SDSI Practice Test 18 — 15 Questions

Question 1

Which THREE factors should be considered when designing a security approach for a hybrid work model? (Select 3)

Accepted Answer

Multi-factor authentication (MFA). Hybrid work requires protecting the identity, the endpoint, and the remote access method simultaneously.

Answer

Physical security of the home office

Answer

VLAN mapping for home routers

Question 2

Which THREE design components are required for a successful implementation of Cisco TrustSec? (Select 3)

Accepted Answer

Cisco ISE. TrustSec requires the identity source (ISE), the enforcement points (switches/APs/firewalls), and the tags themselves.

Answer

DHCP Snooping

Answer

Cisco Umbrella

Question 3

In a hybrid work design, what is the advantage of using Cisco Umbrella's roaming client?

Accepted Answer

It provides consistent security coverage off-network.. The roaming client ensures that security policies follow the device wherever it goes, regardless of the network connection.

Answer

It replaces the need for a local firewall.

Answer

It only works on internal corporate Wi-Fi.

Answer

It forces all traffic through a local DC.

Question 4

When designing a network segmentation strategy using Cisco TrustSec, what is an SGT tag used for?

Accepted Answer

To enforce security policy based on identity. SGTs are used as the source of truth in security group ACLs (SGACLs) to permit or deny traffic based on the tag value.

Answer

To map IP addresses to MAC addresses

Answer

To identify the VLAN ID

Answer

To configure port security

Question 5

Which TWO identity-based design considerations are critical for secure endpoint access? (Select 2)

Accepted Answer

Device posture validation. Endpoints must be verified via posture (is it safe?) and identity (is the user allowed?) to grant access.

Answer

Port security configuration

Answer

Disabling DHCP

Answer

Physical cabling security

Question 6

When configuring a Cisco ASA/Firepower firewall, what is the 'inside' interface typically used for?

Accepted Answer

To connect to the trusted internal network.. The 'inside' interface is the trusted gateway for the internal network, typically having the highest security level (100).

Answer

To connect to the untrusted internet.

Answer

To connect to the DMZ.

Answer

To connect to the management network.

Question 7

Which THREE technologies are used in Cisco's architecture for micro-segmentation?

Accepted Answer

Cisco ISE as the policy engine.. Micro-segmentation requires tagging and distributed enforcement.

Answer

Standard unmanaged switches.

Answer

Static IP ACLs on every port.

Question 8

A security designer is choosing a firewall architecture for a high-throughput data center core. Which Cisco Firewall platform is purpose-built for this requirement?

Accepted Answer

Cisco Firepower 4100/9300 Series. The Cisco Firepower 9300 or 4100 series is designed for data center environments requiring high throughput and low latency.

Answer

Cisco Meraki MX

Answer

Cisco Firepower 1010

Answer

Cisco ASA 5506-X

Question 9

Which TWO methods are used to provide secure remote access for a mobile workforce? (Select 2)

Accepted Answer

Duo Access Gateway. Remote access is best handled by encrypted VPN tunnels (AnyConnect) or identity-centric access proxies (Duo Access Gateway).

Answer

FTP

Answer

Cleartext HTTP

Answer

Telnet

Question 10

Which TWO factors are critical for selecting a firewall architecture?

Accepted Answer

Integration with current management ecosystem (e.g., FMC).. Architecture selection is driven by throughput requirements and the need for advanced security features.

Answer

Using only legacy IPsec gateways.

Answer

Availability of local coffee in the DC.

Answer

The color of the firewall chassis.

Question 11

Which component of the Cisco Secure architecture is used to provide centralized visibility and threat analysis across the entire network based on NetFlow data?

Accepted Answer

Cisco Secure Network Analytics. Cisco Secure Network Analytics (formerly Stealthwatch) uses NetFlow to provide network-wide visibility and behavioral threat detection.

Answer

Cisco ISE

Answer

Cisco Secure Endpoint

Answer

Cisco Firepower Management Center

Question 12

You are designing the control plane security for a Cisco switch. Which feature limits the amount of traffic sent to the CPU, protecting it from DoS attacks?

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) is the feature used to rate-limit traffic destined for the device CPU.

Answer

Port Security

Answer

Storm Control

Answer

DHCP Snooping

Question 13

Which TWO design considerations are critical for a secure management plane for Cisco networking devices? (Select 2)

Accepted Answer

Implementing ACLs on VTY lines. Management plane security requires limiting access to the device and ensuring the protocols used are encrypted.

Answer

Enabling HTTP for the Web GUI

Answer

Disabling the console port

Answer

Using SNMPv1

Question 14

When designing a VPN for a multi-tenant cloud environment, which technology allows for the separation of routing tables to ensure traffic isolation between tenants?

Accepted Answer

VRF-Lite. VRF-Lite (Virtual Routing and Forwarding) allows multiple instances of a routing table to coexist on the same router, providing tenant isolation.

Answer

VLAN tagging

Answer

Access Control Lists

Answer

IPsec Tunnels

Question 15

Which Cisco technology is used to ensure that only authorized users can connect to the network via guest portals?

Accepted Answer

Cisco ISE Guest Services. Cisco ISE Guest Services provides captive portal functionality for self-service guest access.

Answer

Cisco Umbrella

Answer

Cisco Firepower

Answer

Cisco Secure Endpoint