Prepare Smarter for the 300-740 Exam
Build your exam confidence with flexible preparation resources designed around the latest 300-740 exam objectives. Practice at your own pace using PDF questions, online exam simulations, or desktop practice software.
Which attack mitigation must be in place to prevent an attacker from authenticating to a service using a brute force attack?
Correct Answer: D
Multifactor Authentication (MFA) is one of the most effective mitigations against brute-force attacks. Even if an attacker guesses or steals a user’s password, they would still need a second authentication factor (e.g., push notification, hardware token, biometric verification) to complete login.
An engineer is configuring multifactor authentication using Duo. The implementation must use Duo Authentication Proxy and the Active Directory as an identity source. The company uses Azure and a local Active Directory. Which configuration is needed to meet the requirement?
Correct Answer: D
When integrating Duo Authentication Proxy with Active Directory for multifactor authentication (MFA), you must:
Configure the Identity Source in the Duo Admin Panel as Active Directory (not SAML), since it’s using the Authentication Proxy.
Configure the authentication proxy settings in the [sso] section to communicate with both AD and the Duo cloud.
This setup allows Active Directory to be the primary identity store while Duo provides the second authentication factor.
Which concept is used in the Cisco SAFE key reference model?
Correct Answer: A
The Cisco SAFE architecture uses the concept of Secure Domains as foundational blocks. These domains represent areas of the network (e.g., Branch, Data Center, Cloud, Edge) that require specific security controls. Each domain aligns with controls across visibility, segmentation, threat protection, and identity services.
An administrator must deploy an endpoint posture policy for all users. The organization wants to have all endpoints checked against antimalware definitions and operating system updates and ensure that the correct Secure Client modules are installed properly. How must the administrator meet the requirements?
Correct Answer: C
Cisco Identity Services Engine (ISE) is the central policy engine for posture assessments. As outlined in the SCAZT guide (Section 2: User and Device Security, Pages 39–44), to implement posture assessment and client provisioning correctly, an administrator must create posture policies within Cisco ISE and configure the Network Access Device (NAD)—such as a switch, WLC, or firewall—for redirection. This redirection sends the user to the posture portal, where ISE verifies the Secure Client modules (such as AnyConnect) and enforces compliance with antivirus signatures and OS updates.
ISE evaluates endpoint health based on pre-defined compliance rules and supports automatic remediation via the client provisioning portal. This ensures consistency and policy enforcement across distributed environments.
Which mitigation technique does a web application firewall use to protect a web server against DDoS attacks?
Correct Answer: D
Web Application Firewalls (WAFs) use rate-based rules as one of the primary mechanisms to detect and mitigate Distributed Denial of Service (DDoS) attacks. According to the SCAZT Study Guide, Section 3 (Network and Cloud Security, Pages 74–77), rate-based rules dynamically detect unusual spikes in traffic and can throttle or block connections exceeding predefined thresholds. This form of protection is more adaptive and intelligent than standard ACLs or static filtering, enabling protection against zero-day and volumetric attacks that may not follow known patterns.