SDSI Practice Test 14 — 15 Questions

Question 1

Which design factor is most important when deploying a large-scale Cisco Secure Firewall cluster?

Accepted Answer

Ensuring adequate load balancing and capacity planning.. Proper load balancing and traffic distribution are essential for cluster performance and reliability.

Answer

Ensuring all firewalls have the same firmware version.

Answer

The color of the patch cables used.

Answer

The physical location of the firewalls.

Question 2

When designing security for a multi-tenant cloud application, which principle is most effectively addressed by using Cisco Secure Workload to create distinct security domains?

Accepted Answer

Logical Tenant Isolation. Microsegmentation allows for the isolation of multi-tenant environments by ensuring that workloads belonging to different tenants cannot communicate, effectively enforcing logical separation.

Answer

User Identity Provisioning

Answer

Data Backup and Recovery

Answer

null

Answer

Hardware Redundancy

Question 3

A security architect is designing a Cisco Secure Firewall deployment for a multi-cloud environment. Which design strategy ensures consistent security policy enforcement across AWS and Azure instances?

Accepted Answer

Utilize a centralized FMC to manage virtual Secure Firewalls across all cloud environments.. Cisco Secure Firewall Management Center (FMC) acts as the central management plane to push uniform policies across heterogeneous cloud environments.

Answer

Deploy separate FMC instances in each cloud provider for localized management.

Answer

Use individual Firewall Device Managers (FDM) for every instance.

Answer

Implement cloud-native security groups exclusively to bypass firewall bottlenecks.

Question 4

In a multi-cloud design, which component is used to connect remote offices directly to the cloud provider while maintaining Cisco-level security?

Accepted Answer

Cisco SD-WAN Cloud OnRamp.. Cisco SD-WAN (Viptela) provides secure, optimized connectivity to cloud environments via Cloud OnRamp.

Answer

Local NAT translation.

Answer

Cisco Secure Access Control Server (ACS).

Answer

Standard site-to-site IPsec tunnel.

Question 5

A design requirement specifies that all remote access must be verified through device health checks. Which Cisco tool allows for this posture assessment?

Accepted Answer

Cisco AnyConnect Secure Client with Compliance Module.. Cisco AnyConnect (now Secure Client) performs device posture checks using the AnyConnect Compliance Module.

Answer

Cisco Identity Services Engine (ISE) pxGrid.

Answer

Cisco Umbrella roaming client.

Answer

Cisco Secure Firewall VPN portal.

Question 6

A security design requires that all outbound traffic be inspected for malware. Which Cisco solution feature should be included to achieve this at the DNS layer?

Accepted Answer

Cisco Umbrella DNS-layer security.. Cisco Umbrella provides DNS-layer security by preventing connections to known malicious domains.

Answer

Cisco AnyConnect VPN tunnel.

Answer

Cisco Identity Services Engine.

Answer

Cisco Secure Firewall IPS.

Question 7

What is the primary goal of the 'Requirement Gathering' phase in the Cisco security design process?

Accepted Answer

To define the business and technical requirements for the security system.. To define the business and technical objectives that the security design must meet.

Answer

To install the hardware.

Answer

To document the budget only.

Answer

To troubleshoot existing issues.

Question 8

During a risk assessment, which THREE factors are considered critical for determining the design requirements of a secure infrastructure? (Choose three)

Accepted Answer

Regulatory and compliance requirements. Regulatory requirements, threat landscape, and business criticality are the three fundamental pillars for any security design requirement gathering process.

Answer

Office physical location and square footage

Answer

Employee headcount and department budget

Question 9

A design requirement for risk mitigation in a data center requires micro-segmentation. Which Cisco technology is specifically designed to provide workload-level segmentation based on identity and policy?

Accepted Answer

Cisco Secure Workload.. Cisco Secure Workload (formerly Tetration) provides deep visibility and micro-segmentation for data center workloads.

Answer

Cisco Firepower NGFW.

Answer

Cisco AnyConnect.

Answer

Cisco TrustSec/SGTs.

Question 10

A design needs to restrict network access based on the user's role and device type. Which Cisco product is the primary engine for this context-aware policy control?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco ISE (Identity Services Engine) is the industry-standard policy engine for context-aware access control.

Answer

Cisco SecureX.

Answer

Cisco Firepower Management Center.

Answer

Cisco Umbrella.

Question 11

Which TWO Cisco products provide integrated threat intelligence (Talos) to enhance incident response?

Accepted Answer

Cisco Secure Endpoint.. Talos intelligence is a core feature of the Cisco security portfolio, particularly in Firepower and Secure Endpoint.

Answer

Cisco AnyConnect.

Answer

Cisco Stealthwatch.

Answer

Cisco ISE.

Question 12

When gathering requirements for a security design, a customer specifies they need to automate the containment of infected endpoints discovered by Cisco Secure Endpoint. Which API integration should the architect document?

Accepted Answer

Cisco Secure Endpoint API. The Cisco Secure Endpoint API allows for automated isolation of endpoints, which is a common requirement for incident response automation.

Answer

Cisco Umbrella Investigate API

Answer

Cisco Secure Firewall API

Answer

Cisco ISE REST API

Question 13

Which risk assessment methodology component focuses on identifying the 'crown jewels' of the organization's network architecture?

Accepted Answer

Asset Identification. Asset identification and classification is the foundational step in risk assessment, identifying the critical assets that need protection.

Answer

Control Implementation

Answer

Vulnerability Scanning

Answer

Threat Vector Analysis

Question 14

A security designer is tasked with improving the SOC's incident response time. Which TWO Cisco platform capabilities should be integrated to enable automated threat hunting and containment? (Choose two)

Accepted Answer

Cisco Secure Endpoint. Cisco Secure Endpoint (AMP) and Cisco Secure Firewall are the primary components that, when integrated via SecureX, allow for hunting and automated containment.

Answer

Cisco Webex

Answer

Cisco UCS Manager

Answer

Cisco Prime Infrastructure

Question 15

A security architect is designing a DR strategy. Which feature of Cisco Secure Firewall ensures that configurations are synchronized between primary and backup units in a high-availability pair?

Accepted Answer

Cisco Secure Firewall Failover Link.. Stateful failover ensures configuration and session state synchronization.

Answer

Cisco Defense Orchestrator auto-sync.

Answer

Cisco Identity Services Engine RADIUS sync.

Answer

Cisco FMC policy deployment.