20+ practice questions focused on Secure Infrastructure Design — one of the most tested topics on the Cisco Designing Cisco Security Infrastructure (SDSI, 300-745, CCNP Security, design-focused) (SDSI) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Secure Infrastructure Design PracticeWhich TWO factors must be considered when designing a Secure Remote Access VPN architecture for a hybrid workforce using Cisco AnyConnect?
Explanation: Option A is correct because integrating Duo Security provides multi-factor authentication for AnyConnect remote users, which is a critical design factor for securing access in a hybrid workforce where credentials alone are insufficient. Option E is correct because the maximum supported concurrent user sessions on the ASA or FTD headend directly determines scalability and whether the platform can handle the expected number of simultaneous VPN connections. Option B is not a relevant factor since physical port density concerns wired interface capacity, not remote-access VPN design. Option C, while DTLS can benefit latency-sensitive traffic, is not a mandatory design factor for the architecture itself. Option D is incorrect because split-tunneling configuration involves routing and tunnel policies, not simply configuring internal DNS servers as a design consideration.
Which Cisco tool is best suited for designing and documenting network security architectures?
Explanation: Cisco Modeling Labs (CML) is a virtual lab platform that lets engineers build, visualize, and validate network topologies — including security architectures — before deploying to production. It supports importing and simulating Cisco IOS, IOS-XE, NX-OS, and ASA/Firepower images, so you can document and test designs such as segmentation, VPN termination, and firewall placement in a safe environment. This makes it the correct tool for designing and documenting security architectures.
Which Cisco feature is used to prevent the unauthorized use of dynamic IP addresses on a network?
Explanation: IP Source Guard (IPSG) is a Layer 2 security feature that prevents IP address spoofing by filtering traffic based on the source IP address and MAC address binding learned via DHCP snooping. It ensures that only hosts using the IP address assigned by DHCP (or statically configured in the IPSG binding table) can send traffic on the port, thus preventing unauthorized use of dynamic IP addresses. The other options address different threats: Port Security limits MAC addresses, DAI validates ARP packets, and DHCP Snooping builds the binding database but does not enforce IP source filtering.
Which feature enables Cisco switches to limit the amount of broadcast traffic received on a port?
Explanation: Storm Control is the Cisco feature specifically designed to monitor and suppress excessive broadcast, multicast, and unknown unicast traffic on a switch port by defining a threshold (in pps, bps, or percentage of bandwidth). When the threshold is exceeded, the port can drop traffic, send an SNMP trap, or shut down, protecting the LAN from broadcast storms. It is configured with the 'storm-control broadcast level' interface command.
Which THREE design elements are required for a high-availability firewall pair?
Explanation: High availability requires connectivity, state synchronization, and failure detection.
+15 more Secure Infrastructure Design questions available
Practice all Secure Infrastructure Design questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Secure Infrastructure Design. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Secure Infrastructure Design questions on the SDSI frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Secure Infrastructure Design is tested as part of the Cisco Designing Cisco Security Infrastructure (SDSI, 300-745, CCNP Security, design-focused) (SDSI) blueprint. Practicing with targeted Secure Infrastructure Design questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free SDSI practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Secure Infrastructure Design is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Secure Infrastructure Design practice session with instant scoring and detailed explanations.
Start Secure Infrastructure Design Practice →