SDSI Practice Test 2 — 10 Questions

Question 1

You are designing application security for a new customer-facing web application hosted on Cisco ACI with a Cisco Secure Firewall (formerly Firepower) cluster managed by Cisco Secure Firewall Management Center. The application uses a REST API that authenticates users via OAuth 2.0 bearer tokens. The security team wants to detect and block attacks that exploit business logic in the API, such as manipulating order quantities or bypassing approval steps, without breaking legitimate token-based traffic. Which design approach should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Cisco Secure Firewall's TLS decryption on the API server's traffic and apply a custom Snort 3 rule that inspects JSON payload fields for out-of-range quantity values.. Business logic attacks against APIs require visibility into the application payload, not just network metadata. TLS decryption on Cisco Secure Firewall enables inspection of the JSON body, and a custom Snort 3 rule can enforce semantic constraints such as allowed quantity ranges or approval sequences. This design targets the specific manipulation described while preserving legitimate OAuth 2.0 bearer token traffic, because the rule acts on payload fields rather than blocking encrypted sessions wholesale.

Answer

Configure Cisco Application Centric Infrastructure (ACI) microsegmentation contracts to allow only HTTP POST methods to the API endpoint, blocking all other methods.

Answer

Use Cisco Identity Services Engine (ISE) to profile API clients and assign a downloadable ACL that limits each client to a fixed number of API calls per minute.

Answer

Deploy Cisco Umbrella SIG and configure a custom block page for any API request that contains a quantity parameter greater than 100.

Question 2

A risk assessment reveals that internal servers are vulnerable to unauthorized access via SMB protocols. Which Cisco feature should be implemented on the internal switching infrastructure to mitigate this risk?

Accepted Answer

Cisco TrustSec (SGTs).. Cisco TrustSec uses Security Group Tags (SGTs) to enforce role-based access control within the switching infrastructure, allowing segmentation and policy enforcement based on identity/role rather than IP addresses. By tagging SMB traffic and applying SGACLs, unauthorized access to internal servers via SMB can be blocked at the switch level. This is the appropriate internal segmentation control for the described risk.

Answer

ACLs on the core switch.

Answer

Cisco Secure Endpoint scan.

Answer

Cisco Umbrella local policy.

Question 3

Which THREE of the following are key features of Cisco XDR (formerly SecureX) in an automated pipeline?

Accepted Answer

Workflow orchestration. Cisco XDR (formerly SecureX) is built around an automation pipeline in which Workflow orchestration (A) is a core feature, allowing security teams to design, trigger, and chain automated response actions across integrated Cisco and third-party tools. Incident management and response (B) is also central, since XDR correlates detections into incidents, enriches them, and drives response actions from a single console. Threat intelligence aggregation (C) is likewise a key capability, as XDR ingests and normalizes threat intel from multiple sources (e.g., Cisco Talos, third-party feeds) to enrich detections and inform automated workflows. Automated server patching (D) is not a Cisco XDR function; patching is handled by endpoint management or vulnerability/patch management tools, not by the XDR platform itself. Network packet capture hardware (E) is a physical appliance concern (e.g., dedicated capture devices or switches with SPAN/TAP), not a feature of the Cisco XDR software platform.

Answer

Automated server patching

Answer

Network packet capture hardware

Question 4

You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). Which specific architectural component must be deployed within the Kubernetes worker nodes to enforce policy without relying on external firewall hairpining?

Accepted Answer

Secure Workload Software Agent. The Secure Workload Software Agent must be deployed on Kubernetes worker nodes to enforce microsegmentation policy locally at the workload level. The agent intercepts traffic at the host's network stack (via iptables/eBPF or similar) and applies Tetration's policy without hairpinning traffic to an external firewall. This distributed enforcement model is the core of Cisco Secure Workload's architecture for container and VM environments.

Answer

Cisco ASA Virtual Appliance

Answer

Cisco Nexus Dashboard Orchestrator

Answer

Cisco Firepower Management Center

Question 5

A network security designer is evaluating email security solutions. Which feature in Cisco Secure Email (ESA) is most effective against sophisticated Business Email Compromise (BEC) attacks?

Accepted Answer

Advanced Phishing Protection. Advanced Phishing Protection in Cisco Secure Email (ESA) is specifically designed to detect and block sophisticated Business Email Compromise (BEC) attacks that evade traditional signature-based defenses. It uses machine learning and behavioral analysis to identify anomalous sender behavior, such as display name spoofing, lookalike domains, and compromised accounts, which are hallmarks of BEC. Unlike URL filtering or spam quarantine, it focuses on the social engineering tactics and context of the email rather than just malicious links or bulk spam characteristics.

Answer

URL Filtering

Answer

Spam Quarantine

Answer

DKIM Signing

Question 6

A security architect is developing a requirements document for a SOC. Which Cisco capability allows the SOC to prioritize alerts by correlating threats across network, endpoint, and cloud?

Accepted Answer

Cisco SecureX cross-product correlation.. Cisco SecureX is the platform that aggregates and correlates threat intelligence and events across Cisco's portfolio — network (Secure Firewall, Umbrella), endpoint (Secure Endpoint), and cloud (Umbrella, cloud security) — into a single ribbon and threat response view. Its cross-product correlation is what lets a SOC prioritize alerts by seeing that an endpoint detection, a network flow, and a cloud log all relate to the same threat. The other options are single-domain tools that lack cross-domain correlation.

Answer

Cisco Stealthwatch alert grouping.

Answer

Cisco Secure Firewall management center alert correlation.

Answer

Cisco Identity Services Engine monitoring.

Question 7

What is the primary function of Cisco pxGrid in a network design?

Accepted Answer

To exchange security context and data between Cisco and third-party products.. Cisco pxGrid is a platform that enables bidirectional, context-sharing integration between Cisco security products and third-party solutions. It publishes security context — such as identity, endpoint posture, threat detection, and session data — and allows subscribers to query or receive that data to trigger coordinated responses. Its primary function is exchanging security context and data, not enforcing traffic controls itself.

Answer

To encrypt traffic.

Answer

To filter web traffic.

Answer

To manage physical hardware.

Question 8

When designing an API security architecture, what is the primary purpose of 'API Discovery' in the context of Cisco API Security?

Accepted Answer

To inventory all API endpoints and identify shadow or undocumented APIs. API Discovery in Cisco API Security is fundamentally an inventory and visibility function: it enumerates all API endpoints actually in use across the environment and compares them against documented/registered APIs to surface shadow (undocumented) and orphaned (unused) APIs. This gives security teams the complete attack surface picture needed before they can apply any protection. It is a prerequisite for policy enforcement, not a replacement for gateways or a performance feature.

Answer

To replace the need for API gateways

Answer

To increase the API's performance

Answer

To automatically generate API documentation for developers

Question 9

Which aspect of AI-driven security automation helps in 'Reducing Mean Time to Respond (MTTR)'?

Accepted Answer

Automated data correlation. Automated data correlation aggregates and analyzes telemetry from multiple sources (endpoints, network devices, identity systems, threat intelligence feeds) to rapidly identify and prioritize security incidents. By correlating disparate events automatically, security teams can detect and respond to threats much faster, directly reducing Mean Time to Respond (MTTR). This is a core value proposition of AI-driven security automation.

Answer

Updating hardware firmware

Answer

Reducing network latency

Answer

Increasing developer training

Question 10

A security architect is configuring Cisco SecureX for the first time. Which is the most important step to enable centralized incident response?

Accepted Answer

Integrating product API credentials (e.g., Secure Endpoint, Umbrella).. Cisco SecureX aggregates data and enables automated workflows across Cisco security products by integrating their APIs. To enable centralized incident response, you must integrate product API credentials (e.g., Secure Endpoint, Umbrella, Firepower) so SecureX can pull events, correlate them, and trigger response actions. Without API integration, SecureX has no data to work with.

Answer

Setting the dashboard background color.

Answer

Manually uploading log files.

Answer

Renaming all the products in the dashboard.