SDSI Practice Test 15 — 15 Questions

Question 1

To protect a SaaS application accessed by remote users, which Cisco solution provides a unified cloud-native security stack including DNS-layer security and SWG?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the cloud-native Secure Internet Gateway (SIG) that combines DNS-layer security, Secure Web Gateway (SWG), cloud-delivered firewall, and CASB into a single unified stack delivered from the cloud. It is specifically designed to protect users accessing SaaS and internet resources from any location without backhauling traffic to a data center. The other options are point products that do not deliver this unified cloud-native DNS+SWG capability.

Answer

Cisco Duo

Answer

Cisco Firepower Threat Defense

Answer

Cisco Secure Endpoint

Question 2

What is the primary role of a Service Mesh in an API architecture?

Accepted Answer

To abstract and manage service-to-service communication. A service mesh is a dedicated infrastructure layer that handles service-to-service communication within a microservices or API architecture. It provides capabilities like traffic management, mutual TLS, observability, and policy enforcement without requiring changes to application code. By abstracting this communication into sidecar proxies or ambient nodes, it decouples networking concerns from business logic, which is its primary role. This is why option D is correct.

Answer

To perform deep packet inspection of external user traffic

Answer

To act as a physical load balancer

Answer

To replace the need for API documentation

Question 3

When designing for microsegmentation using Cisco Secure Workload, what is the significance of 'Flow Visibility'?

Accepted Answer

It allows for the modeling and validation of security policies before enforcement. Flow Visibility in Cisco Secure Workload (formerly Tetration) continuously ingests and analyzes actual east-west traffic between workloads, building a dependency map of every conversation. This lets security teams model and simulate microsegmentation policies against real traffic before enforcing them, so they can validate that legitimate flows won't be blocked. It is the foundational 'observe before enforce' phase of the workload protection lifecycle.

Answer

It automates the patching of vulnerabilities

Answer

It is used to bill users for bandwidth usage

Answer

It is used to identify the physical location of servers

Question 4

In a multi-cloud design, which protocol is preferred for secure inter-site communication to support micro-segmentation?

Accepted Answer

VXLAN with SGTs.. VXLAN with Security Group Tags (SGTs) is preferred for secure inter-site communication supporting micro-segmentation because it combines scalable Layer 2 overlay transport (VXLAN) with Cisco TrustSec's SGT-based policy enforcement. SGTs are carried in the VXLAN header (Group Policy ID field), allowing consistent security policy across sites and clouds without relying on IP-based rules.

Answer

Standard GRE.

Answer

VLAN tagging.

Answer

802.1Q.

Question 5

Which TWO of the following identify risks associated with using AI for security automation?

Accepted Answer

Adversarial machine learning / poisoning. Option C is correct because adversarial machine learning and data poisoning directly target AI models used in security automation: attackers can inject malicious or mislabeled training data or craft adversarial inputs that cause the model to misclassify threats, evade detection, or generate false alerts, undermining the automation's reliability. Option E is correct because model drift occurs when the statistical patterns in production data change over time and diverge from the training distribution, causing the model's accuracy and detection performance to degrade, which is a recognized ongoing risk for deployed AI security systems that requires monitoring and retraining. The unmarked options do not belong: faster network throughput (A) is a performance benefit, not a risk; too many security updates (B) is an operational patch-management concern unrelated to AI-specific risks; and increased hardware cost (D) is a general infrastructure expense, not a risk inherent to using AI for security automation.

Answer

Faster network throughput

Answer

Too many security updates

Answer

Increased hardware cost

Question 6

When designing a secure API environment, which THREE threat categories should be prioritized for detection by Cisco API Security? (Choose THREE)

Accepted Answer

Broken Object Level Authorization (BOLA). Cisco API Security prioritizes the OWASP API Security Top 10 threats, which include Broken Object Level Authorization (BOLA) (A), Excessive Data Exposure (B), and Broken Authentication (C). BOLA is critical because attackers manipulate object identifiers in API calls to access resources belonging to other users, making it the most prevalent API vulnerability. Excessive Data Exposure is prioritized because APIs often return full data objects and rely on the client to filter sensitive fields, leaking PII or confidential data. Broken Authentication is a core API threat since weak token handling, credential stuffing, or flawed JWT validation lets attackers impersonate legitimate users. Options D and E are incorrect because local fiber optic cable breaks and standard server hardware failures are physical infrastructure availability issues handled by redundancy and disaster recovery, not API-layer threat detection.

Answer

Local fiber optic cable breaks

Answer

Standard server hardware failures

Question 7

Which TWO of the following steps are required to integrate a security tool (like Cisco Secure Firewall) into a CI/CD pipeline?

Accepted Answer

Configure API authentication credentials. Option C is correct because integrating a security tool such as Cisco Secure Firewall into a CI/CD pipeline requires configuring API authentication credentials so the pipeline can programmatically authenticate to the firewall's REST API and push policy or configuration changes. Option E is correct because an infrastructure provisioning tool (e.g., Terraform, Ansible, or similar IaC tooling) is needed to declaratively deploy and manage the firewall configuration as part of the automated pipeline stages. Option A is not required, since integration is a software/API-level task and does not mandate replacing existing firewall hardware. Option B is wrong because hardcoding credentials in the build file is an insecure anti-pattern; secrets should be stored in a vault or secret manager. Option D is wrong because disabling all firewall rules for testing would remove the very security controls being validated and is not a legitimate integration step.

Answer

Replace the existing firewall hardware

Answer

Hardcode credentials in the pipeline build file

Answer

Disable all firewall rules for testing

Question 8

Which TWO methods are used to provide secure remote access for a mobile workforce? (Select 2)

Accepted Answer

Duo Access Gateway. Duo Access Gateway (B) is correct because it provides secure remote access by enforcing multi-factor authentication and single sign-on for users connecting to internal applications from outside the network, protecting against credential theft. AnyConnect VPN (D) is correct because it establishes an encrypted IPsec/IKEv2 or TLS tunnel between the remote device and the corporate network, ensuring confidentiality and integrity of the mobile workforce's traffic. FTP (A) is not acceptable because it transmits credentials and data in cleartext without encryption. Cleartext HTTP (C) is not acceptable because it sends web traffic unencrypted, exposing sensitive data to interception. Telnet (E) is not acceptable because it sends all session data, including passwords, in plaintext and lacks modern cryptographic protections.

Answer

FTP

Answer

Cleartext HTTP

Answer

Telnet

Question 9

Which THREE steps are required for a successful security design process?

Accepted Answer

Developing a detailed architectural plan and implementation roadmap.. Option B is correct because a security design must translate requirements and risk findings into a detailed architectural plan and an implementation roadmap that sequences controls, technologies, and milestones. Option C is correct because requirements gathering from stakeholders establishes business, regulatory, and operational needs that drive the security architecture and ensure alignment with organizational objectives. Option E is correct because performing a risk assessment of the current environment identifies assets, threats, vulnerabilities, and existing controls, providing the baseline needed to prioritize security measures. Option A is incorrect because ignoring existing network infrastructure discards critical context such as topology, legacy systems, and existing controls, which undermines any realistic design. Option D is incorrect because purchasing the most expensive hardware is not a design step and does not guarantee security; solutions should be selected based on requirements and risk, not cost alone.

Answer

Ignoring all existing network infrastructure.

Answer

Purchasing the most expensive hardware available.

Question 10

Which THREE items should be included in a 'Security Design Requirements' document?

Accepted Answer

List of all potential threat actors and their motivations.. Option B is correct because a Security Design Requirements document must identify the threat landscape it is designed to defend against, so enumerating potential threat actors (e.g., nation-state APTs, insider threats, hacktivists) and their motivations (financial gain, espionage, disruption) directly informs the selection of controls, monitoring use cases, and risk prioritization. Option C is correct because latency requirements for critical business applications are a functional constraint that security controls (such as TLS inspection, WAF, DLP, or zero-trust proxies) must respect; documenting acceptable thresholds (e.g., sub-50 ms response time) ensures security architecture does not break business performance SLAs. Option E is correct because regulatory compliance requirements such as GDPR, HIPAA, PCI DSS, or SOX define mandatory legal and contractual controls (data residency, encryption, breach notification timelines, access logging) that the security design must satisfy, making them a core input to the requirements baseline. Option A is not correct because monitor color schemes are a facilities or ergonomics preference, not a security design requirement. Option D is not correct because security team salary information is an HR and payroll matter and has no bearing on the technical or procedural design of security controls.

Answer

The preferred color scheme for the SOC monitors.

Answer

The salary information of the security team.

Question 11

Which TWO features are essential for securing the management plane of a Cisco network device?

Accepted Answer

Access Control Lists (ACLs) applied to VTY lines.. Option B is correct because applying Access Control Lists (ACLs) to VTY lines restricts which source IP addresses can establish remote management sessions (Telnet/SSH) to the device, directly protecting the management plane from unauthorized access. Option E is correct because SSH provides encrypted, authenticated remote management, replacing insecure cleartext protocols like Telnet and protecting credentials and configuration data in transit. Options A, C, and D are not essential management-plane protections: public IP addresses on management interfaces increase exposure rather than secure them, disabling all physical console ports is impractical and unnecessary for management-plane hardening (console access is typically protected by physical controls and authentication), and enabling Telnet is insecure because it transmits credentials and data in cleartext.

Answer

Using public IP addresses for management interfaces.

Answer

Disabling all physical console ports.

Answer

Enabling Telnet for remote management.

Question 12

Which TWO design considerations are critical for a secure management plane for Cisco networking devices? (Select 2)

Accepted Answer

Implementing ACLs on VTY lines. Option B is correct because implementing ACLs on VTY lines restricts which source IP addresses can establish remote management sessions to the device, blocking unauthorized hosts from attempting to reach the management plane over Telnet or SSH. Option E is correct because SSH encrypts management traffic and provides authenticated, integrity-protected sessions, whereas Telnet sends credentials and commands in cleartext, making it unsuitable for a secure management plane. The remaining options do not belong: enabling HTTP for the Web GUI (A) exposes management access without encryption, disabling the console port (C) is not a standard secure-management requirement and can hinder out-of-band recovery, and using SNMPv1 (D) is insecure because it relies on cleartext community strings and lacks strong authentication and encryption.

Answer

Enabling HTTP for the Web GUI

Answer

Disabling the console port

Answer

Using SNMPv1

Question 13

Which THREE factors influence the design of a SOC incident response plan?

Accepted Answer

Regulatory compliance requirements (e.g., GDPR).. Option A is correct because regulatory compliance requirements such as GDPR, HIPAA, or PCI DSS impose mandatory breach notification timelines, data-handling rules, and documentation duties that the incident response plan must explicitly address. Option D is correct because the technical capabilities of the security product stack — for example, whether the SOC has EDR, SIEM correlation, SOAR playbook automation, or network forensics — directly determine which detection, containment, and eradication actions the plan can realistically execute. Option E is correct because the business impact of downtime for critical services drives incident severity classification, prioritization, and recovery time objectives (RTOs), ensuring response efforts protect the most vital business functions first. Option B does not belong because analysts' personal hobbies are irrelevant to professional incident response design, and Option C does not belong because office furniture pricing has no bearing on security, compliance, or business continuity considerations in a SOC plan.

Answer

The personal hobbies of the SOC analysts.

Answer

The price of the office furniture.

Question 14

A network designer needs to implement a VPN that supports both remote access and site-to-site connectivity. Which protocol is recommended for modern Cisco hardware?

Accepted Answer

IKEv2.. IKEv2 is the recommended protocol for modern Cisco hardware because it supports both remote access and site-to-site VPNs, offers improved security, reliability, and mobility (e.g., MOBIKE), and is widely supported in Cisco IOS, ASA, and Firepower platforms. It is the successor to IKEv1 and is considered best practice.

Answer

SSL VPN.

Answer

IKEv1.

Answer

PPTP.

Question 15

When designing for API security, how does Cisco API Security provide protection against 'Excessive Data Exposure' vulnerabilities?

Accepted Answer

By analyzing response schemas to detect sensitive data in API payloads. Cisco API Security analyzes API response schemas and payloads to identify when endpoints return more data than the client actually needs, which is the definition of Excessive Data Exposure (OWASP API #3). By flagging sensitive fields (PII, tokens, internal IDs) in responses, it lets designers trim payloads before attackers can harvest them.

Answer

By implementing strict rate limiting on all users

Answer

By automatically blocking all outgoing API traffic

Answer

By replacing all API keys with OAuth tokens