SDSI Practice Test 10 — 10 Questions

Question 1

What is the primary role of Cisco SecureX in a SOC architecture?

Accepted Answer

To provide a centralized platform for visibility and orchestration.. Cisco SecureX is a cloud-native platform that provides a centralized view of security across multiple products and orchestrates workflows. Its primary role in a SOC is to integrate disparate security tools, automate responses, and provide unified visibility, thereby improving efficiency and threat response. It does not replace other tools but enhances them.

Answer

To provide local firewall policy management.

Answer

To act as a secondary backup firewall.

Answer

To replace all other security tools.

Question 2

You are designing security for a multi-cloud environment. Which feature in Cisco Secure Firewall allows for automated policy deployment based on cloud tags?

Accepted Answer

Dynamic Object Groups.. Dynamic Object Groups in Cisco Secure Firewall (formerly Firepower) let policies reference cloud resource tags (AWS tags, Azure tags, GCP labels) instead of static IPs. As cloud instances are created, terminated, or re-tagged, the firewall automatically updates group membership and enforces policy accordingly, enabling automated policy deployment in multi-cloud environments. This is the mechanism designed specifically for tag-driven, dynamic policy.

Answer

Static IP-based Access Control Lists.

Answer

VLAN tagging.

Answer

Network Interface Virtualization.

Question 3

Which Cisco solution provides DNS-layer security to prevent users from connecting to malicious domains?

Accepted Answer

Cisco Umbrella.. Cisco Umbrella is a cloud-delivered security platform that enforces DNS-layer security by resolving DNS queries through its global network. It blocks requests to malicious domains before a connection is established, preventing users from reaching phishing, malware, or command-and-control sites. This proactive blocking at the DNS layer is Umbrella's core function, making it the correct answer.

Answer

Cisco Stealthwatch.

Answer

Cisco ASA Firewall.

Answer

Cisco Secure Endpoint.

Question 4

What is the primary goal of the 'Requirement Gathering' phase in the Cisco security design process?

Accepted Answer

To define the business and technical requirements for the security system.. The Requirement Gathering phase in the Cisco security design process is the foundational step where the security team collaborates with stakeholders to identify and document both business and technical requirements. This includes understanding business objectives, regulatory compliance needs, risk tolerance, and operational constraints, which then inform the technical specifications for the security system. Without this phase, the design lacks alignment with organizational goals and may fail to address critical security gaps.

Answer

To install the hardware.

Answer

To document the budget only.

Answer

To troubleshoot existing issues.

Question 5

A security designer is choosing a firewall architecture for a high-throughput data center core. Which Cisco Firewall platform is purpose-built for this requirement?

Accepted Answer

Cisco Firepower 4100/9300 Series. The Cisco Firepower 4100 and 9300 Series are purpose-built high-throughput data center firewall appliances, designed for the core with multi-hundred-Gbps throughput, high connection rates, and clustering/HA capabilities. They run FTD (Firepower Threat Defense) and integrate with FMC for centralized management, making them the correct choice for a high-throughput data center core.

Answer

Cisco Meraki MX

Answer

Cisco Firepower 1010

Answer

Cisco ASA 5506-X

Question 6

When designing a secure API lifecycle, which THREE activities should be automated in the CI/CD pipeline? (Choose THREE)

Accepted Answer

API contract/schema testing. Option B (API contract/schema testing) is correct because validating the OpenAPI/Swagger contract against the implementation in CI/CD catches breaking changes, missing fields, and type mismatches early, ensuring consumers and producers stay in sync. Option C (SAST for API code) is correct because static analysis scans source code for vulnerabilities such as injection flaws, hardcoded secrets, and insecure deserialization before deployment, shifting security left. Option D (Automated security policy provisioning for the API gateway) is correct because codifying gateway policies (rate limiting, authentication, WAF rules, TLS enforcement) as infrastructure-as-code ensures consistent, repeatable, and auditable security controls across environments. Option A is wrong because disabling logging harms security monitoring, incident response, and compliance rather than improving security. Option E is wrong because manual CISO review of every commit does not scale and contradicts the goal of automating security activities in the pipeline.

Answer

Disabling all logging for production performance

Answer

Manual code review of every commit by the CISO

Question 7

Which Cisco product would you choose to gain visibility into your SaaS applications and enforce data security policies?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock (part of Cisco Cloud Security/Umbrella CASB) is the SaaS security product that provides API-based visibility into sanctioned and unsanctioned SaaS apps and enforces DLP policies on data at rest and in motion. It discovers SaaS usage, classifies sensitive data, and applies granular controls. The other options address network, workload, or firewall layers, not SaaS application governance.

Answer

Cisco Umbrella

Answer

Cisco Secure Workload

Answer

Cisco Secure Firewall

Question 8

In the context of Cisco Cloudlock, what is a 'Shadow IT' application?

Accepted Answer

A SaaS application connected to the enterprise environment without official IT authorization. In Cisco Cloudlock, a 'Shadow IT' application is any SaaS application that is being used within the enterprise environment without explicit IT approval or oversight. Cloudlock discovers these by analyzing traffic and OAuth grants to sanctioned cloud services, revealing unsanctioned apps that may pose data-loss or compliance risks. The defining characteristic is unauthorized SaaS usage, not malicious code or firewall blocking.

Answer

An application that is blocked by the firewall

Answer

A backup tool for the data center

Answer

A malicious script running on an endpoint

Question 9

A design requirement for a new SOC environment mandates that incident data must be centralized. Which Cisco tool is best suited to act as the single pane of glass for integrating disparate security logs and telemetry?

Accepted Answer

Cisco SecureX. Cisco SecureX is the platform designed to act as a single pane of glass, integrating disparate security products and telemetry into a unified console with threat response, case management, and orchestration. It aggregates data from Cisco and third-party tools, making it the best fit for centralizing incident data across a SOC.

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Defense Orchestrator (CDO)

Question 10

You are designing a management plane security strategy for Cisco networking devices. Which protocol is recommended to replace Telnet to ensure encrypted administrative sessions?

Accepted Answer

SSH. SSH (Secure Shell) is the standard replacement for Telnet because it provides encrypted, authenticated administrative sessions. Telnet transmits credentials and commands in cleartext, while SSH uses strong encryption (AES, ChaCha20) and integrity checking to protect the management plane.

Answer

Netconf

Answer

SNMPv2c

Answer

HTTPS