Free 300-745 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

In the realm of Artificial Intelligence and DevSecOps, watermarking is a critical security technique

used to identify the origin of synthetic media. As generative AI models become increasingly

sophisticated, they can create highly realistic images, videos, and audio clips—often referred to as

deep fakes. These deep fakes pose a significant risk to organizational security and public trust, as

they can be used for sophisticated social engineering attacks, such as impersonating executives in

"Business Email Compromise" (BEC) scenarios or spreading misinformation.

By embedding a cryptographic or perceptible watermark into AI-generated content, security systems

and users can verify the authenticity and provenance of the media. This proactive measure helps

prevent the successful deployment of deep fakes by making it easier for automated security tools to

flag synthetic content that lacks a valid "signature" of origin. While watermarking does not inherently

stop the creation of harmful content (Option C) or reduce resource consumption (Option A), it

provides a layer of accountability and verification. Similarly, scale changes (Option D) are technical

image manipulations that watermarking does not prevent. Within the Cisco SDSI framework,

watermarking is viewed as an essential component of the AI security lifecycle, ensuring that

generative technologies are used responsibly and that synthetic content is distinguishable from

genuine data.

========

Cisco Umbrella is a cloud-delivered Secure Access Service Edge (SASE) solution that provides the first line of defense against internet threats. By deploying the Umbrella roaming client on corporate laptops, an organization can enforce security policies for users regardless of their location. Administrators can create and apply policies that block access to specific content categories, such as social media and personal webmail, at the DNS layer. This directly addresses the requirement to prevent remote employees from accessing non-work-related sites on company-owned devices, enforcing the policy effectively even when users are off the corporate network.

A. Cisco TrustSec: This solution provides network segmentation and access control based on user/device identity (SGTs) within the corporate network, not web content filtering for remote users.

B. RADIUS server: A RADIUS server is used for centralized Authentication, Authorization, and Accounting (AAA) services, such as for VPN or Wi-Fi access, but does not filter web content.

D. network monitoring tool: This type of tool provides visibility and analysis of network traffic. It can report on policy violations but does not actively enforce policies by blocking access.

---

1. Cisco Umbrella Documentation, "Manage Policies": "Content categories organize destinations—domains, IPs, and URLs—into categories based on the type of content they host... You can block all destinations that fall into a content category." This document explicitly details the feature used to block categories like social media. (Source: Cisco Umbrella Documentation, "Content Categories" section).

2. Cisco Press, "CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide": Chapter 22, "Cisco Umbrella," states, "Cisco Umbrella provides the first line of defense against threats on the internet... It can be used to protect employees both on and off the corporate network... Umbrella allows administrators to create policies to allow or block access to specific domains or categories of domains." (ISBN: 978-0135971970, Page 785).

3. Cisco, "Cisco TrustSec Solution Design Guide": This guide describes TrustSec's function: "The Cisco TrustSec solution provides software-defined segmentation to simplify the provisioning of network access, accelerate security operations, and consistently enforce policy across the network." Its focus is on network segmentation via SGTs, not URL/content filtering. (Source: Cisco Design Zone for Campus, "Cisco TrustSec Solution Design Guide," Introduction).

Generative AI is used in network security primarily for advanced anomaly and threat detection. Models like Generative Adversarial Networks (GANs) are trained on extensive datasets of normal network traffic to learn its underlying patterns and characteristics. The model can then either generate synthetic "normal" traffic or learn to discriminate between normal and abnormal data. When live network traffic deviates significantly from this learned baseline of normalcy, the system flags it as an unusual pattern or a potential threat. This allows for the detection of novel, zero-day attacks and sophisticated threats that might evade traditional signature-based security systems.

A. Real-time load balancing is a network availability and performance function, not a primary security application of generative AI.

B. Improving resource consumption is an operational efficiency or network optimization task, not a direct security function.

C. While AI can assist in analyzing audit logs, performing real-time regulatory compliance audits is typically handled by specialized, rule-based security policy and compliance management tools.

1. Cisco Official Blog: In the article "How Generative AI is Revolutionizing Cybersecurity," it is stated, "Generative AI can be used to detect anomalies and potential threats in network traffic by learning the patterns of normal behavior and flagging any deviations. This can help organizations to identify and respond to threats more quickly and effectively." (Cisco Blogs, "How Generative AI is Revolutionizing Cybersecurity," May 24, 2023, Section: "Threat detection and response").

2. Cisco Official Blog: The article "Generative AI: The CISO’s new ally" explains that a key use case is "Threat Detection and Response," where generative AI analyzes "vast datasets of security telemetry to identify subtle patterns and anomalies that may indicate a sophisticated attack." (Cisco Blogs, "Generative AI: The CISO’s new ally," August 2, 2023, Section: "Key use cases for generative AI in cybersecurity").

3. Peer-Reviewed Academic Publication: A survey on using GANs for security highlights their effectiveness in anomaly detection. "GANs are trained on normal data... to learn the distribution of the normal data. During testing, GANs identify test data as anomalies if they have a low probability of being generated from the learned distribution." This directly corresponds to detecting unusual patterns. (Chalapathy, R., & Chawla, S. (2019). Deep Learning for Anomaly Detection: A Survey. arXiv preprint arXiv:1901.03407, Section 4.2.1 Generative Adversarial Networks). DOI: https://doi.org/10.48550/arXiv.1901.03407

The core requirement is to identify who logged into a system during a specific period for a security investigation. This task is the primary function of the AAA (Authentication, Authorization, and Accounting) framework. The Accounting component of AAA is specifically designed to collect and log data about user activity, including session start/stop times, commands executed, and resources accessed. These logs are essential for security audits, forensics, and troubleshooting, directly addressing the engineer's need to identify user logins during the breach.

A. SNMP: Simple Network Management Protocol (SNMP) is used for monitoring and managing network devices' operational status and performance, not for auditing user access to application systems.

B. NACM: NETCONF Access Control Model (NACM) is a specific standard used to control user access to network configuration and state data via the NETCONF protocol, not a general system access framework.

D. PKI: Public Key Infrastructure (PKI) is a framework for managing digital certificates and public-key encryption. While it can be used for authentication, it does not provide the accounting/logging function needed here.

1. Cisco IOS XE Security Configuration Guide, Cisco IOS XE Bengaluru 17.6.x - AAA Overview: "Accounting provides a method for collecting and sending security server information used for auditing, billing, and reporting... When AAA accounting is enabled, the network access server reports user activity to the TACACS+ or RADIUS security server". This directly supports the use of AAA for auditing user activity.

2. Cisco Identity Services Engine Administrator Guide, Release 3.1 - Chapter: Reports > View and Manage Reports: "Cisco ISE provides a robust logging mechanism that you can use to create reports of all activity on your network... You can generate reports for authentication, authorization, and accounting (AAA) events." This shows how a Cisco AAA implementation (ISE) is used for reporting on access events.

3. RFC 2866 - RADIUS Accounting: Section 1, "Introduction," states, "This document describes the RADIUS Accounting protocol. This protocol can be used to convey information about how a user is making use of a resource." This foundational document establishes accounting as the mechanism for tracking user resource usage, including logins.

4. Cisco IOS XE SNMP Configuration Guide, Cisco IOS XE Gibraltar 16.12.x - SNMP Overview: "The Simple Network Management Protocol (SNMP) is an application-layer protocol that provides a message format for communication between SNMP managers and agents. SNMP provides a standardized framework and a common language used for the monitoring and management of devices in a network." This reference confirms SNMP's role is network management, not user access auditing.

The first and most fundamental step in responding to a vulnerability disclosure is to identify and validate if the organization is affected. Before any mitigation, impact analysis, or communication can occur, the security team must confirm that the vulnerable product is present within their environment. This initial asset and vulnerability identification step is critical to determine the scope of the problem and to ensure that all subsequent response efforts are focused, efficient, and relevant to the actual risk posture of the university. This aligns with the "Detection and Analysis" phase of standard incident response lifecycles.

A. Leveraging IDS to measure the impact of the vulnerability is a subsequent analysis step, not the first action. It assumes the vulnerable asset has already been identified.

B. Notifying customers before confirming the vulnerability's presence and assessing its actual impact is premature and could cause unnecessary alarm and confusion.

D. Patching is a remediation action. It should only be performed after the vulnerable systems have been identified, the risk has been assessed, and the patch has been tested.

---

1. NIST Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide. Section 2.3.2, "Detection and Analysis," states: "The analysis phase involves, in part, validating the incident... This analysis is necessary to confirm that an incident has occurred and to determine its scope." This supports the principle of first confirming the presence of the vulnerability before taking other actions.

2. Cisco, Security Vulnerability Policy. The "Customer's Role" section implicitly guides customers through a process that begins with awareness and identification. It states, "Customers should... determine which of their systems are affected by a vulnerability." This highlights that the initial responsibility is to identify the affected assets in their own environment.

3. NIST Special Publication 800-40 Rev. 4, Guide to Enterprise Patch Management Technologies. Section 2.2, "Patch Management Process," outlines the lifecycle which begins with asset and software inventory. It emphasizes that organizations must "know what systems are on their network and what software is on those systems" as a prerequisite for effective patch and vulnerability management. This directly supports validating the product's presence as the first step.

A Security Information and Event Management (SIEM) system is the core tool used by a Security Operations Center (SOC) for incident prioritization. Its primary function is to aggregate log and event data from a wide array of security tools and IT infrastructure, including endpoints, network devices, and cloud services. The SIEM then correlates this disparate data to identify potential security incidents, enriches them with context, and assigns a severity level. This centralized analysis and scoring mechanism enables SOC analysts to effectively prioritize incidents based on their potential impact, allowing them to focus on the most critical threats first.

B. endpoint detection and response: EDR provides deep visibility and threat detection on endpoints but lacks the enterprise-wide, cross-source correlation needed for overall SOC incident prioritization.

C. CloudWatch: This is a monitoring service specific to the Amazon Web Services (AWS) ecosystem and is not a comprehensive tool for prioritizing incidents across an entire hybrid enterprise.

D. endpoint protection platform: EPP is primarily a preventative tool focused on blocking known threats at the endpoint. It is a data source for a SIEM, not the central prioritization engine.

---

1. Cisco Press, CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide. Chapter 25, "Security Operations," Section: "Security Information and Event Management (SIEM)". The text explains that a SIEM is a "foundational tool for any SOC" that "collects, normalizes, and correlates log and event data from various sources" to provide a "holistic view of an organization's security posture," which is fundamental to prioritizing incidents.

2. Cisco White Paper, Building the Modern SOC: A Strategic Guide. Section: "The Role of SIEM in the Modern SOC". This document states, "The SIEM is the core of the SOC, providing the central point for collecting, correlating, and analyzing security data from across the enterprise." This central role is what facilitates effective prioritization.

3. NIST Special Publication 800-92, Guide to Computer Security Log Management. Section 3.2.3, "Log Analysis". This publication details the process of log correlation, a core SIEM function, which is essential for "identifying and understanding events of interest from the log data." This identification and understanding is the prerequisite for prioritization.

Human in the loop (HITL) is a fundamental design policy for responsible AI that incorporates human oversight into the AI system's operational process. In the context of generative AI, HITL serves as a critical safety mechanism where a human can review, filter, or approve content before it is finalized or disseminated. This direct intervention is essential for identifying and preventing the creation of nuanced, contextually-sensitive, or novel harmful content that automated filters might miss. It is a core component of AI governance aimed at ensuring accountability and mitigating the risks of misuse.

A. quantum resistant encryption: This is a cryptographic method to secure data against threats from quantum computers; it is unrelated to managing AI-generated content.

B. watermarking: This technique embeds identifiers into AI-generated content for provenance and detection, but it does not prevent the initial creation of harmful material.

C. retrieval augmented generation: This architecture improves the factual accuracy of AI responses by using external data but does not inherently prevent the generation of harmful content.

---

1. Cisco Systems, Inc. (2023). Cisco Responsible AI Framework.

Reference: Page 6, "Accountability" Principle.

Quote: "We are accountable for our AI systems, and we implement human-in-the-loop governance to ensure our AI systems operate as intended. This includes monitoring and measuring system performance and impact on an ongoing basis." This directly links HITL to governance and ensuring AI operates as intended, which includes preventing harmful outputs.

2. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). NIST AI 100-1.

Reference: Page 16, Section 3.2, "GOVERN" Function.

Details: The GOVERN function is a core part of the framework and emphasizes that "human oversight is present" and that policies should be in place for "human review, and intervention." This establishes HITL as a key policy for managing AI risks, including the generation of harmful content.

3. Weidinger, L., et al. (2021). Taxonomy of Risks posed by Language Models. In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency (FAccT '22).

Reference: Page 225, Section 5.1, "Mitigation approaches".

Details: This peer-reviewed paper discusses mitigation strategies for risks from large language models. It explicitly lists "Human-in-the-loop (HITL) content moderation and review" as a key mitigation approach for risks such as discrimination, hate speech, and misinformation, which fall under the umbrella of harmful content.

DOI: https://doi.org/10.1145/3531146.3533088

The company requires a solution to proactively inspect incoming traffic and block known malicious files before they reach endpoints. A next-generation firewall (NGFW) is designed for this purpose. Unlike traditional firewalls, an NGFW integrates advanced security features such as deep packet inspection (DPI), an intrusion prevention system (IPS), and advanced malware protection (AMP). These capabilities allow the NGFW to analyze the content of network traffic, identify malicious files based on signatures, hashes, or behavioral analysis, and block them at the network perimeter. This adds a crucial layer of preventative security that complements the existing reactive endpoint detection and response (EDR) system.

B. traditional firewall: A traditional firewall operates at Layers 3 and 4, filtering traffic based on IP addresses and ports, but lacks the ability to inspect file content for malware.

C. host-based firewall: This operates on the individual endpoint. The goal is to prevent the malicious file from reaching the endpoint in the first place, which requires a network-level solution.

D. eBPF: This is a powerful in-kernel virtual machine technology used for networking and observability, not a standalone security product designed for advanced threat filtering.

1. Cisco, "What Is a Next-Generation Firewall (NGFW)?" (Official Vendor Documentation). In the section "Key functions of an NGFW," it states: "Unlike most traditional firewalls, NGFWs include... advanced malware protection... An NGFW can block malware from entering a network, averting an infection in the first place." This directly supports the use of an NGFW to prevent malicious files from being delivered.

Source: Cisco.com, "What Is a Next-Generation Firewall (NGFW)?", Accessed from Cisco's main website under Products & Services > Security.

2. Cisco Secure Firewall Data Sheet. (Official Vendor Documentation). This document details the capabilities of Cisco's NGFW solution. Under the "Stop more threats" section, it lists "Advanced Malware Protection (AMP)" as a key feature that "continuously analyzes file activity across your extended network... to quickly detect, block, and contain malware."

Source: Cisco Secure Firewall Data Sheet, Page 2, "Features and benefits" table.

3. Omar Santos, CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide, Cisco Press, 2020. Chapter 11, "Next-Generation Firewall and Intrusion Prevention Systems," explains that NGFWs provide application visibility and control (AVC), NGIPS, and Advanced Malware Protection (AMP). It clarifies that traditional stateful firewalls "do not have the capability to identify and block traffic based on applications or to protect the network against complex attacks and malware."

Source: Chapter 11, "Next-Generation Firewall (NGFW)" section.

Polymorphic malware is designed to evade traditional signature-based security tools by constantly changing its code. A stateful firewall lacks the deep inspection capabilities to counter this. A heuristics-based Intrusion Prevention System (IPS) is the necessary technology to address this threat. Unlike signature-based systems that look for known malicious patterns, a heuristics-based IPS analyzes the behavior of network traffic and executable code. It identifies suspicious actions and characteristics (e.g., unusual port access, attempts to modify system files, communication with known command-and-control servers) that are common to malware, regardless of its specific signature. This behavioral analysis is effective at detecting and blocking previously unseen or polymorphic malware variants, fulfilling the company's goal.

A. A web application firewall is specialized for protecting web applications from attacks like SQL injection and XSS, not for general network malware detection.

B. Physical security controls protect against unauthorized physical access to equipment and facilities, which is irrelevant to defending against software-based malware threats.

C. A network performance monitor is designed to track operational metrics like latency and bandwidth utilization, not to perform security analysis or detect malicious code.

1. Cisco, Cisco Secure IPS (formerly Firepower NGIPS) Data Sheet: "Cisco Secure IPS provides multiple layers of advanced threat protection. It stops more threats, including both known and unknown attacks, with one of the industry’s most effective IPS... It continuously analyzes network activity for suspicious behavior to rapidly detect and stop stealthy attacks before they cause damage." This highlights the capability to stop unknown attacks through behavioral analysis, which is key to defeating polymorphic malware.

2. NIST Special Publication 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS), Section 2.2.2, "Detection Methodologies": This document describes anomaly-based detection, a category that includes heuristics. It states, "The primary benefit of anomaly-based detection is that it can be effective at detecting previously unknown threats." This directly supports the use of such systems against new variants like polymorphic malware.

3. Cisco Press, CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide, Chapter 20, "Intrusion Prevention and Content Security": The guide explains that Next-Generation IPS (NGIPS) goes beyond static signatures. It discusses how these systems use "policy and rule sets that can be based on traffic anomalies, compliance, or behavior," which is the principle behind using heuristics to identify and block threats like polymorphic malware that signature-based methods would miss.

A distributed firewall is an architecture where firewall policy enforcement is pushed out to each workload or host, typically as a software agent or hypervisor-level function. This model is ideal for multi-cloud environments because a central management console can define and push consistent security policies to all workloads, regardless of which cloud provider they reside on. This approach provides centralized visibility and management while offering seamless scalability, as security is an inherent part of each new workload deployed, directly meeting all the stated requirements.

A. traditional firewall: This model relies on centralized hardware or virtual appliances at the network perimeter, which creates traffic bottlenecks and is difficult to scale and manage consistently across different cloud provider networks.

B. zone-based firewall: This is a policy configuration model for network devices, not a firewall type itself. It is still tied to network topology and is not inherently suited for dynamic, multi-cloud workload protection.

D. host-based firewall: While it operates on the host, managing individual host firewalls (like iptables or Windows Firewall) at scale across multiple clouds without a unifying distributed architecture is operationally complex and lacks centralized visibility.

1. Cisco Secure Workload At-A-Glance: "Cisco® Secure Workload (formerly Tetration) provides a zero-trust approach for securing your application workloads across any cloud and on-premises data center environments... Gain a single source of truth for application dependencies and policy enforcement across your hybrid and multicloud environment." This document describes a system that functions as a distributed firewall, meeting the requirements of centralized management and multi-cloud consistency.

Source: Cisco, "Cisco Secure Workload At-A-Glance," Page 1.

2. NIST Special Publication 800-207, Zero Trust Architecture: This publication describes the use of Policy Enforcement Points (PEPs) that can be "a single, dedicated network appliance (a gateway) or a distributed agent on each asset." The distributed agent model is the foundation of a distributed firewall, enabling micro-segmentation and consistent policy enforcement across diverse environments.

Source: National Institute of Standards and Technology (NIST), SP 800-207, "Zero Trust Architecture," August 2020, Section 3.2.2, Page 15.

3. Cisco Live Presentation BRKSEC-3010, "Advanced Micro-segmentation with Cisco Secure Workload": This session details how a distributed architecture is used to enforce security policies directly at the workload. It states, "The enforcement is distributed, it's close to the workload... you have a central place where you define the policy, and then that policy gets distributed and rendered into the native enforcement points." This directly aligns with the requirements for centralized management and scalable, consistent policy in a multi-cloud scenario.

Source: Cisco Live Presentation, BRKSEC-3010, 2022. (Concept described in sections on distributed enforcement).

The requirement is to prevent communication between devices within the same VLAN without using dynamic access control lists (dACLs). Cisco TrustSec is the technology designed for this purpose. It provides micro-segmentation by assigning Security Group Tags (SGTs) to endpoints based on their identity or role, as determined by Cisco ISE. Network devices, such as switches, then enforce communication policies using a Security Group ACL (SGACL) matrix. This allows for granular, identity-based policy enforcement that is independent of network topology (like VLANs or IP subnets), effectively isolating hosts even if they reside on the same logical network segment.

A. Implement device posturing: Posturing assesses an endpoint's security compliance (e.g., antivirus status) to determine its level of network access, but it does not enforce traffic policies between devices.

B. Set up endpoint profiling: Profiling identifies and classifies endpoints to inform policy decisions (like assigning a VLAN or SGT), but it is not the mechanism that enforces the communication rules.

C. Enable identity groups: Identity groups are logical containers within ISE used to group users or endpoints for easier policy management; they do not directly implement traffic segmentation on the network.

1. Cisco Identity Services Engine Administrator Guide, Release 3.1, "TrustSec" Chapter, "Cisco TrustSec Solution" section: "Cisco TrustSec technology provides network segmentation by using security groups. This segmentation simplifies network management by defining security policies that are independent of the network topology. In a Cisco TrustSec-enabled network, you can provision network access control based on the user and device identity and roles, and not IP addresses." This highlights that TrustSec operates independently of VLANs and IP-based ACLs.

2. Cisco SD-Access Solution Design Guide (CVD), Chapter 2: "Solution Components and Architecture", Section: "Group-Based Policy": "Micro-segmentation... provides for the ability to create granular policies that can limit the lateral movement of a threat... This is accomplished by using Cisco TrustSec technology with security group tags (SGTs) that represent a logical grouping of users and things. The policy between SGTs is represented in a matrix form, which is centrally managed from Cisco ISE and pushed to the network devices for enforcement." This confirms TrustSec's role in granular, intra-segment policy enforcement.

3. TrustSec Segmentation and Policy Enforcement Design Guide, "Introduction to TrustSec" section: "TrustSec provides topological-independent, role-based segmentation... This is a significant improvement over traditional segmentation methods that rely on VLANs, ACLs, and firewall rules... Policy enforcement is performed on the destination network device by comparing the SGT of the source with the DGT (Destination Group Tag) of the destination in the SGACL matrix." This explicitly contrasts TrustSec with traditional ACLs and confirms its mechanism for intra-VLAN segmentation.

A Web Application Firewall (WAF) is the correct solution as it is specifically designed to operate at the application layer (Layer 7) of the OSI model. It inspects the content of HTTP/HTTPS traffic, including request headers, to identify and block malicious activity targeting web applications. By analyzing the structure and content of headers, a WAF can enforce policies against malformed or invalid requests, effectively mitigating the type of attack described and protecting the web servers from exploitation.

A. antivirus software: This software is designed to detect and remove file-based malware on a host system; it does not inspect live network traffic for malformed HTTP headers.

B. traditional firewall: A traditional firewall operates at the network and transport layers (Layers 3 and 4), filtering traffic based on IP addresses and ports, but lacks the capability to inspect application-layer data like HTTP headers.

D. host-based firewall: This firewall runs on an individual server and typically controls network access at Layers 3 and 4 for specific applications, but it does not perform deep packet inspection of HTTP content.

---

1. Cisco. (n.d.). What Is a WAF (Web Application Firewall)? Cisco. Retrieved from https://www.cisco.com/c/en/us/products/security/what-is-a-waf-web-application-firewall.html

Reference Point: In the "How does a WAF work?" section, it states, "A WAF sits in front of a web application... and analyzes all HTTP (web) traffic... It works by applying a set of rules, often called policies, to the traffic. These policies can help filter out malicious traffic." This confirms its role in inspecting HTTP traffic to block threats.

2. OWASP Foundation. (n.d.). Web Application Firewall. OWASP. Retrieved from https://owasp.org/www-community/WebApplicationFirewall

Reference Point: The document defines a WAF as a security solution that "monitors, filters or blocks HTTP/S traffic to and from a web service." It further explains that WAFs are "able to detect and prevent many of the most common attacks... by inspecting HTTP traffic." This directly supports the use of a WAF for the described scenario.

3. Cisco. (n.d.). What Is a Firewall? Cisco. Retrieved from https://www.cisco.com/c/en/us/products/security/firewalls/what-is-a-firewall.html

Reference Point: The section "Types of firewalls" describes packet-filtering firewalls (traditional firewalls) as operating "at the network layer... They don’t check the payload of the packet." This clarifies why a traditional firewall is an incorrect choice for inspecting HTTP header content.

MITRE CAPEC (Common Attack Pattern Enumeration and Classification) is a publicly accessible and community-driven catalog of common attack patterns. Its primary purpose is to provide a standardized language and structure for describing how adversaries exploit weaknesses in applications and other cyber-enabled capabilities. Security engineers use CAPEC during threat modeling to systematically identify and evaluate potential attack vectors that could be used against the system being designed, ensuring a more comprehensive security analysis.

A. Cisco SAFE: This is a security reference architecture that provides design guidance and best practices for building secure networks, not a catalog of specific attack patterns for threat modeling.

B. GDPR: The General Data Protection Regulation is a legal framework for data protection and privacy in the European Union. It is a compliance requirement, not a technical attack framework.

D. SOC2: Service Organization Control 2 is an auditing framework that reports on controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy.

---

1. MITRE Corporation. (n.d.). About CAPEC. CAPEC™. Retrieved from https://capec.mitre.org/about/index.html.

Reference Specifics: The "About CAPEC" page states, "CAPEC is a comprehensive dictionary and classification taxonomy of known attacks that can be used by analysts, developers, testers, and educators to advance community understanding and enhance defenses." This directly aligns with the question's need for a framework of attack patterns.

2. Cisco. (2022). Cisco DevSecOps Validated Design Guide. Cisco.

Reference Specifics: Chapter 3, "Threat Modeling," discusses the importance of identifying threats during the design phase. It states, "Threat modeling is a process by which potential threats...can be identified, enumerated, and prioritized." While this guide focuses on methodologies like STRIDE, it establishes the practice of using structured frameworks, for which CAPEC is a prime example for attack patterns.

3. Barnum, S., & Gegick, M. (2005). Common Attack Pattern Enumeration and Classification (CAPEC). MITRE Corporation.

Reference Specifics: Section 1, "Introduction," describes the motivation for CAPEC: "The goal of CAPEC is to provide a publicly available catalog of attack patterns along with a comprehensive schema and classification taxonomy." This document is one of the foundational papers explaining the purpose and structure of the framework.

In the architecture of modern security, Artificial Intelligence (AI) and Machine Learning (ML) are

leveraged to move beyond reactive, signature-based defenses. One of the most significant uses of AI

in securing network infrastructure is the detection of zero-day attacks (often referred to in exam

contexts as "day zero" attacks). A zero-day attack exploits a vulnerability that is unknown to the

software vendor or the public, meaning no signature exists for traditional firewalls or antivirus

software to block it.

AI identifies these threats through behavioral analysis and anomaly detection. By establishing a

highly granular baseline of "normal" network traffic patterns—including flow direction, packet size,

inter-packet arrival times, and protocol behavior—AI models can detect subtle deviations that

indicate a malicious exploit. For example, Cisco Secure Network Analytics (formerly Stealthwatch)

and Encrypted Threat Analytics (ETA) use ML to identify the cryptographic "fingerprints" of malware

even within encrypted traffic, without the need for decryption. This allows the security infrastructure

to identify and mitigate threats at the moment they appear, rather than waiting for a vendor to

release a signature. While load balancing (Option B), traffic shaping (Option C), and Quality of Service

(Option D) are critical for network performance and availability, they are traditional traffic

engineering functions that do not inherently provide the advanced threat detection capabilities

offered by AI-driven security models. Within the Cisco SDSI objectives, AI is positioned as the

primary technology for achieving proactive visibility and reducing the "Mean Time to Detect" (MTTD)

for previously unseen vulnerabilities.

In the context of the Designing Cisco Security Infrastructure (300-745 SDSI) blueprint, Dynamic

Multipoint VPN (DMVPN) is the specialized architectural solution designed for scalable hub-and-

spoke topologies that require the flexibility to evolve into partial or full mesh overlays. DMVPN

leverages a combination of Multipoint GRE (mGRE) tunnels, Next Hop Resolution Protocol (NHRP),

and IPsec encryption to create a dynamic environment.

The primary advantage of DMVPN is its ability to establish "on-demand" tunnels between spoke

sites. In a traditional hub-and-spoke model, traffic between two spokes must transit the hub, which

introduces latency and increases hub resource consumption. With DMVPN, spokes can use NHRP to

discover the public IP addresses of other spokes and build direct tunnels between them

automatically. This allows the pharmaceutical company to maintain a simple hub-and-spoke

management model while benefiting from the performance of a full mesh when traffic patterns

demand it.

While SSL VPNs (Option D) and L2TP (Option B) are excellent for individual remote access, they are

not designed for site-to-site mesh scalability. Crypto maps (Option C) represent the legacy method of

building IPsec tunnels, which requires static, manual configuration of every peer relationship—

making a full mesh practically impossible to manage at scale. DMVPN fulfills the Cisco SDSI objective

of designing highly available and flexible secure infrastructure by automating the complexity of large-

scale tunnel management.