SDSI Practice Test 1 — 10 Questions

Question 1

A security architect is adapting a design post-incident after a credential theft event. Which Cisco ISE feature should be integrated into the architecture to mitigate the risk of compromised static credentials?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enabling MFA integration with Cisco Duo via RADIUS.. Credential theft of static passwords is best mitigated by adding a second authentication factor that cannot be replayed or stolen alongside the password. Integrating Cisco Duo MFA with ISE via RADIUS enforces a second factor (push, TOTP, biometric) at authentication time, so a stolen password alone is insufficient to gain access. This directly addresses the post-incident risk described.

Answer

Deploying Cisco pxGrid to share user identity info with the firewall.

Answer

Configuring Cisco TrustSec to segment user traffic based on IP address.

Answer

Implementing Cisco AnyConnect Device Posture assessment.

Question 2

A SOC analyst requires a tool to gain visibility into encrypted traffic without full decryption. Which Cisco product feature should be included in the design to meet this requirement?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) uses machine learning and network telemetry (NetFlow, TLS metadata such as handshake fields and packet-length sequences) to detect malware in encrypted traffic without decrypting it. It is purpose-built for visibility into encrypted flows while preserving privacy and performance, exactly matching the SOC analyst's requirement.

Answer

Cisco Firepower SSL decryption policies.

Answer

Cisco AnyConnect Network Visibility Module (NVM).

Answer

Cisco Identity Services Engine (ISE) Profiling.

Question 3

A design architect is updating an incident response strategy. What is the role of the 'Post-Incident Architecture Adaptation' phase?

Accepted Answer

To identify and implement changes to prevent recurrence of the incident.. The Post-Incident Architecture Adaptation phase is where lessons learned from an incident are translated into concrete architectural and policy changes to prevent recurrence. It is not about cost accounting, audit documentation, or HR discipline — it is about feeding findings back into the design so the same class of incident is mitigated or eliminated. This aligns with the NIST IR lifecycle 'lessons learned' and continuous improvement stages.

Answer

To document the costs of the incident.

Answer

To update the network documentation for the next annual audit.

Answer

To discipline employees who caused the incident.

Question 4

You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?

Accepted Answer

Cloudlock API-based CASB integration. Cisco Cloudlock integrates with Google Workspace through its API-based CASB connection, using OAuth to read Drive, Gmail, and audit logs. That API access gives Cloudlock visibility into file sharing settings, external collaborators, and user activity, and its behavioral analytics baseline normal user behavior to flag anomalies such as mass external sharing or unusual download volumes. Remediation is then performed through the same APIs.

Answer

Cisco Umbrella roaming client

Answer

Cisco ISE Profiling

Answer

Cisco Secure Firewall NAT

Question 5

Following a major data exfiltration incident, the design team needs to adapt the architecture to prevent lateral movement. Which Cisco Secure Firewall design modification is most effective for mitigating this risk while maintaining operational performance?

Accepted Answer

Implement SGT-based micro-segmentation. SGT-based micro-segmentation using Cisco TrustSec assigns Security Group Tags to workloads and enforces policy based on those tags rather than IP addresses. This allows the firewall to apply granular east-west controls that prevent lateral movement between compromised and target systems, while keeping policy scalable and operationally efficient. It directly addresses lateral movement risk without the performance penalty of inspecting every signature.

Answer

Enable all IPS signatures in blocking mode

Answer

Transition to transparent mode

Answer

Increase firewall inspection timeouts

Question 6

An organization is updating its SOC incident response toolset. Which Cisco technology provides the ability to perform 'retrospective security' by tracking files that have entered the network in the past?

Accepted Answer

Cisco Secure Endpoint (AMP).. Cisco Secure Endpoint (formerly AMP for Endpoints) is built on a continuous file-tracking and retrospective-analysis model: every file that enters an endpoint is fingerprinted (SHA-256) and recorded in the cloud, so when new threat intelligence arrives, the system can retroactively query its historical file database and flag files that were previously deemed clean. This 'retrospective security' capability is the defining feature of the AMP/Secure Endpoint architecture and is what allows the SOC to identify past compromises without re-scanning every host.

Answer

Cisco Secure Network Analytics (Stealthwatch).

Answer

Cisco Firepower IPS.

Answer

Cisco Umbrella.

Question 7

Following a ransomware incident, an architect must modify the network segmentation strategy. What is the most effective approach to mitigate lateral movement using Cisco TrustSec?

Accepted Answer

Implement SGT-based micro-segmentation at the access layer to enforce policies based on identity rather than IP.. Implementing SGT-based micro-segmentation at the access layer with Cisco TrustSec enforces policies based on identity (security group tags) rather than IP addresses, which effectively mitigates lateral movement by restricting communication between groups even within the same VLAN. This approach is dynamic and scalable, allowing granular control that follows the workload or user, not the IP.

Answer

Deploy extended ACLs on every core switch port to block peer-to-peer traffic.

Answer

Configure static port-security across the entire enterprise to prevent unauthorized devices.

Answer

Transition all physical cabling to private VLANs without leveraging SGTs.

Question 8

Which THREE of the following are key AI/ML design considerations when selecting a security automation platform?

Accepted Answer

Explainability and transparency (XAI). Option B (Explainability and transparency, XAI) is correct because security automation platforms increasingly rely on AI/ML models to triage alerts and make risk decisions, so analysts and auditors must be able to understand why a model produced a given verdict to trust, validate, and defend it. Option C (API integration and extensibility) is correct because a security automation platform must interoperate with SIEM, SOAR, EDR, ticketing, and threat-intel systems via REST APIs, webhooks, and plugins, so its ability to integrate and be extended determines how well the AI/ML capabilities fit existing workflows. Option E (Data quality and labeling) is correct because ML model accuracy in security use cases depends directly on well-curated, correctly labeled, and representative training data (e.g., labeled true/false positives), and poor data quality leads to high false-positive rates and unreliable automation. Option A is not a key AI/ML design consideration because vendor team headcount does not determine model explainability, integration capability, or data quality. Option D is not a key AI/ML design consideration for platform selection because local GPU acceleration is an infrastructure/deployment detail, not a core AI/ML design factor, and many platforms deliver inference via cloud or vendor-managed services.

Answer

Number of employees on the vendor's team

Answer

Local hardware GPU acceleration

Question 9

Which THREE actions are recommended when designing a secure API architecture using Cisco API Security to mitigate OWASP API Top 10 threats? (Choose THREE)

Accepted Answer

Implement strict schema validation on all incoming API requests. Option A is correct because strict schema validation on all incoming API requests enforces expected data types, formats, and required fields, which directly mitigates OWASP API threats such as mass assignment, injection, and improper input handling by rejecting malformed or unexpected payloads before they reach backend logic. Option D is correct because continuous monitoring of API traffic for anomalies that indicate data exfiltration helps detect and respond to threats like excessive data exposure and data harvesting, which are core concerns in the OWASP API Top 10. Option E is correct because deploying Cisco API Security to detect Broken Object Level Authorization (BOLA) addresses the top-ranked OWASP API risk, where attackers manipulate object identifiers to access resources belonging to other users; API security tooling can baseline and flag such unauthorized object access patterns. Option B is incorrect because bypassing authentication for performance eliminates access control entirely and would worsen, not mitigate, OWASP API threats such as broken authentication and BOLA. Option C is incorrect because disabling logging of API request headers removes critical audit and forensic visibility needed to detect and investigate attacks, undermining rather than strengthening API security.

Answer

Allow all API traffic to bypass authentication for performance

Answer

Disable all logging of API request headers

Question 10

Which risk assessment methodology is best suited to guide a design modification for a cloud-native architecture relying on Cisco Secure Cloud Analytics?

Accepted Answer

NIST SP 800-30 for conducting the assessment.. NIST SP 800-30 is a risk assessment methodology specifically designed to guide the assessment process, including identifying threats, vulnerabilities, likelihood, and impact. For a cloud-native architecture using Cisco Secure Cloud Analytics, it provides a structured approach to evaluate risks and inform design modifications. It is vendor-neutral and applicable to cloud environments.

Answer

ISO 27002 implementation guide.

Answer

OWASP Top 10 for all infrastructure components.

Answer

PCI-DSS compliance checklist.