Pass the Cisco CCNP Security 300-740 Questions and answers with ValidTests

The provided JSON-like policy structure shows a segmentation rule with action "BLOCK" and filters referencing the HTTPS Consumer and HTTPS Provider. However, to block HTTP, you must define the protocol explicitly in the parameters. The attribute “l4_params” is currently empty. According to Cisco Secure Workload best practices (SCAZT Section 4: Application and Data Security, Pages 88–91), Layer 4 parameters (l4_params) must be used to specify protocols such as HTTP or port 80. Without defining HTTP here, the policy does not apply to HTTP traffic.

Cisco Telemetry Broker (CTB) is designed to act as an intermediary that filters, enriches, and routes telemetry data—such as NetFlow, Syslog, and SNMP—across various tools. It optimizes resource usage by preventing overload and ensures only relevant telemetry is forwarded to appropriate analytics platforms.

The SCAZT guide (Section 5: Visibility and Assurance, Pages 93–95) describes CTB’s role in applying filters and transformations to raw telemetry data to enhance visibility and reduce noise.

The Remote Desktop Protocol (RDP) uses TCP port 3389. Cisco Umbrella includes a cloud-delivered firewall that can be used to block outbound traffic by port. In this case, since the RDP communication needs to be prevented regardless of application name resolution, the best approach is to use a Firewall policy in Umbrella to block port 3389 traffic across the tunnel.

The Secure Cloud Analytics alert indicates suspicious heartbeat-based connections from an internal server (ip-10-201-0-16) to multiple suspicious IPs over UDP/port 53 (DNS). This behavior suggests command-and-control (C2) activity or botnet communications.

B: Alerting the incident response (IR) team is a critical next step in escalating a verified threat as per SCAZT Section 6 (Threat Response, Pages 114–117).

D: Blocking the identified malicious IPs on perimeter firewalls or network access control devices is an appropriate containment step to disrupt communication.

Reinstallation (A/E) is premature without a full forensic investigation. Validating IDS logs (C) is useful but not immediate response-focused compared to actions B and D.

Cisco Secure Endpoint (formerly AMP for Endpoints) includes an “Inbox” tab where detected threats and flagged endpoints are listed. When Duo Trusted Endpoints integration is in place, an endpoint may be denied access if it fails posture checks. The correct workflow includes reviewing the machine’s status in Cisco Secure Endpoint and marking the incident as “Resolved” in the Inbox tab to restore authentication.

This process is described in SCAZT Section 2 (User and Device Security, Pages 44–46) for enforcing endpoint trust with Secure Endpoint and Duo Trusted Endpoints integration.

The error %OPENDNS-3-DNS_RES_FAILURE indicates a failure to resolve DNS queries via Cisco Umbrella. The most common cause of this error is the router lacking DNS resolution capability. To resolve this, the router must be explicitly configured to use Cisco Umbrella’s OpenDNS servers by adding the following to global configuration:

According to the SCAZT guide (Section 1: Cloud Security Architecture, Pages 17–19), Umbrella enforces cloud-based DNS-layer protection, and upstream devices must be properly configured with working DNS name servers to perform redirection and inspection.

Automation of containment and response actions—such as isolating compromised endpoints and applying predefined security policies—is a critical capability of Cisco’s XDR and SecureX platform. According to SCAZT Section 6: Threat Response (Pages 112–117), automating threat containment allows security teams to rapidly limit the blast radius of incidents and improve mean time to respond (MTTR), without relying solely on manual intervention.

To integrate Cisco Webex with Duo SSO using the Duo Access Gateway, the engineer must:

E: Add Cisco Webex as a new SAML application to Duo.

C: Configure the Webex application settings, including Entity ID, Assertion Consumer Service URL, and signing requirements.

Uploading XML metadata (Option A) is typically used when importing IdP settings, not for Duo application configuration. JSON (Option B) is not used in SAML-based Duo app configurations.

The Secure Cloud Analytics alert log shows multiple SSH connections on port 22 from diverse and geographically distributed IP addresses targeting a single GCP instance (www-gcp-east-4c). According to the Cloud Analytics alert logic described in SCAZT (Section 6: Threat Response, Pages 113–116), this behavior indicates “Geographically Unusual Remote Access.” It typically triggers when a host receives connections from countries not normally associated with the network’s usage profile. This is often linked to reconnaissance or brute-force SSH attempts.

Web Application Firewalls (WAFs) use rate-based rules as one of the primary mechanisms to detect and mitigate Distributed Denial of Service (DDoS) attacks. According to the SCAZT Study Guide, Section 3 (Network and Cloud Security, Pages 74–77), rate-based rules dynamically detect unusual spikes in traffic and can throttle or block connections exceeding predefined thresholds. This form of protection is more adaptive and intelligent than standard ACLs or static filtering, enabling protection against zero-day and volumetric attacks that may not follow known patterns.