SDSI Practice Test 2 — 10 Questions

Question 1

When designing a multi-cloud CI/CD security architecture, how should secrets (API keys for Cisco FMC) be managed to ensure compliance?

Accepted Answer

Use a dedicated Secret Management service. Secrets must be stored in a dedicated vault (like HashiCorp Vault or AWS Secrets Manager) and never in code repositories.

Answer

Embed as environment variables in the build runner

Answer

Encrypt with base64 and store in Git

Answer

Hardcode in the Terraform provider block

Question 2

When utilizing Cisco DevNet tools for security, which Python library is the standard for interacting with the Cisco FMC API efficiently?

Accepted Answer

fmcapi. The 'fmcapi' library (a community-supported wrapper) is the industry standard for interacting with FMC in Python scripts.

Answer

requests_cisco

Answer

cisco_py

Answer

fmc_sdk

Question 3

Which Cisco solution is primarily designed to provide visibility and protection for SaaS applications like Office 365, Salesforce, and Slack?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is a cloud-native CASB designed to secure SaaS environments.

Answer

Cisco Secure Workload

Answer

Cisco Secure Firewall

Answer

Cisco Umbrella

Question 4

Which TWO of the following steps are required to integrate a security tool (like Cisco Secure Firewall) into a CI/CD pipeline?

Accepted Answer

Configure API authentication credentials. You need an authentication mechanism (API keys) and a deployment tool (Terraform/Ansible) to manage the infrastructure.

Answer

Replace the existing firewall hardware

Answer

Hardcode credentials in the pipeline build file

Answer

Disable all firewall rules for testing

Question 5

Which TWO of the following are true about 'Policy as Code' in Cisco security infrastructure?

Accepted Answer

Policies are stored in version control systems. It promotes version control and allows for automated testing of policies.

Answer

Policies are always written in assembly language

Answer

Policies are automatically applied without review

Answer

Policies are only for cloud-native apps

Question 6

Which Cisco security solution utilizes AI-based 'Cognitive Intelligence' to detect threats in encrypted traffic without decrypting the payload?

Accepted Answer

Cisco Secure Cloud Analytics. Cisco Secure Cloud Analytics (Stealthwatch) uses Cognitive Intelligence to analyze metadata and flow patterns in encrypted traffic.

Answer

Cisco Secure Firewall

Answer

Cisco Umbrella

Answer

Cisco Secure Email

Question 7

When designing an automated remediation workflow for Cisco Secure Firewall, what is the specific function of the 'Cisco Secure Firewall REST API' in the context of threat intelligence feeds?

Accepted Answer

Dynamic update of Network Objects. The API allows for dynamic injection of IP or Domain lists into 'Network Objects' which are used in policy rules.

Answer

Encryption key rotation

Answer

Automated firmware flashing

Answer

Traffic scrubbing

Question 8

You are implementing automated policy enforcement for Cisco Secure Access by Duo. Which API allows you to programmatically manage users and authentication settings?

Accepted Answer

Duo Admin API. The Duo Admin API is the standard for managing users, policies, and authentication programmatically.

Answer

Duo Web SDK

Answer

Duo Auth API

Answer

Duo Telemetry API

Question 9

You are designing an automated pipeline for Cisco Secure Firewall. If a deployment fails, which mechanism ensures the configuration is reverted to the last known good state?

Accepted Answer

Terraform state rollback. Using Terraform 'state' management or Ansible 'check mode' allows for rollback or verification before committing changes, preventing broken states.

Answer

Manual CLI restore

Answer

FMC Factory Reset

Answer

Automated snapshot deletion

Question 10

Which TWO of the following capabilities does Cisco Secure Firewall (FMC) provide to support automated security workflows?

Accepted Answer

Integration with external Threat Intel feeds. The FMC REST API and the ability to integrate with external threat intelligence feeds are critical for automation.

Answer

Native container orchestration

Answer

Automated code refactoring

Answer

On-board AI training engine