SDSI Practice Test 12 — 15 Questions

Question 1

Which THREE capabilities are provided by Cisco Cloudlock to enhance SaaS security posture? (Choose THREE)

Accepted Answer

Data Loss Prevention (DLP) for SaaS data. Cisco Cloudlock is a cloud-native CASB (Cloud Access Security Broker) that enhances SaaS security posture through API-based monitoring rather than on-premises inspection. Option B is correct because Cloudlock provides Data Loss Prevention (DLP) for SaaS data, scanning content in sanctioned cloud apps such as Microsoft 365, Google Workspace, and Salesforce to detect and remediate exposure of sensitive data (PII, PCI, IP) via policies and regex/EDM classifiers. Option C is correct because Cloudlock includes User and Entity Behavior Analytics (UEBA), which baselines user activity across cloud apps and flags anomalous behavior such as impossible travel, mass downloads, or unusual sharing to detect compromised accounts and insider threats. Option E is correct because Cloudlock performs application auditing and vetting for third-party apps, using its AppFirewall and app-risk scoring to identify OAuth-connected apps with excessive scopes or risky permissions and to block or revoke them. Option A is incorrect because real-time packet capture on the local network is a function of on-premises tools such as Cisco Stealthwatch or Firepower, not the API-based Cloudlock CASB. Option D is incorrect because hardening physical server BIOS settings is a data-center hardware security task unrelated to SaaS security posture management.

Answer

Real-time packet capture on the local network

Answer

Hardening of physical server BIOS settings

Question 2

Which THREE services does Cisco Umbrella provide to secure remote workers? (Select 3)

Accepted Answer

Cloud Access Security Broker (CASB). Cisco Umbrella delivers DNS-layer security (E), which blocks malicious domains and IPs before a connection is established by resolving DNS requests through Umbrella's global resolvers, protecting remote workers regardless of their location. It also provides Secure Web Gateway (SWG) (D) functionality, including URL filtering, SSL inspection, and file inspection to enforce acceptable-use and block risky web content. Additionally, Umbrella offers Cloud Access Security Broker (CASB) (C) capabilities to discover and control sanctioned and unsanctioned SaaS applications and protect cloud data. Host-based Antivirus (A) is not an Umbrella service, as endpoint antivirus is provided by products such as Cisco Secure Endpoint, not Umbrella. Local network DHCP service (B) is also not offered by Umbrella; DHCP is a network infrastructure function handled by routers, switches, or dedicated DHCP servers, not a cloud security service.

Answer

Host-based Antivirus

Answer

Local network DHCP service

Question 3

Which Cisco product allows administrators to manage security policies across a multi-vendor firewall environment?

Accepted Answer

Cisco Defense Orchestrator (CDO).. Cisco Defense Orchestrator (CDO) is a cloud-based management platform designed to orchestrate security policy across multi-vendor firewalls (Cisco ASA, FTD, Meraki, and third-party devices). It provides a single console for policy consistency, object management, and device onboarding across heterogeneous environments. FMC is Firepower-only, ISE is identity/NAC, and SecureX is an integration/automation fabric, not a multi-vendor firewall policy manager.

Answer

Cisco SecureX.

Answer

Cisco ISE.

Answer

Cisco Firepower Management Center (FMC).

Question 4

Which THREE design components are required for a successful implementation of Cisco TrustSec? (Select 3)

Accepted Answer

Cisco ISE. Cisco ISE (A) is required because it serves as the centralized policy and identity engine for TrustSec, defining and distributing security group tags (SGTs) and policies to network devices. Scalable Group Tags (B) are required because TrustSec uses SGTs as the classification mechanism embedded in packets to enforce role-based access control without relying on IP addresses or subnets. Network Access Devices (E) are required because switches, routers, and wireless controllers must act as NADs to authenticate endpoints, apply SGTs, and enforce Security Group ACLs (SGACLs) in the TrustSec domain. DHCP Snooping (C) is not a TrustSec design component; it is a Layer 2 security feature used to prevent rogue DHCP servers and does not provide group-based policy enforcement. Cisco Umbrella (D) is a cloud-delivered DNS-layer security service and is unrelated to the TrustSec architecture, which relies on ISE, SGTs, and NADs.

Answer

DHCP Snooping

Answer

Cisco Umbrella

Question 5

What is the primary benefit of 'Shift Left' security in a DevSecOps pipeline?

Accepted Answer

Reduced remediation costs. Shift Left security moves security testing, scanning, and review earlier in the SDLC — into design, coding, and CI stages — so vulnerabilities are caught before they reach production. The primary measurable benefit is reduced remediation cost, because fixing a flaw during development is far cheaper than fixing it after deployment or after a breach.

Answer

Automated hardware deployment

Answer

Increased development speed

Answer

Elimination of security teams

Question 6

For a zero-trust architecture, what is the primary function of Cisco ISE?

Accepted Answer

Acting as a Policy Decision Point (PDP) for access control.. Cisco ISE (Identity Services Engine) serves as the Policy Decision Point (PDP) in a zero-trust architecture. It evaluates identity, device posture, and contextual attributes (e.g., location, time, threat level) against configured policies to make dynamic access control decisions. These decisions are then enforced by Policy Enforcement Points (PEPs) like switches, wireless controllers, or firewalls. Thus, ISE's primary function is centralized policy decision-making for network access, not password management or packet filtering.

Answer

Managing user passwords.

Answer

Packet filtering at the edge.

Answer

Automating WAN path selection.

Question 7

Which design principle helps minimize the impact of a compromised API key?

Accepted Answer

Rotating keys frequently. Frequent key rotation limits the window of opportunity for an attacker who has stolen or leaked a key — the compromised credential becomes useless once rotated. It also forces teams to build automated rotation and revocation workflows, which reduces the blast radius of any single key exposure. This is a core principle of credential hygiene and least-privilege design.

Answer

Hard-coding keys in the source code

Answer

Using long-lived static API keys

Answer

Sharing a single key among all users

Question 8

To ensure effective post-incident architecture adaptation, which THREE items must be included in the design documentation for future reference? (Choose three)

Accepted Answer

Modified security policy logic. Option B (Modified security policy logic) is correct because post-incident architecture adaptation requires documenting how security policies were changed in response to the incident, so future teams understand the rationale and can maintain or evolve those controls. Option C (Log correlation and alert rules) is correct because the detection engineering artifacts—correlation rules, thresholds, and alert logic—must be captured to preserve the improved detection capability and enable tuning after the incident. Option E (Automated response orchestration workflows) is correct because SOAR/automation playbooks encode the validated response actions and must be documented so the orchestration can be reused, audited, and updated as the architecture changes. Option A (User password policies) is not a post-incident architecture adaptation artifact; password policy is a standing access-control baseline, not incident-derived design documentation. Option D (Hardware rack elevation diagrams) is physical infrastructure documentation unrelated to adapting the architecture based on incident lessons.

Answer

User password policies

Answer

Hardware rack elevation diagrams

Question 9

Which THREE components in Cisco Secure Workload are essential for building a Zero Trust segmentation policy? (Choose THREE)

Accepted Answer

Policy enforcement agents. Option A (Policy enforcement agents) is correct because Cisco Secure Workload relies on agents installed on workloads (or agentless integrations) to enforce the microsegmentation policies at the workload level, translating the intent-based policy into actual allow/deny rules on the host. Option C (Flow telemetry analysis) is correct because Secure Workload continuously ingests flow data from the agents and network devices to map actual workload-to-workload communication, which is the foundation for defining least-privilege segmentation rules. Option E (Workload discovery and profiling) is correct because before any Zero Trust policy can be built, Secure Workload must discover workloads, label them by attributes (e.g., environment, role, application), and profile their behavior to create accurate policy scopes. Option B (Manual IP address manual entry) is not part of the Zero Trust segmentation workflow in Secure Workload, which uses dynamic labels and policy constructs rather than static IP lists. Option D (Physical cable management) is a Layer 1 cabling task unrelated to building segmentation policy in Cisco Secure Workload.

Answer

Manual IP address manual entry

Answer

Physical cable management

Question 10

When designing a microsegmentation strategy with Cisco Secure Workload, which THREE metrics should be monitored to validate policy effectiveness? (Choose THREE)

Accepted Answer

Reduction in unauthorized lateral movement flows. Option B is correct because the core goal of microsegmentation with Cisco Secure Workload is to shrink the attack surface, so a measurable reduction in unauthorized lateral movement flows directly demonstrates that east-west traffic is being constrained by policy. Option D is correct because denied connection attempts show the policy is actively enforcing allow-lists and blocking traffic that violates intent, providing evidence the rules are effective rather than merely present. Option E is correct because tracking the frequency of policy changes reveals policy churn and drift; excessive changes can indicate unstable or ineffective rules and help validate that the policy set has stabilized. Option A is not relevant because server uptime measures availability, not segmentation enforcement, and Option C is not relevant because switch count is a topology/inventory metric unrelated to policy effectiveness.

Answer

Average server uptime

Answer

Total number of network switches used

Question 11

A security architect is configuring a design for an enterprise with high-speed (100G) traffic. Which Cisco firewall solution is most appropriate?

Accepted Answer

Cisco Firepower 9300 series.. Cisco Firepower 9300 series is a high-end, carrier-class firewall designed for high-speed, high-throughput environments, including 100G interfaces. It supports modular security services and clustering for scalability and redundancy. This makes it the most appropriate choice for an enterprise with 100G traffic.

Answer

Cisco Umbrella virtual appliance.

Answer

Cisco Firepower 1000 series.

Answer

Cisco AnyConnect.

Question 12

When designing a VPN for a multi-tenant cloud environment, which technology allows for the separation of routing tables to ensure traffic isolation between tenants?

Accepted Answer

VRF-Lite. VRF-Lite (Virtual Routing and Forwarding Lite) allows multiple independent routing tables to coexist on a single router or Layer 3 switch, providing logical separation of traffic between tenants without requiring MPLS. In a multi-tenant cloud VPN design, VRF-Lite ensures each tenant's routes are isolated, preventing cross-tenant traffic leakage.

Answer

VLAN tagging

Answer

Access Control Lists

Answer

IPsec Tunnels

Question 13

Which Cisco solution provides host-based visibility and protection against fileless malware?

Accepted Answer

Cisco Secure Endpoint.. Cisco Secure Endpoint (formerly AMP for Endpoints) is the host-based endpoint protection platform that uses behavioral analytics, exploit prevention, and continuous file monitoring to detect and block fileless malware that lives in memory and abuses legitimate system tools. It provides the endpoint-level visibility and protection required for fileless threats.

Answer

Cisco ISE.

Answer

Cisco Secure Firewall.

Answer

Cisco Prime Infrastructure.

Question 14

In a hybrid work design, what is the advantage of using Cisco Umbrella's roaming client?

Accepted Answer

It provides consistent security coverage off-network.. Cisco Umbrella's roaming client extends DNS-layer security to devices even when they are off the corporate network. It ensures that security policies are consistently applied regardless of location, protecting users from malicious domains and enforcing acceptable use policies. This is a key advantage for hybrid work.

Answer

It replaces the need for a local firewall.

Answer

It only works on internal corporate Wi-Fi.

Answer

It forces all traffic through a local DC.

Question 15

Why is 'Behavioral Analysis' a critical component of Cisco API Security?

Accepted Answer

To detect anomalous and signature-less threats. Behavioral analysis is critical in Cisco API Security because it establishes a baseline of normal API call patterns (frequency, payload size, sequence, source, timing) and then flags deviations that indicate attacks. Signature-based detection fails against novel or polymorphic API attacks, so behavioral analysis is what catches zero-day and signature-less threats such as credential stuffing, data scraping, and business-logic abuse. This is the core value proposition of the capability.

Answer

To speed up the API processing

Answer

To reduce API storage requirements

Answer

To replace the need for API documentation