SDSI Practice Test 19 — 15 Questions

Question 1

Which THREE components are part of the Cisco Secure Firewall architecture? (Select 3)

Accepted Answer

Firepower Appliance. The architecture comprises the FMC (management), FTD (data plane), and the Firepower 4100/9300 or virtual appliances.

Answer

Cisco ISE

Answer

Cisco Stealthwatch

Question 2

When designing a site-to-site VPN, which IKEv2 feature allows the tunnel to be established without requiring a static IP address on one side?

Accepted Answer

IKEv2 ID-based authentication. IKEv2 allows for identity-based authentication using certificates or pre-shared keys that do not depend on the peer's IP address.

Answer

IKEv2 Virtual Tunnel Interfaces

Answer

AnyConnect Mobility

Answer

Dead Peer Detection

Question 3

Which THREE features of Cisco Secure Email help in mitigating email-based threats? (Select 3)

Accepted Answer

Cisco Threat Grid sandboxing. Cisco Secure Email uses reputation, spam filtering, and sandboxing (Threat Grid) to stop threats.

Answer

DHCP snooping

Answer

VLAN isolation

Question 4

Which Cisco solution provides host-based visibility and protection against fileless malware?

Accepted Answer

Cisco Secure Endpoint.. Cisco Secure Endpoint (formerly AMP for Endpoints) uses behavioral analysis to detect fileless malware.

Answer

Cisco ISE.

Answer

Cisco Secure Firewall.

Answer

Cisco Prime Infrastructure.

Question 5

Which TWO design considerations are essential when implementing a Zero Trust architecture for IoT devices in a campus environment using Cisco ISE and TrustSec?

Accepted Answer

Utilizing Cisco ISE to profile and categorize IoT endpoints.. Profiling and segmentation are the core components of IoT Zero Trust.

Answer

Using static IP addresses for every IoT device to ensure consistency.

Answer

Ensuring all IoT devices are placed in the same VLAN for easier management.

Answer

Disabling 802.1X for all non-PC devices.

Question 6

A security architect is designing a Cisco Secure Firewall deployment for a multi-cloud environment. Which design approach provides the most consistent security policy enforcement across AWS and Azure?

Accepted Answer

Utilize Cisco Defense Orchestrator for centralized policy management.. Cisco Defense Orchestrator (CDO) provides a unified management plane to maintain consistent policies across different cloud infrastructures.

Answer

Deploy individual local managers for each cloud provider.

Answer

Rely on native cloud-native security groups only.

Answer

Implement separate FTD instances with unique local access control lists.

Question 7

Which TWO methods are effective for securing email infrastructure against phishing?

Accepted Answer

DMARC/SPF/DKIM implementation.. Email security requires both gateway-based protection and user authentication protocols.

Answer

Using only local SMTP relays.

Answer

Disabling all attachments in emails.

Answer

Allowing all inbound mail traffic.

Question 8

Which feature enables Cisco switches to limit the amount of broadcast traffic received on a port?

Accepted Answer

Storm Control.. Storm Control prevents single ports from overwhelming the switch CPU or the network with excessive broadcast/multicast traffic.

Answer

Port Security.

Answer

Rate Limiting (QoS).

Answer

Broadcast suppression.

Question 9

Which THREE services does Cisco Umbrella provide to secure remote workers? (Select 3)

Accepted Answer

Cloud Access Security Broker (CASB). Umbrella provides DNS-layer security, SWG (web proxy), and CASB functionality.

Answer

Host-based Antivirus

Answer

Local network DHCP service

Question 10

When designing a VPN solution for a hybrid workforce, which protocol provides the most robust support for DTLS to minimize latency for real-time traffic?

Accepted Answer

Cisco Secure Client with DTLS enabled.. AnyConnect (Cisco Secure Client) utilizes DTLS to prioritize latency-sensitive traffic over the standard TLS tunnel.

Answer

SSL VPN Clientless portal.

Answer

L2TP/IPsec.

Answer

IPsec IKEv1.

Question 11

Which TWO factors must be considered when designing a Secure Remote Access VPN architecture for a hybrid workforce using Cisco AnyConnect?

Accepted Answer

Integration with Duo Security for multi-factor authentication.. The number of concurrent sessions and the integration with MFA are critical for scaling and security.

Answer

Physical port density on the headend device.

Answer

The use of DTLS for latency-sensitive traffic.

Answer

Configuring internal DNS servers for split-tunneling.

Question 12

To protect a SaaS application accessed by remote users, which Cisco solution provides a unified cloud-native security stack including DNS-layer security and SWG?

Accepted Answer

Cisco Umbrella. Cisco Umbrella provides the cloud-native security stack including DNS security, SWG, and CASB functions.

Answer

Cisco Duo

Answer

Cisco Firepower Threat Defense

Answer

Cisco Secure Endpoint

Question 13

Which design component is necessary for implementing Cisco TrustSec across a multi-switch campus?

Accepted Answer

SXP (SGT Exchange Protocol).. SXP (SGT Exchange Protocol) is required to propagate SGT (Scalable Group Tag) information to switches that do not natively support hardware-based tagging.

Answer

VLAN Trunking Protocol (VTP).

Answer

LLDP.

Answer

802.1Q.

Question 14

Which TWO strategies are recommended for securing a cloud-native SaaS environment?

Accepted Answer

Duo MFA integration.. SaaS security focuses on identity and data protection.

Answer

Opening all firewall ports.

Answer

Storing passwords in clear text.

Answer

Disabling all logging.

Question 15

A design architect is deploying a Cisco Secure Firewall in a High Availability (HA) pair. Which configuration is required to ensure stateful failover across firewalls?

Accepted Answer

Stateful failover link. A dedicated state link (failover link) is required to synchronize connection tables and state information between the active and standby units.

Answer

HSRP on the interfaces

Answer

Control plane sync via FMC

Answer

VSS for Firewall