SDSI Practice Test 14 — 15 Questions

Question 1

A security design requires that all outbound traffic be inspected for malware. Which Cisco solution feature should be included to achieve this at the DNS layer?

Accepted Answer

Cisco Umbrella DNS-layer security.. Cisco Umbrella DNS-layer security is specifically designed to block malicious domains and IPs at the DNS resolution stage, before a connection is even established. It inspects DNS queries from all users and devices, regardless of location, and enforces security policies by redirecting malicious requests to a block page. This directly satisfies the requirement to inspect outbound traffic for malware at the DNS layer, as it stops threats like malware callbacks, phishing, and command-and-control communications early in the kill chain.

Answer

Cisco AnyConnect VPN tunnel.

Answer

Cisco Identity Services Engine.

Answer

Cisco Secure Firewall IPS.

Question 2

You are designing an IoT security strategy for a manufacturing site. Which approach best isolates unmanaged IoT devices from the enterprise network?

Accepted Answer

Implement Cisco ISE with SGT-based micro-segmentation.. Cisco ISE with SGT-based micro-segmentation (TrustSec) provides granular isolation of IoT devices by assigning Security Group Tags and enforcing policies across the network, even within the same VLAN. This approach best isolates unmanaged IoT devices from the enterprise network because it enables dynamic segmentation and policy enforcement based on device identity and context, not just network topology.

Answer

Deploy a transparent firewall in bridge mode at the distribution layer.

Answer

Enable PortFast on all IoT switch ports.

Answer

Assign static VLANs to all IoT ports on access switches.

Question 3

When designing a multi-cloud CI/CD security architecture, how should secrets (API keys for Cisco FMC) be managed to ensure compliance?

Accepted Answer

Use a dedicated Secret Management service. A dedicated Secret Management service (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) provides centralized, auditable, and policy-driven storage for sensitive credentials like Cisco FMC API keys. It enforces encryption at rest and in transit, supports dynamic secrets and rotation, and integrates with CI/CD pipelines via short-lived tokens, ensuring compliance with standards such as PCI DSS, HIPAA, and SOC 2. This approach eliminates hardcoded secrets and reduces the blast radius of a compromise.

Answer

Embed as environment variables in the build runner

Answer

Encrypt with base64 and store in Git

Answer

Hardcode in the Terraform provider block

Question 4

For a high-availability firewall architecture, which design element is critical when utilizing a routed-mode configuration in a data center?

Accepted Answer

Utilizing a dedicated stateful failover link between firewalls.. In a routed-mode high-availability firewall pair, each firewall maintains its own routing table and forwards based on Layer 3, so the two units must synchronize connection state to survive a failover without dropping established sessions. A dedicated stateful failover link carries that state (session tables, NAT translations, VPN state) between the peers. Without it, traffic that was mid-session would be dropped when the standby takes over.

Answer

Configuring HSRP between firewall interfaces.

Answer

Implementing OSPF equal-cost multi-path (ECMP) for load balancing.

Answer

Using a virtual MAC address per interface.

Question 5

What is the primary purpose of conducting a risk assessment as part of the security design process?

Accepted Answer

To identify and prioritize security controls based on threat and vulnerability data.. A risk assessment identifies threats, vulnerabilities, and potential impacts, then prioritizes them so that security controls can be selected and funded based on actual risk rather than guesswork. This ensures the design addresses the most significant risks first and justifies control selection to stakeholders.

Answer

To automate the patching of all network servers.

Answer

To ensure compliance with local labor laws.

Answer

To select the cheapest security hardware.

Question 6

An architect is reviewing post-incident logs in Cisco SecureX. Which feature allows the analyst to see the timeline of events from different integrated products in one view?

Accepted Answer

SecureX Incident/Event Timeline.. SecureX provides an Incident/Event Timeline view that aggregates events from all integrated products (Secure Endpoint, Umbrella, Firepower, Email, etc.) into a single chronological view for an investigation. This is the feature that lets an analyst see the sequence of events across products without pivoting between consoles. The other options are single-product event views that do not aggregate cross-product timelines.

Answer

Stealthwatch Alarms view.

Answer

FMC Event Viewer.

Answer

ISE Auth Reports.

Question 7

Which TWO design considerations are essential when implementing a Zero Trust architecture for IoT devices in a campus environment using Cisco ISE and TrustSec?

Accepted Answer

Utilizing Cisco ISE to profile and categorize IoT endpoints.. Option B is correct because Cisco ISE's profiling and endpoint categorization is foundational to Zero Trust for IoT: ISE uses probes (RADIUS, SNMP, DHCP, NMAP, etc.) and profiling policies to identify device types, which then drives authorization and policy decisions rather than trusting the device by default. Option C is correct because TrustSec Scalable Group Tags (SGTs) applied to IoT endpoints enable micro-segmentation via Security Group ACLs (SGACLs) enforced on network devices, so traffic between IoT groups and other segments is restricted based on group membership rather than IP addresses or VLANs. Static IP addressing (A) is not essential and actually complicates profiling and dynamic policy, since DHCP-based profiling and identity context are commonly leveraged. Placing all IoT devices in one VLAN (D) contradicts Zero Trust micro-segmentation by creating a flat, overly permissive broadcast domain. Disabling 802.1X for all non-PC devices (E) weakens identity-based access control and is not a Zero Trust design principle; IoT devices should be authenticated where possible (e.g., MAB, 802.1X with certificates) and then authorized through ISE.

Answer

Using static IP addresses for every IoT device to ensure consistency.

Answer

Ensuring all IoT devices are placed in the same VLAN for easier management.

Answer

Disabling 802.1X for all non-PC devices.

Question 8

What is the benefit of using 'Identity-Based' microsegmentation in Cisco Secure Workload?

Accepted Answer

It provides stable policies that persist through workload moves and scaling. Identity-based microsegmentation in Cisco Secure Workload uses workload identity (labels, tags, process attributes) rather than IP addresses to define policy. Because policies are anchored to identity, they remain valid even when workloads move, scale, or change IPs — providing stable, portable policy across dynamic environments. This is the key benefit over IP-based rules.

Answer

It requires less initial configuration

Answer

It relies on hard-coded firewall rules

Answer

It is only compatible with physical servers

Question 9

You are automating Cisco Secure Firewall policies. Why is 'Version Control' (e.g., Git) considered a security control?

Accepted Answer

Provides audit trails and change history. Version control systems like Git provide audit trails and change history, which are essential security controls for tracking who changed firewall policies, when, and why. This enables accountability, rollback of malicious or erroneous changes, and compliance with change management requirements. In automated environments, version control ensures that policy changes are reviewed and approved before deployment, reducing the risk of unauthorized modifications.

Answer

Automatically encrypts all traffic

Answer

Increases bandwidth

Answer

Replaces the need for a firewall

Question 10

When assessing the risk of 'Data Loss' via USB devices, which Cisco product provides the best control for endpoint-based DLP?

Accepted Answer

Cisco Secure Endpoint.. Cisco Secure Endpoint (formerly AMP for Endpoints) is the endpoint agent that provides device-level control, including USB device blocking and data loss prevention policies on endpoints. It is the only option that operates at the endpoint layer where USB devices are physically attached, making it the correct choice for endpoint-based DLP against USB data loss.

Answer

Cisco Stealthwatch.

Answer

Cisco ISE.

Answer

Cisco Umbrella.

Question 11

When designing for SaaS security, why should you implement a 'Least Privilege' policy for third-party application integrations?

Accepted Answer

To limit the impact if the third-party application is compromised. Least privilege limits the permissions granted to a third-party integration to only what it strictly needs, so if that third party is breached, the attacker inherits only that narrow scope rather than broad access to the SaaS tenant. This directly reduces blast radius and is a core Zero Trust and SaaS security control. It is a security control, not a licensing, performance, or usability feature.

Answer

To avoid paying license fees

Answer

To improve the application's performance

Answer

To make the application easier to install

Question 12

When designing an API strategy, what is the 'API Contract' and why is it important for security?

Accepted Answer

A technical specification that allows for automated schema validation and security enforcement. An API Contract is a formal, machine-readable specification (typically OpenAPI/Swagger, RAML, or gRPC proto) that defines endpoints, methods, parameters, request/response schemas, and authentication requirements. Because it is machine-readable, it enables automated schema validation of every request and response, and it lets security controls (input validation, auth scopes, rate limits) be enforced consistently at the gateway. This makes it a security asset, not just documentation.

Answer

A password file for the API

Answer

A legal document for the API usage

Answer

A file that lists all allowed IP addresses

Question 13

What is the primary design benefit of deploying Cisco Secure Workload as a 'software-only' solution in a public cloud environment?

Accepted Answer

It provides consistent security enforcement without relying on physical network appliances. A software-only deployment of Cisco Secure Workload runs as agents or virtual appliances within the cloud environment, so it enforces policy consistently across workloads without depending on physical network appliances that cannot be inserted into cloud traffic paths. This preserves microsegmentation and visibility even as workloads scale and migrate.

Answer

It reduces the need for VPC configuration

Answer

It guarantees 100% protection against all malware

Answer

It automates the creation of virtual machines

Question 14

You are designing security for a SaaS application integrated with Cisco Cloudlock. A user is persistently attempting to share sensitive documents with external parties. Which Cloudlock feature should be applied to remediate this?

Accepted Answer

Create a policy to automatically unshare files containing PII with external collaborators. Cisco Cloudlock is a cloud access security broker (CASB) that provides data loss prevention (DLP) and user behavior analytics for SaaS applications. The scenario describes a user persistently sharing sensitive documents externally, which is a data exfiltration risk. The correct remediation is to create a Cloudlock policy that automatically unshares files containing PII when shared with external collaborators. This directly addresses the behavior by enforcing a data-centric control that revokes unauthorized sharing, aligning with Cloudlock's core policy enforcement capabilities.

Answer

Implement MFA for the SaaS login portal

Answer

Enable Cisco Umbrella DNS-layer protection

Answer

Configure an API Key for the SaaS platform

Question 15

During a risk assessment, it is determined that a legacy application cannot be patched. Which Cisco security control should be prioritized to compensate for this vulnerability?

Accepted Answer

Virtual patching via Cisco Secure Firewall IPS.. Virtual patching via Cisco Secure Firewall IPS provides a compensating control for unpatched vulnerabilities by inspecting and blocking exploit traffic at the network layer. It does not require modifying the legacy application, making it ideal when patching is not possible. This approach reduces risk while maintaining availability.

Answer

Cisco Stealthwatch behavioral alerts.

Answer

Cisco AnyConnect VPN.

Answer

Cisco Umbrella DNS blocking.