Cisco 300-745 SDSI: Designing Cisco Security Infrastructure Practice Exam
Cover the full 300-745 v1.0 blueprint — secure infrastructure, application security, risk/events/requirements, and AI, automation & DevSecOps — with objective-mapped questions, immediate feedback in Learn mode, and full timed simulation in Exam mode.
Start 24-hour free trial →300-745 exam at a glance
- Vendor
- Cisco
- Exam code
- 300-745 (SDSI)
- Full name
- Designing Cisco Security Infrastructure
- Level
- Professional
- Blueprint
- v1.0
- Duration
- 90 minutes (approximately 60 questions)
- Focus
- Security architecture design — not device-level configuration
- Role in CCNP
- CCNP Security concentration exam — pair with the SCOR 350-701 core to earn CCNP Security
- Also earns
- Cisco Certified Specialist – Designing Cisco Security Infrastructure
- Domains
- Four, with published weights (see below); they sum to 100%
- Cost (USD)
- $300 USD (regional pricing varies); confirm on Cisco’s page
- Delivery
- Pearson VUE; test center or online proctored
Sources: Cisco — SDSI (300-745) exam page · Cisco — official SDSI v1.0 exam topics (PDF). Verify current details with Cisco before scheduling.
About the Cisco 300-745 SDSI exam
The 300-745 SDSI exam validates the skills to design Cisco security infrastructure — choosing security approaches, controls, VPNs, firewall architectures, and frameworks that fit given business and technical requirements. Crucially, it is a design exam: it tests architectural decision-making rather than device-level configuration. For how certification exams work generally, see the certification study guides in our Learning Hub.
SDSI is a CCNP Security concentration exam. To earn CCNP Security you pass two exams: the SCOR 350-701 core (Implementing and Operating Cisco Security Core Technologies) plus one concentration — SDSI being the design-focused option. Passing SDSI on its own also earns the Cisco Certified Specialist – Designing Cisco Security Infrastructure credential. Related concentrations include SCAZT secure cloud access design (300-740), SNCF firewall security (300-710), and SVPN secure VPN solutions (300-730).
Every PowerKram practice question maps to one of the four weighted domains and links to Cisco’s own exam material, so a weak spot becomes a specific study step rather than a guess.
300-745 exam domains and weights (v1.0)
Cisco publishes four weighted domains for the 300-745 exam, and they sum to 100%. There is no single dominant domain — Secure Infrastructure and Risk, Events, and Requirements tie for the largest share at 30% each. Because this is a design exam, expect scenario questions that ask for the best architectural choice, not a command. Confirm the current weights on Cisco’s exam topics before scheduling.
Selecting security approaches for endpoints, identity (MFA, passwordless, continuous trust), and email threats; adapting architecture for hybrid work, IoT, SaaS, and multi-cloud; choosing VPN/tunneling (SD-WAN, IPsec, MPLS, GRE, DMVPN); securing management and control planes; and selecting firewall architecture (NGFW, WAF, IPS/IDS, distributed, eBPF, host-based).
Selecting security solutions (firewalls, SSL offloading/decryption, DLP, endpoint) to protect applications; designing segmentation/microsegmentation for cloud-native apps, microservices, containers, and serverless; and design policies for emerging tech such as generative AI, machine learning, and quantum computing.
How the SOC leverages incident-handling and response tools; modifying a design to mitigate risk and after an incident; using frameworks such as MITRE CAPEC, NIST SP 800-37, and Cisco SAFE across the security-design lifecycle; and matching regulatory/compliance requirements (e.g. PCI DSS, HIPAA, GDPR) to scenarios.
The role of AI in securing infrastructure; selecting elements for automated security architecture — API tooling, Infrastructure as Code, monitoring, container scanning, security telemetry, alerting, and SOAR; and choosing the next step in DevSecOps workflows and pipelines to minimize deployment risk.
Source: Cisco — official SDSI v1.0 (300-745) exam topics (PDF). Weights are Cisco’s and sum to 100%. Verify the current edition before scheduling.
Who the 300-745 exam is for
SDSI is aimed at professionals who design security, not just operate it:
- Security architects translating business risk and compliance mandates into Cisco security designs.
- Senior network and security engineers moving from implementation into architecture and design roles.
- Security consultants designing end-to-end solutions across branch, campus, data center, and cloud edge (Cisco SAFE PINs).
- CCNP Security candidates choosing the design concentration alongside the SCOR 350-701 core.
Complement design with implementation-focused concentrations such as SNCF (300-710) for firewalls or SVPN (300-730) for VPNs, or design cloud security with SCAZT (300-740). For where security-architecture skills lead, see the cybersecurity career paths in our Career Hub.
What this 300-745 practice exam delivers
Learn mode
Get the correct answer, the explanation, and a direct link to Cisco’s exam material each question maps to — immediately after each question. Ideal for design questions where several options are plausible and one best fits the requirement.
Exam mode
Timed, full-length simulation spanning all four domains at the real 90-minute pace — so test day feels familiar.
Source-linked explanations
Every answer links to Cisco’s own SDSI exam material, so you can verify each architectural choice against the source.
Score by weighted domain
Results break down across the four weighted domains so you can see whether it’s secure infrastructure, applications, risk/events/requirements, or AI/automation/DevSecOps that needs more work.
Sample 300-745 practice questions
Ten free questions across the 300-745 weighted domains, with full explanations and source links to Cisco’s exam material. The complete bank is available with the 24-hour trial.
A design must protect remote and hybrid workers accessing SaaS and private apps, with per-request verification rather than implicit network trust. Which approach best fits?
- A zero trust network access (ZTNA) design with continuous identity and posture verification
- A single perimeter firewall with a flat internal network
- Disabling authentication to reduce friction
- Allowing all traffic once a device is on the VPN
Show answer & explanation
Correct: A. ZTNA verifies identity and device posture on every request and grants least-privilege access to specific applications — the right fit for hybrid workers reaching SaaS and private apps without implicit network trust.
Why not the others: a single perimeter firewall with a flat network (B) is the implicit-trust model ZTNA replaces; disabling authentication (C) removes the core control; trusting all traffic once on the VPN (D) is exactly the implicit trust the requirement rejects.
Source: Cisco — SDSI: secure infrastructure → Further reading: PowerKram — SCAZT (300-740) →A design needs site-to-site connectivity across many branches with dynamic, on-demand tunnels and simplified hub configuration. Which VPN technology best matches?
- A single static GRE tunnel to each branch from the hub
- DMVPN (Dynamic Multipoint VPN)
- Clientless SSL VPN
- No encryption, relying on MPLS privacy
Show answer & explanation
Correct: B. DMVPN builds dynamic, on-demand spoke-to-spoke tunnels with a single multipoint interface on the hub, scaling to many branches with minimal per-branch hub config — the standard fit for this requirement.
Why not the others: static GRE per branch (A) doesn’t scale and lacks dynamic spoke-to-spoke; clientless SSL VPN (C) is a remote-access, not site-to-site, model; relying on MPLS for privacy without encryption (D) doesn’t meet a secure-tunnel requirement.
Source: Cisco — SDSI: VPN & tunneling design → Further reading: PowerKram — SVPN (300-730) →A web-facing application needs protection against SQL injection and cross-site scripting at the application layer. Which control best fits the design?
- A traditional stateful Layer 4 firewall only
- A DHCP server
- A Web Application Firewall (WAF)
- A spanning-tree change
Show answer & explanation
Correct: C. A WAF inspects HTTP/HTTPS at Layer 7 and is purpose-built to block application-layer attacks like SQL injection and XSS — the correct control for this requirement.
Why not the others: a Layer 4 firewall (A) filters ports/addresses but doesn’t understand application payloads; a DHCP server (B) assigns addresses; a spanning-tree change (D) is a Layer 2 loop-prevention matter, not application security.
Source: Cisco — SDSI: firewall architecture selection →A microservices application on Kubernetes needs east-west traffic controls so a compromised pod can’t freely reach others. Which design approach fits best?
- Placing all pods in one flat namespace with no policy
- Microsegmentation with workload/namespace-level policy (e.g. network policies, service mesh)
- Relying only on a perimeter firewall at the cluster edge
- Turning off logging to improve performance
Show answer & explanation
Correct: B. Microsegmentation applies fine-grained, workload-level policy to east-west traffic so a compromised pod is contained — the intended design for microservices/container segmentation.
Why not the others: a flat namespace with no policy (A) gives an attacker free lateral movement; a perimeter-only firewall (C) doesn’t see east-west pod traffic; disabling logging (D) reduces visibility and doesn’t segment anything.
Source: Cisco — SDSI: application segmentation design → Further reading: PowerKram — SCAZT (300-740) →Which control most directly lets a design inspect encrypted (TLS) traffic for threats before it reaches an internal application?
- Increasing the DHCP lease time
- Renaming the application
- Disabling HTTPS entirely
- SSL/TLS decryption (inspection) at a security device
Show answer & explanation
Correct: D. SSL/TLS decryption lets a firewall or proxy inspect otherwise-encrypted traffic for threats and data loss, then re-encrypt it — the standard design control for visibility into encrypted flows.
Why not the others: DHCP lease time (A) is unrelated; renaming the app (B) does nothing for inspection; disabling HTTPS (C) trades away confidentiality and isn’t an acceptable security design.
Source: Cisco — SDSI: application protection →A design team must standardize security controls consistently across branch, campus, data center, and cloud edge. Which Cisco framework is intended for this?
- The Cisco SAFE model (Places in the Network)
- The OSI model
- The spanning-tree protocol
- The DHCP option list
Show answer & explanation
Correct: A. Cisco SAFE organizes security design around Places in the Network (PINs) — branch, campus, data center, cloud edge — giving a consistent, modular way to standardize controls across the enterprise. SDSI explicitly references SAFE in the design lifecycle.
Why not the others: the OSI model (B) describes networking layers, not a security-design framework; spanning tree (C) prevents Layer 2 loops; the DHCP option list (D) configures address assignment.
Source: Cisco — SDSI: frameworks (SAFE) → Further reading: PowerKram — SNCF (300-710) →A retailer that processes cardholder data asks which regulatory requirement most directly shapes the security design. Which is the best match?
- The building fire code
- The corporate dress code
- PCI DSS (Payment Card Industry Data Security Standard)
- The office parking policy
Show answer & explanation
Correct: C. PCI DSS governs the protection of cardholder data and directly drives design requirements such as segmentation of the cardholder data environment, encryption, and access control — exactly the compliance-to-design mapping SDSI tests.
Why not the others: the fire code (A), dress code (B), and parking policy (D) are not information-security regulatory frameworks for cardholder data.
Source: Cisco — SDSI: regulatory & compliance mapping →After a security incident, which action best reflects the SDSI approach to improving the design?
- Delete the logs to reduce clutter
- Blame the end users and take no design action
- Turn off monitoring to avoid future alerts
- Modify the security design based on incident findings to reduce recurrence (feedback into the design lifecycle)
Show answer & explanation
Correct: D. SDSI treats incidents as inputs to the design lifecycle: use the findings to modify the architecture (new controls, segmentation, detections) so the same class of incident is less likely to recur.
Why not the others: deleting logs (A) destroys evidence and visibility; blaming users with no design change (B) fixes nothing; turning off monitoring (C) removes the detection the design depends on.
Source: Cisco — SDSI: post-incident design changes →A design calls for consistent, repeatable, version-controlled security infrastructure so environments don’t drift. Which approach fits best?
- Configuring every device by hand each time
- Infrastructure as Code (IaC) with version control
- Emailing configuration steps around the team
- Avoiding documentation to move faster
Show answer & explanation
Correct: B. Infrastructure as Code defines security infrastructure declaratively in version-controlled files, giving repeatable, auditable, drift-resistant deployments — a core SDSI automation concept.
Why not the others: hand-configuring each time (A) invites drift and error; emailing steps (C) is neither repeatable nor version-controlled; skipping documentation (D) undermines auditability.
Source: Cisco — SDSI: automation & IaC →Which capability best lets a design automatically coordinate response actions (enrich, contain, notify) across security tools when an alert fires?
- A louder alarm buzzer
- A larger monitor
- SOAR (Security Orchestration, Automation, and Response)
- A faster office printer
Show answer & explanation
Correct: C. SOAR platforms orchestrate playbook-driven response across tools — enriching an alert, containing a host, opening a ticket, notifying responders — which is exactly the automated-response design element SDSI calls out.
Why not the others: a buzzer (A), a bigger monitor (B), and a printer (D) don’t orchestrate automated security response.
Source: Cisco — SDSI: SOAR & automated response →Keep going: Learning & Career resources
SDSI is the design concentration in the CCNP Security track. Two PowerKram hubs back this exam.
Deep dive: the design mindset, the CCNP Security path, and study strategy
Design, not configuration
SDSI is deliberately architectural. Questions give you business and technical requirements and ask for the best design choice — which firewall architecture, which VPN, which segmentation strategy, which framework — rather than a CLI command. Practicing “which option best meets the requirement” is more useful than memorizing configuration syntax. See SCAZT (300-740) →
How SDSI fits CCNP Security
CCNP Security requires two exams: the SCOR 350-701 core plus one concentration. SDSI is the design concentration; implementation-focused options include SNCF (300-710, firewalls), SVPN (300-730, VPNs), and the cloud-security design exam SCAZT (300-740). Passing SDSI alone also earns Cisco Certified Specialist – Designing Cisco Security Infrastructure. See SVPN (300-730) →
Realistic study path
Weight your time toward the two 30% domains (Secure Infrastructure and Risk, Events, and Requirements), but don’t skip the 15% AI/automation domain — it’s what distinguishes this modern blueprint. Learn the Cisco SAFE model, the frameworks named in the objectives (MITRE CAPEC, NIST SP 800-37), and how to map compliance mandates to design. Finish with objective-mapped practice and at least one timed 90-minute run. Confirm the current blueprint on Cisco’s exam topics. See SNCF (300-710) →
Frequently asked questions
What is the 300-745 SDSI exam?
Is 300-745 a CCNP exam by itself?
What are the exam domains and weights?
How long is the exam and what does it cost?
Is SDSI a configuration exam?
Start your free 24-hour 300-745 practice trial
Full access to the question bank, both study modes, source-linked explanations, and score-by-weighted-domain across all four SDSI design domains. No credit card required.
Start free trial →