introduction to the Solution". "Cisco Cyber Vision is a cybersecurity solution specific to Industrial Control Systems (ICS) that provides visibility and threat detection... The Cisco Secure Firewall with its Intrusion Prevention System (IPS) powered by Snort 3 can then be used to segment the industrial network and block threats." This guide shows that for IoT/ICS visibility and anomaly detection (Cyber Vision), the enforcement and protection mechanism is the firewall's IPS.

3. Cisco, Cisco Secure Firewall Threat Defense Configuration Guide for Firepower Device Manager, Version 7.2, Chapter: "Intrusion Policies". "Intrusion policies are the system's last line of defense before traffic is allowed to its destination... The system uses the intrusion policy to examine traffic for security violations and, in inline deployments, can block or alter malicious traffic." This official configuration guide details how the IPS component is responsible for examining traffic for security violations, which aligns with the requirement to protect against network-based attacks and detect anomalies.

The feature described is GitHub Dependabot, which is represented here as "Depend-a-bot". Dependabot automatically scans a repository's dependency files (e.g., package.json, pom.xml) to detect dependencies with known vulnerabilities listed in the GitHub Advisory Database. When a vulnerability is found, it generates a Dependabot alert. It can also automatically create pull requests to update the dependency to the minimum secure version, respecting semantic versioning (SemVer) to ensure compatibility and minimize breaking changes. This directly addresses the company's need to flag and manage vulnerable software components.

B. Sealed boxes: This refers to an encryption mechanism (using libsodium) for protecting secrets within GitHub Actions, not for scanning software component vulnerabilities.

C. GitHub Actions: This is a CI/CD and workflow automation platform. While it can be used to run vulnerability scanning tools, it is not the specific feature that performs the dependency analysis itself.

D. Artifact attestations: This feature provides verifiable, signed metadata about how a software artifact was built (provenance), securing the supply chain, but it does not scan for vulnerabilities within dependencies.

---

1. GitHub Docs, "About Dependabot alerts": "Dependabot alerts identify dependencies with known vulnerabilities and report them to you... GitHub scans dependency files... and creates a dependency graph... When GitHub detects a vulnerable dependency in your repository, we generate a Dependabot alert."

Source: GitHub, Inc. Official Documentation. Retrieved from https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts

2. GitHub Docs, "Configuring Dependabot security updates": "Dependabot security updates make it easier for you to fix vulnerable dependencies... When you enable Dependabot security updates, GitHub automatically creates a pull request to update the dependency to the minimum possible secure version needed to avoid the vulnerability."

Source: GitHub, Inc. Official Documentation. Retrieved from https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates

3. GitHub Docs, "Using secrets in GitHub Actions": "Secrets are encrypted environment variables that you create in an organization, repository, or repository environment... GitHub uses a libsodium sealed box to help ensure that secrets are encrypted before they reach GitHub and remain encrypted until you use them in a workflow."

Source: GitHub, Inc. Official Documentation. Retrieved from https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions

4. GitHub Docs, "About artifact attestations": "Artifact attestations create a verifiable link between a software artifact and the workflow that built it... This allows you to verify the origin and build process of your software, helping you meet security requirements like SLSA."

Source: GitHub, Inc. Official Documentation. Retrieved from https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds

Generative AI is used in network security primarily for advanced anomaly and threat detection. Models like Generative Adversarial Networks (GANs) are trained on extensive datasets of normal network traffic to learn its underlying patterns and characteristics. The model can then either generate synthetic "normal" traffic or learn to discriminate between normal and abnormal data. When live network traffic deviates significantly from this learned baseline of normalcy, the system flags it as an unusual pattern or a potential threat. This allows for the detection of novel, zero-day attacks and sophisticated threats that might evade traditional signature-based security systems.

A. Real-time load balancing is a network availability and performance function, not a primary security application of generative AI.

B. Improving resource consumption is an operational efficiency or network optimization task, not a direct security function.

C. While AI can assist in analyzing audit logs, performing real-time regulatory compliance audits is typically handled by specialized, rule-based security policy and compliance management tools.

1. Cisco Official Blog: In the article "How Generative AI is Revolutionizing Cybersecurity," it is stated, "Generative AI can be used to detect anomalies and potential threats in network traffic by learning the patterns of normal behavior and flagging any deviations. This can help organizations to identify and respond to threats more quickly and effectively." (Cisco Blogs, "How Generative AI is Revolutionizing Cybersecurity," May 24, 2023, Section: "Threat detection and response").

2. Cisco Official Blog: The article "Generative AI: The CISO’s new ally" explains that a key use case is "Threat Detection and Response," where generative AI analyzes "vast datasets of security telemetry to identify subtle patterns and anomalies that may indicate a sophisticated attack." (Cisco Blogs, "Generative AI: The CISO’s new ally," August 2, 2023, Section: "Key use cases for generative AI in cybersecurity").

3. Peer-Reviewed Academic Publication: A survey on using GANs for security highlights their effectiveness in anomaly detection. "GANs are trained on normal data... to learn the distribution of the normal data. During testing, GANs identify test data as anomalies if they have a low probability of being generated from the learned distribution." This directly corresponds to detecting unusual patterns. (Chalapathy, R., & Chawla, S. (2019). Deep Learning for Anomaly Detection: A Survey. arXiv preprint arXiv:1901.03407, Section 4.2.1 Generative Adversarial Networks). DOI: https://doi.org/10.48550/arXiv.1901.03407

eBPF (extended Berkeley Packet Filter) is a Linux kernel technology that allows sandboxed programs to run directly within the kernel without modifying the kernel source code or loading kernel modules. These eBPF programs can be attached to various kernel hooks, such as system calls, network events, and function entries/exits. This enables highly efficient and programmable tracing for observability and performance troubleshooting, as well as packet filtering for advanced networking and security policy enforcement. eBPF's in-kernel virtual machine ensures that the programs are safe to run, providing the required capabilities dynamically and securely.

B. distributed firewall: This describes a security architecture or deployment model where firewall policy is enforced on each host, not a specific underlying kernel technology that enables it.

C. NGFW: A Next-Generation Firewall is typically a dedicated network appliance (physical or virtual) that operates at the network perimeter, not a technology running within the kernel of individual hosts.

D. VPP: Vector Packet Processing (VPP) is a high-performance packet processing framework that operates primarily in user space, intentionally bypassing the kernel's network stack for speed.

---

1. Cisco Live Presentation, BRKCRT-2120 (2023): In the "Introduction to eBPF" session, eBPF is described as a "revolutionary kernel technology" that allows for running sandboxed programs in the Linux kernel. The presentation explicitly states its use cases include "networking, observability, tracing, and security" and highlights the key benefit of extending kernel capabilities "without the need to change kernel source code or load kernel modules." (Source: Cisco Live On-Demand Library, BRKCRT-2120, 2023).

2. Official eBPF Project Documentation: The introduction on the official eBPF website states, "eBPF is a revolutionary technology with origins in the Linux kernel that can run sandboxed programs in an operating system kernel. It is used to safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or load kernel modules." (Source: ebpf.io, "What is eBPF?", Introduction section).

3. Cisco Secure Workload (Tetration) White Paper: Cisco Secure Workload uses software agents that rely on in-kernel mechanisms for deep visibility and enforcement. The solution overview describes collecting "process and network flow information from servers" to build application dependency maps and enforce segmentation. This deep, kernel-level data collection for tracing and filtering is a primary use case for eBPF. (Source: Cisco, "Cisco Secure Workload (Tetration) Solution Overview," Page 4, "How it works").

4. Linux Kernel Documentation: The official kernel documentation on BPF/eBPF describes its architecture, which includes a verifier to ensure safety and an in-kernel JIT compiler for performance. It details how BPF programs can be attached to tracepoints and network hooks to implement tracing and filtering functionalities. (Source: The Linux Kernel documentation, Documentation/bpf/bpfdesignQA.rst).

Splunk is a widely recognized Security Information and Event Management (SIEM) and data analytics platform. Its fundamental purpose is to collect machine-generated data, such as logs, from diverse sources across an enterprise network—including network devices, endpoints, servers, and applications. It provides powerful tools to index and search this data, enabling security analysts and administrators to perform complex analysis, correlate events, and create visualizations like dashboards and reports. Cisco security appliances are frequently integrated with Splunk to forward event data for centralized monitoring and incident response, making it a standard tool for the functions described.

A. Cisco Email Security Appliance: This is a specialized security product for protecting against email-based threats. It is a source of logs, not a central platform for collecting logs from other devices.

B. Cloud Observability: This is a broad term for monitoring modern cloud-native applications. While it involves collecting logs, metrics, and traces, it is a concept or a specific performance-oriented solution (like Cisco FSO), not a general-purpose log analysis tool like Splunk.

C. Cisco Web Security Appliance: This is a dedicated secure web gateway that provides web security and threat defense. Like the ESA, it generates logs but does not serve as an enterprise-wide log aggregator.

---

1. Cisco Systems, "Cisco Secure Firewall Management Center and Splunk Integration Guide" (Version 7.2, August 2022): The introduction states, "Splunk is a security information and event management (SIEM) solution that allows you to monitor and analyze machine-generated data from various sources." This document details how a core Cisco security product sends its logs to Splunk for centralized analysis and visualization, directly aligning with the question's description.

2. Cisco Systems, "Cisco Secure Email Gateway Data Sheet": The data sheet describes the product's function as providing "protection against email-based threats, including phishing, business email compromise, ransomware, and spam." This confirms its role as a specific security gateway, not a central log analysis platform.

3. Cisco Systems, "Cisco Full-Stack Observability At-a-Glance": This document defines the solution's purpose: "Cisco Full-Stack Observability helps you deliver exceptional digital experiences... by providing visibility and insights across your entire technology stack." This highlights its focus on application and infrastructure performance monitoring rather than the general-purpose, security-centric log aggregation role of a SIEM.

Endpoint Detection and Response (EDR) is the most suitable solution. The problem describes malware spreading on the management network, which implies that endpoints (servers, workstations) were compromised. EDR solutions are specifically designed to continuously monitor these endpoints to detect malicious activity, contain threats at the source, and provide remediation capabilities. By deploying an EDR solution like Cisco Secure Endpoint, the company can gain visibility into endpoint behavior, automatically block known malware, and rapidly respond to new threats, directly addressing the requirement to detect and mitigate similar future incidents.

B. RADIUS: This is an authentication, authorization, and accounting (AAA) protocol used for network access control, not for detecting or mitigating malware on an already-connected device.

C. encrypted threat analysis: This technology analyzes network traffic patterns to find threats within encrypted flows. While useful, it does not address the malware residing and executing directly on the endpoint itself.

D. IPsec VPN: This provides secure, encrypted tunnels for data in transit between networks. It protects data from eavesdropping but does not inspect the payload for malware or protect the endpoints.

1. Cisco Secure Endpoint Data Sheet: "Cisco® Secure Endpoint is a cloud-managed endpoint security solution that prevents breaches, and detects and responds to advanced threats... It integrates prevention, detection, threat hunting, and response capabilities in a single solution, leveraging the power of the cloud to protect your organization from even the most advanced threats." This document explicitly details how EDR functions to prevent, detect, and respond to malware on endpoints.

Source: Cisco, "Cisco Secure Endpoint Data Sheet," Page 2, "What it does."

2. Cisco SD-WAN End-to-End Security Design Guide: This guide discusses layered security approaches. It positions EDR (like Cisco AMP for Endpoints/Secure Endpoint) as a critical component for host-level protection. In contrast, it describes IPsec's role for transport security and ETA's role for network traffic analysis.

Source: Cisco, "Cisco SD-WAN End-to-End Security Design Guide," Section: "Endpoint Security," Page 15.

3. Cisco Identity Services Engine (ISE) Administrator Guide: This documentation describes the function of RADIUS within a network security architecture. "The RADIUS protocol is used to communicate information between a network access server and a RADIUS authentication server." Its purpose is clearly defined as AAA.

Source: Cisco, "Cisco Identity Services Engine Administrator Guide, Release 3.1," Chapter: "Fundamental Concepts of Cisco ISE," Section: "RADIUS Protocol."

4. Encrypted Traffic Analytics White Paper: "Encrypted Traffic Analytics is a technology that allows organizations to analyze encrypted traffic to detect threats without decryption... It is focused on identifying malware communications in encrypted traffic through passive monitoring." This highlights its role in network analysis, not direct endpoint remediation.

Source: Cisco, "Encrypted Traffic Analytics White Paper," Page 3, "Introduction."

In the realm of Artificial Intelligence and DevSecOps, watermarking is a critical security technique

used to identify the origin of synthetic media. As generative AI models become increasingly

sophisticated, they can create highly realistic images, videos, and audio clips—often referred to as

deep fakes. These deep fakes pose a significant risk to organizational security and public trust, as

they can be used for sophisticated social engineering attacks, such as impersonating executives in

"Business Email Compromise" (BEC) scenarios or spreading misinformation.

By embedding a cryptographic or perceptible watermark into AI-generated content, security systems

and users can verify the authenticity and provenance of the media. This proactive measure helps

prevent the successful deployment of deep fakes by making it easier for automated security tools to

flag synthetic content that lacks a valid "signature" of origin. While watermarking does not inherently

stop the creation of harmful content (Option C) or reduce resource consumption (Option A), it

provides a layer of accountability and verification. Similarly, scale changes (Option D) are technical

image manipulations that watermarking does not prevent. Within the Cisco SDSI framework,

watermarking is viewed as an essential component of the AI security lifecycle, ensuring that

generative technologies are used responsibly and that synthetic content is distinguishable from

genuine data.

========

OpenAPI Specification (OAS) Analysis is a proactive, "design-first" security approach. The developer defines the API contract, including endpoints, methods (e.g., DELETE, PUT), data models, and security requirements in an OAS file before writing implementation code. Security tools can then statically analyze this specification to identify design flaws. This process allows for scoring risks by detecting destructive endpoints that lack proper security scheme definitions or identifying schemas that contain sensitive data patterns (like 'password' or 'ssn'), enabling remediation early in the software development lifecycle.

B. SAST: Static Application Security Testing (SAST) analyzes source code for vulnerabilities. It cannot be performed before the code is written, making it a reactive measure in this context.

C. SBOM Generation: A Software Bill of Materials (SBOM) lists third-party components to manage dependency vulnerabilities. It does not analyze the API's functional design or access control logic.

D. CSPM: Cloud Security Posture Management (CSPM) tools assess the configuration of cloud infrastructure, not the application's internal API design, and are used post-deployment.

---

1. Cisco Panoptica Data Sheet: "API security testing based on OpenAPI specifications provides deep visibility into business logic abuse and data exposure risks." This document highlights that Cisco's own tooling uses OpenAPI specifications as a basis for security analysis, which is a pre-code artifact. (Source: Cisco Panoptica Data Sheet, Page 2, "API Security" section).

2. OpenAPI Specification v3.1.0: The official specification defines the Security Scheme Object, which allows developers to declare security mechanisms like API keys, OAuth2, or OpenID Connect directly within the API design. This confirms that access control is an integral part of the pre-code specification. (Source: OpenAPI Specification v3.1.0, Section 4.8.8, "Security Scheme Object").

3. OWASP API Security Top 10 2023: The document emphasizes the need for proper authorization. For risk API5:2023 - Broken Function Level Authorization, it states, "The enforcement mechanism should deny all access by default, requiring explicit grants to specific roles for access to every function." This principle is best implemented and verified at the design stage, which is facilitated by analyzing an OpenAPI specification. (Source: OWASP API Security Top 10 2023, API5:2023 section).