Free Practice Questions for the Cisco CCNP Security 300-740 Exam (2026 Updated)

Cisco Secure Endpoint (formerly AMP for Endpoints) includes an “Inbox” tab where detected threats and flagged endpoints are listed. When Duo Trusted Endpoints integration is in place, an endpoint may be denied access if it fails posture checks. The correct workflow includes reviewing the machine’s status in Cisco Secure Endpoint and marking the incident as “Resolved” in the Inbox tab to restore authentication.

This process is described in SCAZT Section 2 (User and Device Security, Pages 44–46) for enforcing endpoint trust with Secure Endpoint and Duo Trusted Endpoints integration.

Rule 3 allows all traffic (including SSH) from 10.1.0.0/30 during the hours of 18:00–08:00, which directly conflicts with Rule 1 that is intended to deny SSH at those same hours. Since firewall rules are evaluated top-down and Rule 3 allows traffic during the exact period where SSH should be blocked, deleting Rule 3 will allow Rule 1 to apply correctly.

This behavior is explained in SCAZT Section 3 (Network and Cloud Security, Pages 72–75), where rule precedence and time-based evaluation logic are discussed.

The provided JSON-like policy structure shows a segmentation rule with action " BLOCK " and filters referencing the HTTPS Consumer and HTTPS Provider. However, to block HTTP, you must define the protocol explicitly in the parameters. The attribute “l4_params” is currently empty. According to Cisco Secure Workload best practices (SCAZT Section 4: Application and Data Security, Pages 88–91), Layer 4 parameters (l4_params) must be used to specify protocols such as HTTP or port 80. Without defining HTTP here, the policy does not apply to HTTP traffic.

Cisco Extended Detection and Response (XDR) leverages telemetry from Cisco Secure Endpoint, Secure Email, Secure Network Analytics, and other sources to correlate threat detections with contextual data, such as asset value and business impact. This allows Cisco XDR to prioritize threats not only by the risk of the detection but also by the importance of the affected asset—essentially assessing the risk to business. This dynamic and context-aware prioritization method enables security teams to address the most impactful threats first.

Cisco Talos is Cisco’s threat intelligence organization, delivering real-time threat intelligence and malware analytics to help organizations detect and prevent threats before they impact the network. According to the SCAZT guide, Talos provides comprehensive coverage of threat data including signatures, indicators of compromise, and context-driven analytics. This intelligence feeds into Cisco security platforms such as Cisco SecureX and Cisco Secure Endpoint to enhance detection, investigation, and response capabilities. Talos is explicitly referenced in the Threat Response section as the primary source of threat intelligence and malware analytics that supports cloud and endpoint security frameworks.

The App Discovery function in Cisco Umbrella enables organizations to identify cloud applications in use across their environment, including unsanctioned or shadow IT services. This is crucial for risk assessments and ranking cloud services based on their risk profile.

App Discovery analyzes DNS and web traffic to detect SaaS applications and assigns a risk score to each app based on industry best practices and Cisco Talos threat intelligence.

It provides visibility into cloud service usage and supports decisions about which applications should be allowed, restricted, or blocked.

???? Reference (Cisco SCAZT Guide):

Section: Visibility and Assurance

Topic: Cisco Umbrella > App Discovery

Key Statement: " App Discovery helps identify cloud applications in use and provides risk ratings for each, allowing organizations to apply governance policies to risky or unsanctioned cloud services. "

Pages: 84–86

Rule 3 denies all DNS traffic from the subnet 10.1.0.0/30, which includes the client at 10.1.0.6. Since DNS resolution is required to resolve www.salesforce.com, this DNS deny rule is preventing the client from obtaining the IP address needed for HTTPS connection. Removing Rule 3 allows DNS traffic from the client, while Rule 4 permits it specifically for the 4.4.4.4 DNS server.

As per SCAZT Section 3: Network and Cloud Security (Pages 70–73), DNS resolution must be allowed before HTTPS connectivity is attempted. Rule priority and traffic dependency should always be considered in firewall design.

To preserve the user for investigation while immediately revoking access, the correct approach is to disable the user in the Duo Admin Panel. This action blocks authentication without deleting logs or user data. Simultaneously, resetting the password from Active Directory ensures any potentially compromised credentials are revoked.

According to SCAZT (Section 2: User and Device Security, Pages 40–44), disabling user accounts in Duo offers secure containment during security incidents while maintaining data for forensic review.

In IKEv1 policy configuration for Cisco ASA, two key commands are required to define the encryption and hashing algorithms:

A: encryption aes-256 defines the encryption method for the IKE SA.

E: hash sha-256 ensures SHA-256 is used as the integrity mechanism during IKE phase 1.

According to Cisco documentation and SCAZT (Section 1: Cloud Security Architecture, Pages 19–22), these two components are essential to negotiating a secure VPN tunnel. The provided config uses group 1 (modp768), which is weak by today’s standards and could also lead to negotiation failure. However, from the available options, encryption and hash are the two required for tunnel success.

The MITRE ATT & CK framework is a globally recognized knowledge base that catalogs adversary behavior. One of its most crucial components is its matrix of Tactics and Techniques.

“Techniques for accessing credentials” is a key example of the Techniques layer within the MITRE ATT & CK matrix.

These techniques describe how adversaries achieve tactical objectives—such as gaining access to credentials for lateral movement or privilege escalation.

In the SCAZT guide under Threat Response, organizations are advised to map telemetry and detection tools (like Cisco Secure Analytics, SecureX, and Secure Endpoint) to the MITRE ATT & CK framework to enhance visibility and accelerate threat response.

After Cloudlock is integrated with Salesforce, full visibility into objects and data requires that Cloudlock has the “View All Data” permission enabled on the connected Salesforce account. This permission allows the Cloudlock API connection to access all user data, regardless of individual field-level or sharing rules. Without it, Cloudlock will be limited in its visibility scope.

As per SCAZT (Section 4: Application and Data Security, Pages 86–89), integration with SaaS platforms like Salesforce must include enabling comprehensive data visibility to perform effective risk analysis and policy enforcement.

The screenshot from Cisco Secure Cloud Analytics shows a Role Violation alert. According to the “Supporting Observations” pane, the device with IP 10.201.0.15 is assigned the role of Domain Controller but has demonstrated traffic behavior matching an FTP client, connecting to ports 20, 21, 115, 152, 989, and 990. This discrepancy triggered the alert.

Cisco SCAZT documentation emphasizes that devices acting outside their expected network roles (e.g., a domain controller acting as an FTP client) indicate potential compromise or misuse. Role-based anomaly detection is part of Visibility and Assurance mechanisms where baseline behaviors are continuously monitored and flagged when changes occur outside expected policy or operational norms.