300-745 Designing Cisco Security Infrastructure Exam Topics and Questions

This topic carries the heaviest weighting on the exam and covers the widest range of technical ground. You need to make design choices across endpoints, identity systems, email security, network connectivity, management plane protection, and firewall architectures. The cost comes from the breadth: missing one area means dropping marks across multiple items, and the scenarios demand you balance business constraints against technical capability.

– Threat protection across endpoints, identity, and email

Endpoint protection splits into three postures: devices on the corporate network, those off-network but managed, and remote workers whose trust boundary shifts constantly. Each posture changes your tooling and your enforcement model. Identity moves beyond static credentials to multi-factor authentication, passwordless flows, continuous trust evaluation, and intelligence feeds that flag compromised accounts before they authenticate. Email remains a primary attack surface. Phishing, ransomware, business email compromise, malware payloads, and domain spoofing all require different detection and mitigation layers. The exam expects you to match the threat type to the control, and to recognize when a single technology cannot address the full spectrum. Candidates lose marks by picking endpoint controls that assume always-on network access, or identity schemes that ignore the cost of user friction in high-volume environments.

– Architecture changes for hybrid work, IoT, SaaS, and multi-cloud applications

Hybrid workers break the assumption that users sit behind a perimeter. Your architecture must deliver consistent policy whether the session originates from a branch, a home office, or a coffee shop. IoT devices multiply the attack surface and rarely support agent-based security, so segmentation and behavioral monitoring become the primary controls. SaaS applications move data and identity outside your direct control, requiring you to secure API access, enforce data loss prevention at the boundary, and integrate third-party identity providers. Applications that span on-premises data centers and multiple cloud providers demand a security fabric that travels with the workload. The exam tests whether you can adapt a legacy perimeter design to these distributed models without creating gaps or doubling operational cost.

– VPN, tunneling, and connectivity design

Selecting the right tunneling solution depends on bandwidth, latency, redundancy, and whether you need application-aware path selection or simple encrypted transport. SD-WAN delivers dynamic path selection and integrated security but adds complexity. IPsec provides strong encryption and broad platform support. MPLS offers predictable performance and carrier SLAs but limited agility. GRE tunnels are lightweight and flexible but carry no native encryption. DMVPN scales hub-and-spoke or mesh topologies without static tunnel configuration. Public cloud tunnel options integrate directly with provider networking but may lock you into a single ecosystem. The exam expects you to weigh these trade-offs against a stated set of business and technical requirements, not recite feature lists.

– Management plane, control plane, and firewall architecture

Securing the management and control planes means protecting the systems that configure, monitor, and route traffic across your infrastructure. Compromise here grants an attacker persistent access and the ability to alter policy undetected. You need out-of-band management, role-based access with logging, encrypted transport, and segmentation that isolates administrative traffic from production flows. Firewall architecture selection turns on whether you need stateful inspection alone or deeper capabilities like intrusion prevention, SSL decryption, application visibility, and distributed enforcement. Traditional firewalls work at the network edge. Next-generation firewalls add application and user awareness. Web application firewalls protect HTTP traffic. Distributed firewalls enforce policy at the workload. eBPF and host-based firewalls run on the endpoint itself. The exam presents a scenario and asks which architecture satisfies the stated requirements without over-engineering the solution.

How Secure Infrastructure is tested

Thirty percent of the exam means you will see this topic in roughly one out of every three items. The questions present a business or technical scenario, then ask you to select the security approach, modify an architecture, or choose the appropriate technology. The demand is design judgement, not feature recall. You must read the constraints (budget, user count, latency tolerance, compliance mandates) and eliminate options that fail to meet them. Candidates lose marks by picking the most advanced technology when the scenario calls for the simplest one that works, or by ignoring a stated requirement like support for remote workers or multi-cloud applications. Another trap is conflating similar technologies: choosing IPsec when the scenario needs application-aware path selection, or recommending a traditional firewall when the requirement explicitly mentions application-layer visibility. Pay attention to the exact wording of the business and technical requirements, because the wrong answer often satisfies most of them but misses one critical constraint.

Application security shifts the focus from network perimeter to the workload itself. You need to protect data in motion and at rest, enforce segmentation inside containerized environments, and account for architectural patterns like microservices and serverless functions. The topic also introduces emerging risks from generative AI, machine learning inference, and the eventual threat of quantum decryption. The cost is in the detail: application flows behave differently than network flows, and the controls that work for monolithic applications often break when applied to cloud-native architectures.

How Applications is tested

At twenty-five percent, this topic appears in one out of every four items. The questions give you application characteristics (traffic patterns, data sensitivity, deployment model) or flow data, then ask you to select the security solution that addresses the stated risk. You might see a scenario describing an application that terminates SSL at a load balancer and asks where to place decryption and inspection. Another item might describe a microservices architecture and ask how to enforce segmentation between containers. The trap is choosing a solution that works for traditional applications but fails in cloud-native environments, or ignoring the operational cost of a control that requires inline inspection of every flow. Candidates also lose marks by confusing SSL offloading with SSL decryption, or by recommending endpoint-based controls for serverless workloads that have no persistent endpoint. Emerging technology questions test whether you understand the risk (for example, that generative AI can leak training data, or that quantum computing threatens current encryption standards) and can describe a policy response, even when the tooling is not yet mature. Read the scenario carefully to distinguish between protecting the application itself and protecting the data it handles.

This topic ties security design to incident handling, risk mitigation, and compliance frameworks. You are expected to know how a security operations center uses its tools during an incident, how to modify a design to reduce risk or respond to a breach, and how frameworks like MITRE CAPEC, NIST SP 800-37, and Cisco SAFE guide the lifecycle of a security architecture. The final piece is matching regulatory and industry compliance documents to business or technical scenarios. The weight matches Secure Infrastructure, so together these two topics account for sixty percent of the exam.

– SOC tools and incident workflows

A security operations center relies on incident handling and response tools to detect, contain, investigate, and remediate threats. During an incident, the SOC uses SIEM platforms to correlate events, endpoint detection and response tools to isolate compromised hosts, network traffic analysis to trace lateral movement, and case management systems to coordinate the response. The exam expects you to describe how these tools support the workflow, not list vendor products. You need to understand what data each tool provides, when in the incident lifecycle it is used, and how it integrates with the broader security architecture. Candidates who focus on feature lists instead of operational context miss the point of the question.

– Design modification for risk and post-incident response

Modifying a design to mitigate risk means identifying where the architecture exposes the organization to unacceptable loss, then selecting a control that reduces likelihood or impact without introducing new weaknesses. After an incident, you modify the design based on what the breach revealed: gaps in visibility, missing segmentation, inadequate logging, or controls that failed under attack. The exam presents a scenario describing a risk or an incident, then asks what change would address it. The trap is recommending a control that mitigates one risk but creates another, or choosing a response that treats the symptom rather than the underlying design flaw. You must also consider cost and operational complexity, because the best technical control may not be viable in the given environment.

– Frameworks and compliance mapping

MITRE CAPEC catalogs attack patterns and helps you anticipate adversary behavior during design. NIST SP 800-37 defines the Risk Management Framework, which structures how you select, implement, assess, and monitor controls across the lifecycle. Cisco SAFE provides a modular architecture organized by security domains and lifecycle phases. The exam tests whether you can match the framework to its role in the design process, not whether you have memorized every step. Regulatory and industry compliance documents (PCI DSS, HIPAA, GDPR, SOC 2, and others) impose specific technical and procedural controls. You need to recognize which document applies when the scenario describes payment card data, health records, personal data of EU residents, or service organization assurance. The wrong answer often cites a framework that applies to a different industry or data type.

How Risk, Events, and Requirements is tested

Thirty percent weighting means this topic appears as often as Secure Infrastructure. The questions describe an incident, a risk scenario, or a business requirement, then ask you to select the appropriate response or framework. You might see a breach description and be asked what design change would prevent recurrence. Another item might describe a compliance obligation and ask which regulatory document mandates it. The demand is contextual judgement: you must read the scenario, identify the relevant framework or control, and eliminate options that address a different problem. Candidates lose marks by confusing frameworks (using MITRE CAPEC when the question asks about lifecycle phases, which is NIST RMF territory), or by recommending a post-incident change that mitigates the specific attack but ignores the broader vulnerability class. Another trap is citing a compliance standard that sounds plausible but does not actually govern the data type or industry described in the scenario. The questions assume you can interpret business language and map it to technical requirements, so practice translating between the two.

This topic addresses how artificial intelligence secures network infrastructure, what elements support automated security architectures, and how DevSecOps workflows minimize risk during automated deployments. At fifteen percent it is the lightest topic, but it covers ground that many candidates have less hands-on experience with. The cost is in the abstraction: you need to understand the role of AI and automation in security design without necessarily having deployed every tool yourself.

How Artificial Intelligence, Automation, and DevSecOps is tested

Fifteen percent means roughly one in seven items. The questions ask you to describe the function or role of AI in network security, select the feature that supports automated infrastructure (API tooling, Infrastructure as Code, monitoring, container scanning, security telemetry, alerting, SOAR), or choose the next step in a DevSecOps pipeline to reduce deployment risk. The demand is conceptual: you must understand what each element does and when it applies, even if you have not configured it in production. Candidates lose marks by confusing AI functions (anomaly detection versus policy recommendation versus automated response) or by selecting an automation feature that solves a different problem than the one described. DevSecOps questions often present a workflow with a missing step and ask what should happen next to catch vulnerabilities before code reaches production. The trap is picking a step that belongs earlier or later in the pipeline, or choosing a manual gate when the scenario calls for automated scanning. Another common error is recommending container scanning when the risk is in the infrastructure configuration, not the container image. Read carefully to distinguish between securing the deployment pipeline and securing the deployed workload.