SDSI Practice Test 15 — 15 Questions

Question 1

When designing for high availability, what is the role of the 'Heartbeat' mechanism in a Cisco firewall pair?

Accepted Answer

To detect the failure of the peer unit.. The heartbeat signal allows the active unit to monitor the status of the standby unit.

Answer

To authenticate users.

Answer

To sync firewall configurations.

Answer

To balance traffic load.

Question 2

Which THREE criteria are used during the 'Requirements Gathering' phase of a secure architecture design?

Accepted Answer

Existing network topology and traffic flow patterns.. Design must be based on business goals, performance needs, and existing architecture.

Answer

The personal email addresses of the network staff.

Answer

The color of the hardware rack units.

Question 3

When designing a SOC, the team identifies a need for centralized management of threat intelligence feeds. Which Cisco product is the primary repository for this function?

Accepted Answer

Cisco Secure Firewall Management Center. Cisco Talos Intelligence is the primary source, but Cisco Secure Firewall (FMC) or SecureX acts as the repository for consuming these feeds in a design.

Answer

Cisco Adaptive Security Appliance

Answer

Cisco AnyConnect

Answer

Cisco Defense Orchestrator

Question 4

In a Cisco Secure Firewall architecture, what is the purpose of the 'Intrusion Policy'?

Accepted Answer

To identify and block malicious traffic based on pattern matching.. The Intrusion Policy inspects traffic for exploits, vulnerabilities, and malware patterns based on Snort rules.

Answer

To optimize routing paths.

Answer

To handle VPN authentication.

Answer

To manage firewall NAT rules.

Question 5

A risk assessment reveals that internal servers are vulnerable to unauthorized access via SMB protocols. Which Cisco feature should be implemented on the internal switching infrastructure to mitigate this risk?

Accepted Answer

Cisco TrustSec (SGTs).. Cisco TrustSec/SGTs allow for segmentation that blocks lateral movement between servers, regardless of VLAN.

Answer

ACLs on the core switch.

Answer

Cisco Secure Endpoint scan.

Answer

Cisco Umbrella local policy.

Question 6

A security designer is choosing a tool for DNS-layer security. Which Cisco product is the standard choice?

Accepted Answer

Cisco Umbrella.. Cisco Umbrella is the industry leader for DNS-layer security.

Answer

Cisco Secure Endpoint.

Answer

Cisco ISE.

Answer

Cisco Secure Firewall.

Question 7

An organization wants to monitor all internal traffic for anomalies. Which Cisco tool is used for behavioral analysis of network flows?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch).. Cisco Secure Network Analytics (Stealthwatch) is specifically for flow-based behavioral analysis.

Answer

Cisco ISE.

Answer

Cisco Umbrella.

Answer

Cisco Firepower IPS.

Question 8

Which Cisco solution provides DNS-layer security to prevent users from connecting to malicious domains?

Accepted Answer

Cisco Umbrella.. Cisco Umbrella uses DNS filtering to block requests to known malicious domains at the resolution layer.

Answer

Cisco Stealthwatch.

Answer

Cisco ASA Firewall.

Answer

Cisco Secure Endpoint.

Question 9

Which THREE components are critical for an effective post-incident 'Architecture Adaptation'?

Accepted Answer

Updating security policies to address the identified gap.. Post-incident adaptation requires analyzing the root cause, updating policies, and hardening the infrastructure.

Answer

Increasing the number of helpdesk staff.

Answer

Renaming all user accounts in the domain.

Question 10

A design architect is updating an incident response strategy. What is the role of the 'Post-Incident Architecture Adaptation' phase?

Accepted Answer

To identify and implement changes to prevent recurrence of the incident.. This phase ensures that identified gaps are closed and the infrastructure is hardened.

Answer

To document the costs of the incident.

Answer

To discipline employees who caused the incident.

Answer

To update the network documentation for the next audit.

Question 11

An organization is modifying their architecture to meet new compliance requirements for logging. The design requires offloading logs from multiple Cisco Firepower sensors. What is the recommended destination for long-term audit storage?

Accepted Answer

Security Information and Event Management (SIEM). Cisco Secure Event Logs (via Syslog/eStreamer) are typically sent to a SIEM or Cisco Secure Cloud Analytics for long-term storage and compliance auditing.

Answer

Cisco ISE Node

Answer

Cisco Catalyst Center

Answer

Local flash memory on the sensor

Question 12

A SOC manager requests a design that simplifies the incident investigation process. Which TWO Cisco tools should the design include for improved correlation of network traffic and endpoint events? (Choose two)

Accepted Answer

Cisco Secure Network Analytics. Secure Network Analytics (NetFlow) and Secure Endpoint (Process/File data) are the core tools for correlating network and host activities.

Answer

Cisco DNA Spaces

Answer

Cisco Smart Licensing

Answer

Cisco Nexus Dashboard

Question 13

Which TWO methods provide identification for IoT devices in an enterprise network?

Accepted Answer

802.1X (EAP-TLS).. IoT devices require various methods to be identified, ranging from profiling to certificate-based methods.

Answer

Ignoring the device type.

Answer

Using public Wi-Fi access.

Answer

MAC address spoofing.

Question 14

Which Cisco technology allows an organization to enforce security policies based on the user's location and device posture, even when the user is off-network?

Accepted Answer

Cisco Duo. Cisco Duo with its 'Trusted Endpoints' and 'Adaptive Authentication' policies evaluates device posture and location regardless of network connection.

Answer

Cisco AnyConnect

Answer

Cisco ASA

Answer

Cisco ISE

Question 15

Which Cisco product is used to manage the configuration and security policy of multiple Firepower firewalls from a single console?

Accepted Answer

Cisco Firepower Management Center (FMC).. Cisco Firepower Management Center (FMC) is the centralized management tool for Cisco Secure Firewalls.

Answer

Cisco Defense Orchestrator (CDO).

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco SecureX.