SDSI Practice Test 16 — 15 Questions

Question 1

In a Cisco Container Platform (CCP) environment, you need to ensure that pod-to-pod traffic within the same namespace is inspected for malicious patterns. Which design decision satisfies this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a service mesh to implement mutual TLS and traffic monitoring. Deploying a service mesh provides sidecar proxies that can inspect pod-to-pod traffic within a namespace, enforce mutual TLS, and surface L7 telemetry for anomaly detection. This gives the required visibility and inspection of east-west traffic without relying on perimeter controls.

Answer

Use Kubernetes Network Policies to drop traffic

Answer

Implement a Cisco Firepower NGIPS at the perimeter

Answer

Redirect all inter-pod traffic to an external load balancer

Question 2

A security architect is designing a risk mitigation strategy for a multinational enterprise that uses Cisco Secure Firewall, Cisco ISE, and Cisco Secure Endpoint. The business requires that the design must detect and block advanced threats that evade traditional signature-based defenses, and must also provide detailed forensics for post-incident analysis. Which two Cisco design components should be included to meet these requirements? (Choose two.)

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch) for network traffic analysis and anomaly detection. To detect and block advanced threats that evade signature-based defenses and provide detailed forensics, the design must include network traffic analysis and endpoint detection and response. Cisco Secure Network Analytics delivers network-wide anomaly detection and forensic flow data, while Cisco Secure Endpoint with Exploit Prevention and SecureX integration blocks endpoint threats and enriches forensics. Together they cover network and endpoint vectors, meeting both requirements.

Answer

Cisco Identity Services Engine (ISE) with posture assessment and profiling

Answer

Cisco Secure Firewall with Snort 3 IPS and file policy for malware detection

Answer

Cisco Umbrella with DNS-layer security and intelligent proxy

Question 3

When designing an endpoint security strategy, which Cisco tool provides visibility into fileless malware by monitoring system process behavior?

Accepted Answer

Cisco Secure Endpoint. Cisco Secure Endpoint (formerly AMP for Endpoints) uses behavioral analysis and process monitoring to detect fileless malware, which executes in memory and leaves no file on disk. Its endpoint agent observes process lineage, script execution, and memory activity, making it the correct tool for this visibility requirement.

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch

Answer

Cisco Duo

Question 4

When designing for high availability, what is the role of the 'Heartbeat' mechanism in a Cisco firewall pair?

Accepted Answer

To detect the failure of the peer unit.. The heartbeat mechanism in a Cisco firewall HA pair sends periodic hello messages between peer units so each can detect whether the other is still alive. If heartbeats stop arriving within the hold time, the standby unit assumes the active unit has failed and takes over. It is purely a health/failure-detection mechanism, not a configuration sync or load-balancing function.

Answer

To authenticate users.

Answer

To sync firewall configurations.

Answer

To balance traffic load.

Question 5

A security architect is designing a solution to block malicious URLs across all branch offices. Which Cisco feature provides the most efficient, scalable way to manage this across 500+ locations?

Accepted Answer

Cisco Umbrella cloud-delivered DNS filtering.. Cisco Umbrella provides cloud-delivered DNS-layer security, so a single policy change in the Umbrella dashboard instantly applies to all 500+ branch offices without touching each site's firewall. DNS filtering blocks malicious domains before a connection is even established, making it both efficient and scalable for distributed environments.

Answer

Cisco Stealthwatch.

Answer

Cisco Identity Services Engine (ISE).

Answer

Local URL filtering on each branch firewall.

Question 6

A security architect is designing a SIEM integration for a distributed enterprise. Which tool selection criteria best aligns with the requirement to support real-time correlation across disparate cloud and on-premises environments?

Accepted Answer

Prioritize tools that support native Common Event Format (CEF) ingestion and bidirectional API integrations.. Native Common Event Format (CEF) ingestion and bidirectional API integrations are the criteria that best support real-time correlation across disparate cloud and on-premises sources. CEF is a standardized log format that normalizes events from heterogeneous vendors, and bidirectional APIs allow the SIEM to both ingest telemetry and push response actions back to sources, which is essential for a distributed enterprise.

Answer

Choose tools that utilize a monolithic database structure to ensure data consistency.

Answer

Focus on tools that strictly utilize hardware-based packet capture for all telemetry.

Answer

Select tools based solely on the number of pre-built connectors available in the marketplace.

Question 7

Which TWO design principles should be followed when selecting a firewall architecture for a multi-cloud environment? (Select 2)

Accepted Answer

Centralized management of policies. Option B is correct because centralized management of policies is essential in a multi-cloud environment, where security teams must define, audit, and enforce consistent rules across AWS Security Groups, Azure NSGs, GCP firewall rules, and on-premises devices from a single pane of glass rather than managing each cloud console separately. Option D is correct because maintaining a consistent feature set across physical and virtual firewalls ensures that the same inspection, logging, NAT, and policy capabilities apply everywhere, so security posture does not degrade when workloads move between on-premises data centers and different cloud providers. Option A is wrong because physical firewalls cannot be inserted into most cloud segments; cloud traffic is handled by virtual or cloud-native constructs, and physical appliances are impractical for east-west traffic inside a VPC/VNet. Option C is wrong because relying exclusively on cloud-native firewalls creates provider lock-in, inconsistent policy models, and gaps for hybrid or on-premises traffic that still needs protection. Option E is wrong because deploying firewalls in a single region leaves workloads in other regions unprotected and adds unnecessary latency and failure risk, violating high-availability and defense-in-depth design goals.

Answer

Physical firewalls for all cloud segments

Answer

Using cloud-native firewalls only

Answer

Deploying firewalls in a single region

Question 8

Which security design decision is most critical when migrating an application to the cloud, specifically regarding API security?

Accepted Answer

Implementing API security and identity-based access at the application layer. Migrating to cloud shifts the trust boundary: the cloud provider secures the infrastructure, but the application owner must secure the API layer. Implementing API security and identity-based access at the application layer (D) ensures authentication, authorization, and threat detection travel with the workload regardless of which cloud or region it runs in.

Answer

Relying on the cloud provider's firewall

Answer

Maintaining a VPN tunnel to the on-premise data center

Answer

Disabling all API endpoints that are not internal

Question 9

Which Cisco technology is used to ensure that only authorized users can connect to the network via guest portals?

Accepted Answer

Cisco ISE Guest Services. Cisco ISE Guest Services provides guest portal functionality that authenticates and authorizes guest users before granting network access. It supports sponsored guest access, self-registration, and policy enforcement, ensuring only authorized users connect via the guest portal.

Answer

Cisco Umbrella

Answer

Cisco Firepower

Answer

Cisco Secure Endpoint

Question 10

Which THREE technologies enable network segmentation in a modern Cisco campus design?

Accepted Answer

VRF-Lite.. VRF-Lite (B) is correct because it creates multiple virtual routing and forwarding instances on the same physical device, each with its own separate routing table, thereby logically segmenting Layer 3 traffic on a shared campus infrastructure. Cisco TrustSec with Security Group Tags (C) is correct because it provides identity- and role-based segmentation by tagging packets with SGTs and enforcing group-based policies, independent of IP addresses or VLANs. VLANs (E) are correct because they are the foundational Layer 2 segmentation mechanism in a campus design, isolating broadcast domains and separating traffic between different user or device groups. Standard routing protocols without filters (A) do not segment traffic—they advertise reachability between networks and would actually defeat isolation. Port forwarding (D) is a NAT/port-mapping technique for exposing internal services, not a segmentation technology, so it does not belong.

Answer

Standard routing protocols without filters.

Answer

Port forwarding.

Question 11

You are designing an API security layer for a public-facing web application. Which security control is most effective against 'Broken Function Level Authorization' (BFLA) attacks?

Accepted Answer

Strict RBAC/ABAC authorization checks on every function. BFLA occurs when an API endpoint enforces authentication but fails to verify whether the authenticated user is authorized to invoke that specific function (e.g., a regular user calling an admin-only endpoint). The only control that directly addresses this is enforcing strict role- or attribute-based authorization checks on every function invocation, so that each request is validated against the caller's permissions regardless of how the endpoint is reached. Rate limiting, IP blocking, and TLS encryption do not evaluate user privilege, so they cannot stop a legitimate low-privilege user from invoking a high-privilege function.

Answer

Rate limiting

Answer

Blocking traffic from known malicious IP addresses

Answer

Encrypting all traffic with TLS 1.3

Question 12

An organization is performing a risk assessment for a new remote access design. They identify that the SOC currently lacks visibility into anomalous VPN session behavior. Which Cisco solution should the design incorporate to provide behavioral analytics for incident response tool selection?

Accepted Answer

Cisco Secure Network Analytics. Cisco Secure Network Analytics (formerly Stealthwatch) uses NetFlow and telemetry to build behavioural baselines and detect anomalies such as unusual VPN session patterns, data transfers, or connection volumes. It is purpose-built for network behavioural analytics and feeds incident response tooling with actionable detections. This directly addresses the SOC's lack of visibility into anomalous VPN behaviour.

Answer

Cisco Identity Services Engine

Answer

Cisco Umbrella

Answer

Cisco Secure Firewall Management Center

Question 13

When designing an API security strategy using Cisco API Security, how should you address APIs that are currently using legacy authentication?

Accepted Answer

Use an API gateway to terminate modern authentication and proxy to the legacy backend. The correct approach is to use an API gateway to terminate modern authentication (e.g., OAuth 2.0, OpenID Connect) and then proxy requests to the legacy backend, which may still use basic auth, API keys, or other legacy methods. This allows you to enforce strong authentication at the edge without modifying the legacy backend, which is often impractical or impossible. Cisco API Security solutions, such as those integrated with Cisco API Gateway, support this pattern by handling token validation, scopes, and policies before forwarding traffic. This decouples security from the legacy system and provides a migration path.

Answer

Force the legacy backend to support modern OAuth

Answer

Block all access to legacy APIs immediately

Answer

Ignore the legacy APIs as they are 'trusted'

Question 14

You are designing security for a multi-tier application. Why is it recommended to use a Service Mesh to manage the identity of microservices?

Accepted Answer

To provide cryptographically verifiable workload identity. A service mesh provides each microservice with a cryptographically verifiable identity, typically through mutual TLS (mTLS) certificates issued by a built-in certificate authority (CA). This identity is based on the service's attributes (e.g., Kubernetes service account) rather than its IP address, enabling strong authentication and authorization between services. This is essential for zero-trust security in dynamic environments where IPs change frequently.

Answer

To simplify the management of IP addresses

Answer

To replace the need for firewalls

Answer

To increase the network throughput

Question 15

When designing security for a cloud-native architecture, why is it better to use an identity-based model instead of a network-based model for microsegmentation?

Accepted Answer

Because identity is persistent while IP addresses are volatile. In cloud-native environments, workload IP addresses are ephemeral — containers and pods are constantly created, destroyed, and rescheduled, so IP-based policies quickly become stale and either over-permit or break legitimate traffic. Identity (service account, SPIFFE ID, labels, or workload identity) persists across IP changes and is therefore the stable anchor for microsegmentation policy. This is the foundational reason identity-based segmentation is preferred.

Answer

Because it is easier to implement IP-based rules

Answer

Because identity is always known to the network hardware

Answer

Because it doesn't require any policy configuration