01. A service is under two simultaneous denial-of-service pressures: a volumetric network-layer flood is saturating the link into the site, while an HTTP flood of seemingly valid requests is hammering the application itself.
How should the work be divided between an upstream scrubbing service and the web application firewall?
a) The upstream scrubbing service handles both the volumetric flood and the HTTP flood, and the web application firewall plays no part in the response.
b) The upstream scrubbing service absorbs the volumetric network flood before it reaches the link, and the web application firewall mitigates the application-layer HTTP flood.
c) The application server's own connection limits absorb the HTTP flood, and the link's available bandwidth is left to soak up the volumetric flood on its own.
d) The web application firewall inspects and absorbs both the volumetric network flood and the HTTP flood from a single point at the application edge.
02. A team has deployed zero-trust micro-segmentation and now needs evidence that the policy is actually being enforced as designed, not merely configured.
Which observations validate that the segmentation is working as intended?
(Choose two.)
a) More users successfully authenticated to applications during the measurement window.
b) Unexpected cross-segment connection attempts outside the policy are denied and logged at the enforcement point.
c) The number of firewall rules in the configuration grew compared with the previous quarter.
d) The observed east-west flows match the allow-list baseline defined for each segment.
e) Total aggregate bandwidth and peak throughput across the data center increased after the rollout.
03. In a cloud security platform, traffic from users must be evaluated by the secure web gateway, then the CASB, then the cloud firewall, each in a defined order, within a single pass.
Which mechanism arranges this?
a) DNS-based load balancing that distributes each session across the available services so that the processing load is spread evenly.
b) A separate hairpin to each service in turn, where the endpoint sends traffic out and back once per control before continuing.
c) A policy-based routing rule on the edge router that forwards packets to whichever service appliance has the lowest current utilization.
d) Security service insertion, which steers each flow through the stacked cloud services in the configured sequence within one pass.
04. After Cisco XDR correlates an intrusion into a single prioritized incident, the team wants the same set of containment steps to run automatically every time a matching incident appears, instead of an analyst repeating them by hand.
What connects the correlated visibility to consistent action?
a) Automated response playbooks triggered directly from the correlated incident.
b) An extra telemetry source attached to the incident to give responders more context before they act.
c) A written runbook that an analyst opens and follows step by step each time a similar incident recurs.
d) A scheduled summary report emailed to the on-call analyst at the start of every shift for manual review.
05. During an audit a team learns that a developer committed a cloud access secret into a Git repository several months ago. The secret has already been rotated. Leadership now wants a mechanism that will detect a secret that reaches the code and prevent the same mistake from recurring.
Which approach addresses that goal?
a) A reduction of repository access to a smaller group of developers and a sign-off step before any new member is added.
b) Automated secret scanning in the repository and build pipeline, plus a secrets vault that injects short-lived credentials at runtime.
c) A scheduled rotation of the exposed secret that replaces it with a fresh value on a fixed, recurring interval and records each change in a central log for review.
d) A rewrite of the repository history that purges the secret from every past commit, then force-updates the shared branches afterward.
06. Employees sometimes visit risky, uncategorized sites that could execute malicious scripts on their laptops. The organization wants users to keep browsing these sites while ensuring no page code ever runs locally.
Which control achieves this?
a) A URL-filtering block on the uncategorized category, which denies the sites and keeps users from opening them on a corporate device at all.
b) Endpoint anti-malware that scans each downloaded file against known signatures after the browser has already fetched and rendered the page.
c) Remote browser isolation, which runs the session in a remote container and streams back only a safe rendering of the page.
d) A host-based intrusion prevention agent that watches for exploit behavior and terminates the browser the instant it detects one.
07. After gaining a foothold, an attacker registers a new scheduled task and installs a background service on a host, specifically so that their access is automatically re-established if the machine is rebooted.
Which MITRE ATT&CK tactic does creating these mechanisms represent?
a) Persistence
b) Defense Evasion
c) Privilege Escalation
d) Execution
08. A multinational organization is subject to a law requiring that certain categories of data, and the keys that protect them, remain physically within one legal region even though the organization operates across several cloud providers.
Which design satisfies the residency requirement?
a) Replicate the data and its keys across all regions for availability, balance requests among the copies, and rely on access controls to limit who can read each one.
b) Store the data in region-pinned locations, keep its keys in that same region, and enforce a policy that stops either from leaving.
c) Store the data wherever capacity is cheapest, encrypt it at rest, and treat its physical location as no longer relevant once it is encrypted.
d) Keep the data in its home region, manage its keys from a single global key service, and synchronize the controlling policy from that central point.
09. Telemetry from dozens of sources is overwhelming the SIEM with low-value data, and three downstream tools each require their own copy of the same streams. The team needs to redesign the pipeline so the SIEM carries less noise while every consumer still gets what it needs.
Which pipeline design meets both goals?
a) Point all sources straight at the SIEM, then let every downstream tool pull and filter the data it needs from the SIEM's stored indexes afterward.
b) Raise the SIEM's ingestion licensing and storage tier so it can absorb the full raw volume arriving from every source.
c) Disable the noisiest sources at the device so the overall telemetry volume drops before anything is forwarded.
d) Insert a Telemetry Broker that filters and transforms the streams, then replicates the refined telemetry to each consumer.
10. Access to a private application is granted only to compliant devices. The security team is concerned that a device can pass the posture check at login and then have its security state degrade — a disabled firewall, a stopped agent — while the session continues.
Which access-path design addresses this?
a) ZTNA that evaluates device posture continuously through the session and restricts or revokes access the moment the device falls out of compliance.
b) A VPN that authenticates the device with a certificate and keeps the tunnel open until the session times out or the user manually disconnects it.
c) ZTNA that performs a single thorough posture assessment at authentication time and then trusts that result for the entire remainder of the session.
d) A network access control sweep that scans connected devices on a fixed schedule and emails a report of any that fail.
The Cisco 300-740 Certification Sample Questions on this page help you become familiar with the question style and knowledge areas of the Cisco Certified Specialist Security Secure Cloud Access (SSCA) exam. Each question is written to reflect the syllabus topics and the level of understanding the certification expects, so you can see how theoretical concepts are tested in practice. Working through them lets you check your understanding, identify topics that need further study, and get comfortable interpreting certification-style questions before you sit the official exam.
