SDSI Practice Test 13 — 15 Questions

Question 1

When selecting a security approach for email threats, which Cisco technology provides automated sandboxing to protect against zero-day phishing?

Accepted Answer

Cisco Secure Malware Analytics.. Cisco Secure Malware Analytics (formerly Threat Grid) is Cisco's automated malware analysis and sandboxing platform. It detonates suspicious files and URLs in an isolated environment, observes behavior, and produces threat scores and indicators, which is exactly the automated sandboxing needed to catch zero-day phishing payloads that signature-based filters miss. It integrates with email security (ESA) to submit attachments and links for analysis.

Answer

Cisco Duo MFA.

Answer

Cisco Umbrella DNS layer security.

Answer

Cisco Secure Endpoint protection.

Question 2

A design requirements gathering phase identifies that users frequently access untrusted SaaS applications. Which Cisco solution should be included to mitigate data exfiltration risks?

Accepted Answer

Cisco Umbrella with CASB capability enabled.. Cisco Umbrella with CASB capability enabled provides visibility and control over SaaS application usage, including the ability to detect and block unsanctioned apps, enforce DLP policies, and mitigate data exfiltration risks. It is specifically designed to secure cloud access and protect data in SaaS environments.

Answer

Cisco Secure Firewall with IPS enabled.

Answer

Cisco AnyConnect VPN.

Answer

Cisco Identity Services Engine (ISE).

Question 3

A company is migrating to a SASE architecture using Cisco+ Secure Connect. Which component is responsible for the unified identity-based access control for remote users?

Accepted Answer

Cisco Duo integration within the Secure Connect platform.. In Cisco+ Secure Connect (Cisco's SASE offering), unified identity-based access control for remote users is provided by the integration with Cisco Duo. Duo provides multi-factor authentication (MFA) and device trust, which are essential for zero-trust access. The Secure Connect platform leverages Duo to enforce identity-based policies before granting access to applications. The other options are either legacy components (AnyConnect standalone VPN) or on-premises solutions (ISE) that are not the primary identity control in the SASE architecture.

Answer

AnyConnect standalone VPN gateway.

Answer

Firepower Management Center cloud connector.

Answer

On-premises ISE cluster.

Question 4

An organization is modifying their architecture to meet new compliance requirements for logging. The design requires offloading logs from multiple Cisco Firepower sensors. What is the recommended destination for long-term audit storage?

Accepted Answer

Security Information and Event Management (SIEM). For long-term audit storage of logs from multiple Cisco Firepower sensors, a Security Information and Event Management (SIEM) system is the recommended destination. SIEMs are designed to aggregate, correlate, and retain logs from diverse sources for compliance and forensic analysis. They provide centralized storage, search, and reporting capabilities that meet audit requirements.

Answer

Cisco ISE Node

Answer

Cisco Catalyst Center

Answer

Local flash memory on the sensor

Question 5

For a DevSecOps pipeline involving Cisco Secure Firewall, what is the 'CI' (Continuous Integration) component responsible for?

Accepted Answer

Validating and testing code changes. In a DevSecOps pipeline for Cisco Secure Firewall, the Continuous Integration (CI) component is responsible for validating and testing code changes — automatically building, linting, and running tests on firewall policy or automation code before it is merged. This ensures that changes meet quality and security standards before progressing to deployment.

Answer

User access authentication

Answer

Monitoring runtime attacks

Answer

Deploying to production

Question 6

A security design architect needs to ensure that all endpoints have the latest malware signatures. Which tool provides continuous, automated updates?

Accepted Answer

Cisco Secure Endpoint.. Cisco Secure Endpoint (formerly AMP for Endpoints) is the endpoint detection and response (EDR) agent that continuously updates malware signatures and cloud-based threat intelligence on managed endpoints. Its cloud reputation engine and signature sets are pushed automatically without administrator intervention, satisfying the requirement for continuous, automated updates.

Answer

Cisco Secure Firewall.

Answer

Cisco ISE.

Answer

Cisco Umbrella.

Question 7

Your organization uses a hybrid cloud model. You are tasked with designing a security posture for workloads in AWS and Azure using Cisco Secure Workload. What is the benefit of the 'Anywhere' agent approach?

Accepted Answer

It provides consistent security policy enforcement across heterogenous environments. The 'Anywhere' agent approach in Cisco Secure Workload provides consistent security policy enforcement across heterogeneous environments, including on-premises, AWS, Azure, and other clouds. It allows you to define policies once and apply them uniformly, regardless of where the workload runs, ensuring a unified security posture.

Answer

It automatically patches the underlying operating system

Answer

It replaces the need for a central management platform

Answer

It eliminates the need for any firewall rules in the cloud

Question 8

A security architect is designing a Cisco Secure Firewall deployment for a multi-cloud environment. Which design approach provides the most consistent security policy enforcement across AWS and Azure?

Accepted Answer

Utilize Cisco Defense Orchestrator for centralized policy management.. Cisco Defense Orchestrator (CDO) provides centralized, cloud-delivered management of Cisco Secure Firewall (FTD) policies across multiple environments, including AWS and Azure. By managing all firewalls from a single pane, CDO ensures consistent access control, intrusion prevention, and URL filtering policies regardless of which cloud the firewall instance runs in.

Answer

Deploy individual local managers for each cloud provider.

Answer

Rely on native cloud-native security groups only.

Answer

Implement separate FTD instances with unique local access control lists.

Question 9

You are performing a security assessment of a containerized application architecture. Which TWO of the following configurations are critical for ensuring secure communication between pods in a Cisco ACI-managed Kubernetes environment? (Choose TWO)

Accepted Answer

Defining Contracts between EPGs to permit specific traffic types.. Option A is correct because in Cisco ACI, Contracts define the permitted protocols, ports, and directions of traffic between EPGs, so defining Contracts between EPGs enforces microsegmentation and only allows the specific traffic types required between pods. Option C is correct because pods must be mapped to the appropriate EPGs based on their function; the EPG is the policy enforcement boundary in ACI, so without correct pod-to-EPG assignment, Contracts cannot be applied to the right workloads. Option B is incorrect because disabling the ACI CNI plugin removes ACI's native integration with Kubernetes networking and policy enforcement, undermining rather than improving secure pod communication. Option D is incorrect because a single flat, non-segmented network eliminates the segmentation that ACI EPGs and Contracts rely on to isolate and control pod traffic. Option E is incorrect because physical cabling and VLAN separation are not the mechanism for securing pod-to-pod communication in an ACI-managed Kubernetes environment, where policy is enforced logically through EPGs and Contracts.

Answer

Disabling the ACI CNI plugin to allow native Kubernetes network policies.

Answer

Configuring all pods to reside in a single flat, non-segmented network.

Answer

Using physical cabling to separate traffic by VLAN.

Question 10

Which TWO design considerations are critical for a secure SD-WAN edge deployment?

Accepted Answer

Centralized security policy enforcement via vManage.. Option C is correct because Cisco SD-WAN's vManage controller provides centralized policy management, allowing consistent security and application-aware policies to be pushed to all edge devices, which is essential for maintaining a uniform security posture across a distributed SD-WAN fabric. Option D is correct because automated IPsec tunnel encryption secures the data plane by encrypting traffic between WAN edge devices, protecting data in transit across untrusted transports such as the internet. Option A is incorrect because local breakout without inspection bypasses security controls and exposes traffic to threats, undermining a secure edge design. Option B is incorrect because deploying devices with default passwords creates a serious vulnerability that attackers can easily exploit. Option E is incorrect because disabling the control plane firewall removes protection for the SD-WAN control plane, leaving it exposed to unauthorized access and attacks.

Answer

Using local breakout for all internet traffic without inspection.

Answer

Deploying devices with default passwords.

Answer

Disabling the control plane firewall.

Question 11

During a post-incident review, an architect identifies that Cisco Stealthwatch (Secure Network Analytics) failed to alert on lateral movement due to lack of visibility. Which design modification is required to ensure visibility into internal east-west traffic?

Accepted Answer

Enable NetFlow export from core and distribution layer switches to the Stealthwatch Flow Collector.. Stealthwatch (Cisco Secure Network Analytics) relies on flow telemetry—primarily NetFlow/IPFIX—to build its behavioral baselines and detect anomalies such as lateral movement. Without flow export from internal Layer 3 boundaries (core and distribution switches), the Flow Collector only sees perimeter traffic and cannot observe east-west conversations between internal hosts. Enabling NetFlow export from those switches feeds the Flow Collector the internal flow records needed to detect anomalous host-to-host behavior.

Answer

Update the Cisco Secure Endpoint policy to scan memory more frequently on all endpoints.

Answer

Increase the logging interval on the perimeter Cisco Firepower Management Center.

Answer

Integrate the Cisco ISE platform via pxGrid to force all internal hosts to re-authenticate.

Question 12

When designing security for a microservices architecture, why should you implement a 'Zero Trust' approach at the service level?

Accepted Answer

To ensure that every service-to-service call is authenticated and authorized. Zero Trust at the service level ensures that every service-to-service call is authenticated and authorized, regardless of network location. This prevents lateral movement in case of a breach and enforces least privilege. It is essential in microservices architectures where traditional perimeter security is insufficient.

Answer

To rely solely on network perimeter security

Answer

To increase the latency of inter-service communication

Answer

To simplify the management of firewall rules

Question 13

You are designing a secure API architecture where services are deployed in Kubernetes. You need to enforce authentication and rate limiting at the ingress. Which tool should be used for centralized policy enforcement?

Accepted Answer

An API Gateway integrated into the Ingress Controller. An API Gateway integrated into the Ingress Controller is the correct choice because it centralizes authentication, rate limiting, and other cross-cutting concerns at the ingress layer before traffic reaches microservices. This offloads security logic from individual services and provides a single enforcement point for policies like JWT validation, API key checks, and quota management. Tools like Kong, NGINX Ingress with auth plugins, or Istio Gateway with Envoy filters implement this pattern.

Answer

Using IP-based ACLs on the Kubernetes node

Answer

Hard-coding auth logic into every microservice

Answer

Cisco Secure Firewall running in transparent mode

Question 14

What is the primary goal of implementing microsegmentation in an enterprise data center?

Accepted Answer

To prevent lateral movement of attackers. Microsegmentation creates granular, workload-level security zones (often down to individual VMs or containers) so that east-west traffic must be explicitly authorized. Its primary security goal is to prevent lateral movement — if an attacker compromises one workload, they cannot freely pivot to others because inter-segment traffic is denied by default. Bandwidth, topology simplification, and server reduction are operational side effects at best, not the goal.

Answer

To increase bandwidth capacity

Answer

To simplify the network topology

Answer

To reduce the number of servers required

Question 15

In a post-incident design, which tool should be used to provide visibility into user activity across multiple SaaS applications?

Accepted Answer

Cisco Umbrella (with CASB).. Cisco Umbrella with CASB provides visibility and control over user activity across SaaS applications by combining DNS-layer security with cloud access security broker capabilities. CASB discovers shadow SaaS usage, enforces policies, and provides activity visibility across sanctioned and unsanctioned apps. ISE is identity/NAC, Stealthwatch is network flow analytics, and Secure Firewall is perimeter/IPS — none deliver SaaS application activity visibility the way Umbrella CASB does.

Answer

Cisco ISE.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Firewall.