Cisco · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When designing an automated security policy deployment for Cisco Secure Workload (formerly Tetration), which mechanism allows you to test policies in a simulation environment before applying them to production?
Policy Analysis mode
Policy Analysis mode simulates proposed policies against historical flow data, showing which traffic would be permitted or denied without enforcing changes. This satisfies the requirement to test policies in a simulation environment before production deployment, avoiding accidental workload disruption.
Agentless vulnerability scanning
Workload isolation testing
Inventory change management
Live enforcement mode
In a DevSecOps environment, you need to implement Cisco Secure Firewall Management Center (FMC) rule updates via Ansible. Which approach ensures the highest level of security and idempotency?
Manually updating via FMC UI then exporting JSON
Pushing configuration snapshots via SCP
Executing raw REST API calls via shell scripts
Utilizing the cisco.fmc Ansible collection
The cisco.fmc collection wraps FMC's REST API in declarative modules, so Ansible compares desired rule state against current configuration and applies only deltas. This delivers idempotency, while HTTPS with token-based authentication secures credential handling, satisfying the DevSecOps requirement for repeatable, secure rule updates.
When designing a multi-cloud CI/CD security architecture, how should secrets (API keys for Cisco FMC) be managed to ensure compliance?
Embed as environment variables in the build runner
Encrypt with base64 and store in Git
Use a dedicated Secret Management service
A dedicated Secret Management service stores API keys centrally and injects them at runtime, so credentials never persist in pipeline code, repositories or build logs. This satisfies the compliance constraint by enforcing rotation, auditing and least-privilege access across every cloud in the multi-cloud CI/CD architecture.
Hardcode in the Terraform provider block
Which component of Cisco XDR (formerly Cisco SecureX) is critical for normalizing data from different Cisco security products to enable automated orchestration?
Cloud-native storage
Local management agent
Unified Data Model
The Unified Data Model maps each product's disparate event schema into common, normalised fields, giving playbooks consistent observables and verdicts. That normalisation is the prerequisite for reliable automated orchestration across Cisco security products in XDR workflows.
Packet inspection engine
What is the primary benefit of 'Shift Left' security in a DevSecOps pipeline?
Automated hardware deployment
Increased development speed
Elimination of security teams
Reduced remediation costs
Fixing flaws during design and coding costs far less than remediating them after deployment, since production incidents demand emergency patching, incident response and potential breach notification. Shift Left therefore directly satisfies the stem's cost-reduction objective by moving defect discovery to the earliest, cheapest pipeline stage.
In DevSecOps, what is the role of an 'Artifact Repository' such as Artifactory in relation to security?
Store and secure immutable build artifacts
Artifactory stores versioned build artefacts with checksums and access controls, so pipelines consume only immutable, verified binaries rather than mutable latest tags. This satisfies the DevSecOps requirement that artefacts remain tamper-evident throughout the delivery chain.
Manage user identities
Monitor real-time network traffic
Execute live security testing
Want more AI Automation And Devsecops practice?
Practice this domainDuring a post-incident review, an architect identifies that Cisco Stealthwatch (Secure Network Analytics) failed to alert on lateral movement due to lack of visibility. Which design modification is required to ensure visibility into internal east-west traffic?
Update the Cisco Secure Endpoint policy to scan memory more frequently on all endpoints.
Enable NetFlow export from core and distribution layer switches to the Stealthwatch Flow Collector.
Stealthwatch derives its analytics from flow telemetry, so east-west visibility depends on NetFlow exported from core and distribution switches to the Flow Collector. Without that export, internal lateral movement generates no flow records, leaving the gap identified in the review unaddressed.
Increase the logging interval on the perimeter Cisco Firepower Management Center.
Integrate the Cisco ISE platform via pxGrid to force all internal hosts to re-authenticate.
When assessing risk for a remote office branch, the architect decides to use Cisco Umbrella. Which requirement is addressed by implementing the Umbrella roaming client for branch endpoints?
Providing deep packet inspection for local branch-to-branch file transfers.
Managing local firewall rules on the branch router.
Providing local site-to-site VPN encryption for branch traffic.
Enforcing security policies on endpoints even when they are off the corporate network.
The Umbrella roaming client intercepts DNS and IP requests directly on the endpoint, applying policy regardless of whether the device sits behind the branch firewall. This satisfies the off-network requirement, where traditional perimeter enforcement no longer covers roaming branch users.
A security architect is designing a SOC response workflow using Cisco SecureX Orchestration. Which mechanism is most effective for automated remediation of an endpoint identified as compromised via Cisco Secure Endpoint?
Triggering a workflow that executes the isolate endpoint action in Cisco Secure Endpoint via API.
SecureX Orchestration calls the Cisco Secure Endpoint API to run the isolate endpoint action, immediately cutting the host off from the network while preserving forensic state. This satisfies the requirement for automated remediation of a compromised endpoint.
Deploying an umbrella policy change to redirect the host traffic to a sinkhole.
Configuring a local script on the Cisco ASA to block the host IP address.
Using Cisco Defense Orchestrator to push a new access control policy to the endpoint.
A security architect is adapting a design post-incident after a credential theft event. Which Cisco ISE feature should be integrated into the architecture to mitigate the risk of compromised static credentials?
Deploying Cisco pxGrid to share user identity info with the firewall.
Configuring Cisco TrustSec to segment user traffic based on IP address.
Implementing Cisco AnyConnect Device Posture assessment.
Enabling MFA integration with Cisco Duo via RADIUS.
Integrating Cisco Duo MFA via RADIUS into Cisco ISE adds a possession or biometric factor at authentication, so a stolen static password alone cannot grant access. This directly mitigates the credential-theft risk described in the post-incident scenario.
Following a ransomware incident, an architect must modify the network segmentation strategy. What is the most effective approach to mitigate lateral movement using Cisco TrustSec?
Deploy extended ACLs on every core switch port to block peer-to-peer traffic.
Configure static port-security across the entire enterprise to prevent unauthorized devices.
Implement SGT-based micro-segmentation at the access layer to enforce policies based on identity rather than IP.
Security Group Tags decouple policy from IP addressing, letting TrustSec enforce least-privilege segmentation between workloads based on identity and role. Applied at the access layer, this contains compromised hosts and blocks the east-west lateral movement ransomware relies on.
Transition all physical cabling to private VLANs without leveraging SGTs.
A design requirement for a new SOC environment mandates that incident data must be centralized. Which Cisco tool is best suited to act as the single pane of glass for integrating disparate security logs and telemetry?
Cisco SecureX
Cisco SecureX aggregates telemetry from multiple Cisco and third-party security products into a unified console, correlating alerts and enabling consistent response workflows. This centralisation satisfies the mandate for a single pane of glass integrating disparate logs across the SOC environment.
Cisco Firepower Management Center (FMC)
Cisco Identity Services Engine (ISE)
Cisco Defense Orchestrator (CDO)
Want more Risk Events And Requirements practice?
Practice this domainYou are designing a security architecture for a hybrid cloud environment using Cisco Secure Firewall. Which design pattern effectively mitigates the risk of lateral movement between VPCs in AWS while maintaining centralized policy enforcement?
Relying solely on AWS Security Groups for inter-VPC traffic.
Implementing an Overlay Network using Cisco ACI Remote Leaf.
Utilizing a Transit Gateway with a centralized inspection VPC and VPC attachments.
A Transit Gateway hubs all VPC attachments through a centralised inspection VPC, so inter-VPC traffic is forced through Cisco Secure Firewall rather than routing directly. This satisfies centralised policy enforcement while blocking lateral movement between VPCs.
Deploying individual firewall appliances in each VPC.
A company is migrating to a SASE architecture using Cisco+ Secure Connect. Which component is responsible for the unified identity-based access control for remote users?
AnyConnect standalone VPN gateway.
Firepower Management Center cloud connector.
On-premises ISE cluster.
Cisco Duo integration within the Secure Connect platform.
Duo supplies the identity layer inside Cisco+ Secure Connect, enforcing user authentication and device trust before granting access to private applications and internet destinations. This satisfies the stem's requirement for unified identity-based access control for remote users across the SASE fabric.
Which TWO design considerations are essential when implementing a Zero Trust architecture for IoT devices in a campus environment using Cisco ISE and TrustSec?
Using static IP addresses for every IoT device to ensure consistency.
Utilizing Cisco ISE to profile and categorize IoT endpoints.
Cisco ISE profiling discovers IoT endpoints and assigns them to logical groups based on fingerprinting attributes, giving the identity foundation Zero Trust requires. Without accurate classification, no meaningful authorisation policy can be applied to unmanaged campus devices.
Applying Scalable Group Tags (SGTs) to enforce micro-segmentation.
SGTs carried in the TrustSec header let the network enforce least-privilege micro-segmentation between IoT groups regardless of IP addressing, containing compromised devices. This satisfies Zero Trust's requirement that access decisions follow identity rather than network location.
Ensuring all IoT devices are placed in the same VLAN for easier management.
Disabling 802.1X for all non-PC devices.
In a Cisco SD-WAN environment, you need to ensure that branch office traffic destined for SaaS applications is optimized and secured. Which design approach is most appropriate?
Implementing Cisco Umbrella SIG integration on the SD-WAN edge devices for DIA.
Cisco Umbrella SIG integrated on SD-WAN edge devices routes SaaS traffic directly to the internet while applying cloud-delivered DNS-layer security, CASB and SWG inspection. This satisfies both constraints: local internet breakout optimises SaaS performance, and SIG enforcement secures that direct access path.
Using static routing to bypass all security policies for trusted SaaS domains.
Deploying a dedicated physical firewall at every branch office.
Hair-pinning all SaaS traffic back to the corporate headend for inspection.
A security architect is designing a Cisco Secure Firewall deployment for a multi-cloud environment. Which design strategy ensures consistent security policy enforcement across AWS and Azure instances?
Utilize a centralized FMC to manage virtual Secure Firewalls across all cloud environments.
A centralised FMC manages virtual Secure Firewalls in both AWS and Azure, pushing one unified policy set to every instance. This directly satisfies the stem's requirement for consistent enforcement across clouds, since policy is authored once and deployed identically, rather than configured separately per cloud platform.
Deploy separate FMC instances in each cloud provider for localized management.
Use individual Firewall Device Managers (FDM) for every instance.
Implement cloud-native security groups exclusively to bypass firewall bottlenecks.
When designing a secure remote access solution for a hybrid workforce, which Cisco AnyConnect feature should be prioritized to reduce the attack surface by verifying the posture of the device before granting access?
IKEv2 protocol support.
AnyConnect Posture Module.
The AnyConnect Posture Module collects host attributes such as antivirus, patch and firewall state, and returns them for evaluation before access is granted. This satisfies the requirement to verify device posture and thereby reduce the attack surface for hybrid workers.
Split-tunneling.
Dynamic Access Policies (DAP).
Want more Secure Infrastructure Design practice?
Practice this domainWhen designing microsegmentation policies in Cisco Secure Workload (Tetration) for a multi-tier application, which THREE factors must be considered to ensure traffic flow integrity?
Application dependency mapping
Application dependency mapping reveals the actual inter-tier communication flows, ensuring microsegmentation policies permit only legitimate traffic between workloads. Without it, policies risk blocking required east-west connections, violating the traffic flow integrity constraint in the stem. It grounds policy in observed behaviour rather than assumptions.
DHCP lease duration
Workload inventory classification
Workload inventory classification labels each workload by role, environment and sensitivity, which determines the policy set applied to it. Accurate classification ensures microsegmentation rules match each tier's actual function, preserving legitimate traffic flow while denying everything else.
Infrastructure zone isolation
Infrastructure zone isolation separates workloads by trust boundary, such as production from development or PCI from non-PCI, so policy enforcement points align with physical or logical segmentation. This prevents cross-zone lateral movement while maintaining required intra-zone traffic flow integrity.
User identity mapping
You are designing a microsegmentation strategy using Cisco Secure Workload (formerly Tetration) for a multi-tier application. Which mechanism allows you to enforce fine-grained security policies between application tiers while maintaining visibility across the hybrid cloud?
Applying static ACLs on the core switch
Using policy-based agents on endpoints to enforce segmentation
Policy-based agents installed on endpoints enforce fine-grained segmentation by applying allow/deny rules at the workload itself, regardless of network topology. This maintains visibility and consistent enforcement across on-premises and hybrid cloud environments, which host-based firewalls alone cannot achieve.
Implementing Cisco ASA zone-based firewalling
Configuring VRF-Lite on the distribution layer
In a cloud-native environment, which Cisco solution provides visibility into vulnerabilities within the application code and runtime environment?
Cisco Secure Endpoint
Cisco Stealthwatch
Cisco Secure Malware Analytics
Cisco Secure Application for AppDynamics
Cisco Secure Application for AppDynamics instruments the application runtime, correlating code-level vulnerabilities and attacks with business transactions, so it provides visibility into flaws within application code and the live runtime environment rather than only network or host layers.
You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?
Cisco Umbrella roaming client
Cisco ISE Profiling
Cloudlock API-based CASB integration
Cloudlock's API-based CASB integration scans Google Workspace data at rest via Google's APIs, applying user behaviour analytics to flag anomalous sharing patterns such as sudden external sharing spikes. This satisfies the stem's requirement to detect anomalous data sharing behaviour, which inline proxies cannot inspect retrospectively.
Cisco Secure Firewall NAT
To secure API endpoints exposed via Cisco Secure API Gateway, which policy type is best suited to prevent brute-force attacks on authentication endpoints?
Identity Propagation Policy
Schema Validation Policy
Rate Limiting Policy
Rate Limiting Policy caps requests per client within a time window, throttling the high-volume repeated authentication attempts that define brute-force attacks. It targets the attack's volume characteristic at the gateway before requests reach backend authentication services.
Transformation Policy
You are designing an API security architecture for a hybrid cloud environment. Which TWO Cisco technologies would you implement to secure the API lifecycle?
Cisco Firepower
Cisco ISE
Cisco Secure Application for AppDynamics
Cisco Secure Application for AppDynamics instruments application runtimes to detect runtime API threats and business-logic abuse, feeding live behaviour into the API lifecycle. In a hybrid cloud, this runtime protection complements design-time and gateway controls, satisfying the requirement to secure APIs across both private and public deployment environments.
Cisco AnyConnect
Cisco Secure API Gateway
Cisco Secure API Gateway enforces authentication, authorisation, rate limiting and threat inspection at the API ingress point, covering the publish and consume stages of the lifecycle. This directly satisfies the hybrid cloud constraint by applying consistent policy to APIs exposed from both on-premises and cloud workloads.
Want more Application Security Design practice?
Practice this domainThe vendor does not publish an exact question count for the SDSI; the exam lasts 90 minutes. Always confirm current details on the vendor's official exam page.
CLI output interpretation, network topology analysis, routing behaviour, switching concepts, troubleshooting, and configuration questions.
The exam covers 4 domains: AI Automation And Devsecops, Risk Events And Requirements, Secure Infrastructure Design, Application Security Design. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Cisco SDSI exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.