SDSI Practice Test 19 — 15 Questions

Question 1

A design architect is deploying a Cisco Secure Firewall in a High Availability (HA) pair. Which configuration is required to ensure stateful failover across firewalls?

Accepted Answer

Stateful failover link. Stateful failover in a Cisco Secure Firewall HA pair requires a dedicated stateful failover link (also called the failover interface) that synchronizes connection state, translation tables, and other runtime data between the active and standby units. Without this link, failover is stateless and existing connections are dropped, breaking user sessions. The stateful failover link is the configuration element that enables seamless session continuity.

Answer

HSRP on the interfaces

Answer

Control plane sync via FMC

Answer

VSS for Firewall

Question 2

Which design principle is most important when implementing microsegmentation in an environment with high workload volatility (e.g., auto-scaling groups)?

Accepted Answer

Use label-based dynamic security policies. In environments with high workload volatility, such as auto-scaling groups, IP addresses change frequently, making IP-based policies impractical. Label-based dynamic security policies allow microsegmentation rules to follow workloads as they scale, because labels are applied to pods or instances and policies reference those labels rather than ephemeral IPs. This ensures consistent security enforcement regardless of scaling events.

Answer

Manually update firewall rules when scaling

Answer

Disable scaling to maintain network stability

Answer

Use IP-based static access control lists

Question 3

Why is it important to include 'Application Context' when defining microsegmentation policies in Cisco Secure Workload?

Accepted Answer

To align security policies with business and application logic. Application Context lets microsegmentation policies be expressed in terms of application tiers, roles, and business logic (e.g., 'web tier to app tier') rather than raw IPs and ports. This aligns security with how the business actually operates, makes policies meaningful and maintainable, and ensures enforcement follows the application even as IPs change. It is about semantic alignment, not performance or readability alone.

Answer

To bypass the need for firewall rules

Answer

To make the policy easier to read for network admins

Answer

To reduce the amount of memory consumed by the agent

Question 4

When designing a post-incident security architecture, which THREE factors are critical for determining the placement of Cisco Secure Firewall sensors?

Accepted Answer

Physical segmentation of the network (VLANs/VRFs).. Option C is correct because the physical and logical segmentation of the network (VLANs and VRFs) dictates where a sensor can be inserted and which traffic flows it can observe, since a firewall sensor must sit at a boundary between segments to inspect inter-segment traffic. Option D is correct because placing a sensor requires either a SPAN/mirror port on a switch or a network TAP to copy traffic for inspection; without such a monitoring point, the sensor cannot passively receive the packets it needs to analyze. Option E is correct because the firewall hardware's traffic throughput capacity must match or exceed the volume of traffic at the proposed placement, otherwise the sensor will drop packets or become a bottleneck, undermining both security and availability. Option A does not belong because the count of Wi-Fi users is a rough scale indicator, not a determinant of sensor placement, which depends on traffic paths and segmentation rather than user population. Option B does not belong because server room temperature is a facilities/environmental concern and has no bearing on where a network security sensor is logically or physically positioned.

Answer

The number of users connected to the local office Wi-Fi.

Answer

Local temperature of the server room.

Question 5

When configuring a Cisco ASA/Firepower firewall, what is the 'inside' interface typically used for?

Accepted Answer

To connect to the trusted internal network.. On a Cisco ASA/Firepower firewall, the 'inside' interface is the trusted network, typically the internal LAN where protected resources reside. It has a higher security level (default 100) than the 'outside' interface (default 0), allowing traffic to flow from inside to outside by default. This is the standard configuration for perimeter firewalls.

Answer

To connect to the untrusted internet.

Answer

To connect to the DMZ.

Answer

To connect to the management network.

Question 6

When designing a secure multi-cloud strategy for applications, how does Cisco Secure Workload facilitate consistent policy management?

Accepted Answer

By providing a centralized policy plane that integrates with native cloud security controls. Cisco Secure Workload provides a centralized policy plane that integrates with native cloud security controls (e.g., AWS Security Groups, Azure NSGs, GCP firewall rules) to enforce consistent micro-segmentation policies across multi-cloud environments. This allows a single policy definition to be translated and applied natively in each cloud, avoiding vendor lock-in and manual per-cloud configuration. The centralized plane maintains visibility and enforcement consistency regardless of where workloads run.

Answer

By forcing all traffic to transit a VPN tunnel

Answer

By moving all traffic through a centralized Cisco hardware firewall

Answer

By manually creating ACLs in each cloud provider console

Question 7

You are designing an IoT network segment. Which technology allows you to verify device identity at the hardware level?

Accepted Answer

802.1X with EAP-TLS.. 802.1X with EAP-TLS is correct because it performs mutual certificate-based authentication at the network access layer, where the supplicant's identity is proven using a digital certificate stored in a hardware-protected module (TPM or secure element). This binds the device identity to cryptographic keys that cannot be easily spoofed, unlike MAC or IP addresses. The hardware-level verification comes from the certificate's private key being protected by the device's hardware root of trust, making it resistant to cloning.

Answer

MAC Authentication Bypass (MAB).

Answer

SNMPv3.

Answer

Static IP filtering.

Question 8

In a Cisco SD-WAN environment, you need to ensure that branch office traffic destined for SaaS applications is optimized and secured. Which design approach is most appropriate?

Accepted Answer

Implementing Cisco Umbrella SIG integration on the SD-WAN edge devices for DIA.. In a Cisco SD-WAN environment, optimizing and securing branch traffic to SaaS applications is best achieved by integrating Cisco Umbrella SIG (Secure Internet Gateway) on the SD-WAN edge devices and using Direct Internet Access (DIA). This approach allows branch traffic to break out locally to the internet, where Umbrella enforces security policies (e.g., DNS-layer security, URL filtering, CASB) without backhauling to the corporate headend. This reduces latency and improves performance for SaaS apps while maintaining security. The other options either bypass security, add unnecessary hardware, or reintroduce backhauling.

Answer

Using static routing to bypass all security policies for trusted SaaS domains.

Answer

Deploying a dedicated physical firewall at every branch office.

Answer

Hair-pinning all SaaS traffic back to the corporate headend for inspection.

Question 9

In a DevSecOps environment, you need to implement Cisco Secure Firewall Management Center (FMC) rule updates via Ansible. Which approach ensures the highest level of security and idempotency?

Accepted Answer

Utilizing the cisco.fmc Ansible collection. The cisco.fmc Ansible collection is purpose-built to manage Cisco Secure Firewall Management Center through its REST API, exposing declarative modules that are natively idempotent and support secure credential handling via Ansible Vault. It abstracts raw API calls into state-based tasks, so repeated playbook runs converge on the desired rule set without duplicating or corrupting policy objects. This delivers both the security (encrypted secrets, authenticated API sessions) and idempotency required in a DevSecOps pipeline.

Answer

Manually updating via FMC UI then exporting JSON

Answer

Pushing configuration snapshots via SCP

Answer

Executing raw REST API calls via shell scripts

Question 10

Which risk assessment methodology component focuses on identifying the 'crown jewels' of the organization's network architecture?

Accepted Answer

Asset Identification. Asset Identification is the component of risk assessment that focuses on discovering and cataloging all assets, especially the 'crown jewels'—the most critical and valuable data, systems, and applications. This step is foundational because you cannot protect what you haven't identified, and risk cannot be accurately assessed without knowing which assets are most business-critical. By identifying crown jewels first, organizations can prioritize subsequent risk analysis and controls where they matter most.

Answer

Control Implementation

Answer

Vulnerability Scanning

Answer

Threat Vector Analysis

Question 11

When designing security for a multi-tenant cloud application, which principle is most effectively addressed by using Cisco Secure Workload to create distinct security domains?

Accepted Answer

Logical Tenant Isolation. Cisco Secure Workload (formerly Tetration) creates distinct security domains that enforce microsegmentation and policy boundaries between tenants, which directly implements logical tenant isolation in a multi-tenant cloud application. By defining separate security domains per tenant, the platform ensures that workloads from one tenant cannot communicate with another unless explicitly allowed, satisfying the isolation principle. This is the principle most effectively addressed by that design approach.

Answer

User Identity Provisioning

Answer

Data Backup and Recovery

Answer

null

Answer

Hardware Redundancy

Question 12

During a design review, it is determined that the current logging architecture is missing context for user identity. Which Cisco tool must be integrated with the firewall to map IP addresses to specific usernames in the logs?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco Identity Services Engine (ISE) is the identity and policy platform that integrates with firewalls (via pxGrid or the ISE Identity Source) to map IP addresses to usernames, providing user-identity context in firewall logs. ISE maintains the active session directory of user-to-IP mappings from 802.1X, MAB, VPN, and passive authentication, which the firewall queries to enrich logs.

Answer

Cisco Defense Orchestrator.

Answer

Cisco Umbrella.

Answer

Cisco SecureX.

Question 13

Which TWO of the following are benefits of using 'Infrastructure as Code' (IaC) with Cisco Secure Firewall?

Accepted Answer

Improved auditability of changes. Option B (Improved auditability of changes) is correct because IaC stores firewall configuration as version-controlled declarative files (e.g., Terraform HCL or Ansible playbooks in Git), so every change is tracked with commit history, diffs, and author metadata, providing a clear audit trail. Option C (Configuration consistency across environments) is correct because the same IaC templates are applied repeatedly to dev, test, and production, eliminating manual CLI drift and ensuring identical policy, NAT, and interface settings across deployments. Option A is incorrect because IaC addresses configuration management, not traffic forwarding or bandwidth optimization. Option D is incorrect because firewall policies are still required; IaC only automates how those policies are defined and deployed. Option E is incorrect because IaC provisions and configures software, but it cannot physically repair failed hardware.

Answer

Reduction of network bandwidth usage

Answer

Elimination of the need for firewall policies

Answer

Automatic hardware repair

Question 14

Which THREE components are critical for an effective post-incident 'Architecture Adaptation'?

Accepted Answer

Updating security policies to address the identified gap.. Option B is correct because architecture adaptation requires updating security policies to close the specific gap that enabled the incident, ensuring governance and controls reflect the lessons learned. Option C is correct because hardening configurations on impacted network devices directly remediates the exploitable weaknesses and prevents recurrence at the architectural/device level. Option E is correct because the Root Cause Analysis (RCA) report identifies the underlying failure and provides the evidence-based foundation for adapting the architecture. Option A is not a structural or architectural change; adding helpdesk staff addresses operational capacity, not the root cause or design gap. Option D is not a remediation or adaptation measure; mass account renaming does not fix the vulnerability and can disrupt identity management without improving security posture.

Answer

Increasing the number of helpdesk staff.

Answer

Renaming all user accounts in the domain.

Question 15

Which component of the Cisco Secure architecture is used to provide centralized visibility and threat analysis across the entire network based on NetFlow data?

Accepted Answer

Cisco Secure Network Analytics. Cisco Secure Network Analytics (formerly Stealthwatch) is the component of the Cisco Secure architecture that provides centralized visibility and threat analysis using NetFlow data. It collects flow telemetry from network devices, applies behavioral analytics and machine learning to detect anomalies, and presents a centralized dashboard for threat hunting and incident response.

Answer

Cisco ISE

Answer

Cisco Secure Endpoint

Answer

Cisco Firepower Management Center