SDSI Practice Test 20 — 15 Questions

Question 1

You are designing a security architecture for a hybrid cloud environment using Cisco Secure Firewall. Which design pattern effectively mitigates the risk of lateral movement between VPCs in AWS while maintaining centralized policy enforcement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Utilizing a Transit Gateway with a centralized inspection VPC and VPC attachments.. Using a Transit Gateway with a centralized inspection VPC forces traffic through a firewall cluster, enabling consistent policy enforcement.

Answer

Relying solely on AWS Security Groups for inter-VPC traffic.

Answer

Implementing an Overlay Network using Cisco ACI Remote Leaf.

Answer

Deploying individual firewall appliances in each VPC.

Question 2

Which protocol is used for the control plane communication between Cisco SD-WAN controllers?

Accepted Answer

OMP.. OMP (Overlay Management Protocol) is used for routing, policy, and service information exchange between SD-WAN components.

Answer

EIGRP.

Answer

BGP.

Answer

OSPF.

Question 3

For a zero-trust architecture, what is the primary function of Cisco ISE?

Accepted Answer

Acting as a Policy Decision Point (PDP) for access control.. ISE acts as the Policy Decision Point (PDP) in a zero-trust architecture, validating identity and context before granting access.

Answer

Managing user passwords.

Answer

Packet filtering at the edge.

Answer

Automating WAN path selection.

Question 4

For a high-availability firewall architecture, which design element is critical when utilizing a routed-mode configuration in a data center?

Accepted Answer

Utilizing a dedicated stateful failover link between firewalls.. Stateful failover ensures that session information is synchronized, preventing connection drops during a device swap.

Answer

Configuring HSRP between firewall interfaces.

Answer

Implementing OSPF equal-cost multi-path (ECMP) for load balancing.

Answer

Using a virtual MAC address per interface.

Question 5

When selecting a security approach for email threats, which Cisco technology provides automated sandboxing to protect against zero-day phishing?

Accepted Answer

Cisco Secure Malware Analytics.. Cisco Secure Email (formerly ESA) integrates with Secure Malware Analytics (formerly Threat Grid) for sandboxing.

Answer

Cisco Duo MFA.

Answer

Cisco Umbrella DNS layer security.

Answer

Cisco Secure Endpoint protection.

Question 6

When designing a secure remote access solution for a hybrid workforce, which Cisco AnyConnect feature should be prioritized to reduce the attack surface by verifying the posture of the device before granting access?

Accepted Answer

AnyConnect Posture Module.. HostScan or the AnyConnect Posture module allows for pre-connection assessment.

Answer

IKEv2 protocol support.

Answer

Split-tunneling.

Answer

Dynamic Access Policies (DAP).

Question 7

What is the primary function of the 'AnyConnect' (Secure Client) profile?

Accepted Answer

To manage connection and security settings for the endpoint.. The profile defines the connection settings, server lists, and security policies for the client software.

Answer

To act as an identity provider.

Answer

To store user credentials.

Answer

To monitor CPU usage on the host.

Question 8

When designing an endpoint security strategy, which Cisco tool provides visibility into fileless malware by monitoring system process behavior?

Accepted Answer

Cisco Secure Endpoint. Cisco Secure Endpoint (formerly AMP for Endpoints) uses behavioral analytics to detect fileless malware executing in memory.

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch

Answer

Cisco Duo

Question 9

When designing a secure remote access solution, what is the 'Always-On' VPN feature in AnyConnect primarily used for?

Accepted Answer

To enforce security policy for off-network users. Always-On VPN ensures that the VPN tunnel is established immediately when a client detects a network connection, enforcing security policy even off-premise.

Answer

To reduce authentication time

Answer

To improve performance

Answer

To enable seamless roaming

Question 10

Which Cisco tool is best suited for designing and documenting network security architectures?

Accepted Answer

Cisco Modeling Labs (CML).. Cisco Modeling Labs (CML) allows for the simulation and design of complex network security topologies.

Answer

Cisco Meraki Dashboard.

Answer

Cisco Webex.

Answer

Cisco Jabber.

Question 11

You are designing security for a multi-cloud environment. Which feature in Cisco Secure Firewall allows for automated policy deployment based on cloud tags?

Accepted Answer

Dynamic Object Groups.. Cisco Secure Firewall uses cloud-based tags to dynamically apply security group policies, ensuring that as instances scale, the policy follows them.

Answer

Static IP-based Access Control Lists.

Answer

VLAN tagging.

Answer

Network Interface Virtualization.

Question 12

A manufacturing firm wants to secure IoT devices using Cisco TrustSec. Which mechanism ensures that traffic from IoT sensors is isolated from corporate traffic without relying on complex VLAN/ACL management?

Accepted Answer

Scalable Group Tags (SGTs). Scalable Group Tags (SGTs) provide identity-based segmentation, which decouples security policies from network topology.

Answer

Dynamic ARP Inspection

Answer

Private VLANs (PVLANs)

Answer

VLAN Trunking Protocol

Question 13

A security architect is designing a remote-work solution. What is the benefit of using Split Tunneling in Cisco Secure Client?

Accepted Answer

It allows internal traffic to be routed over the VPN while local traffic bypasses it.. Split tunneling allows trusted internet traffic to bypass the VPN, reducing latency and bandwidth load on the headend gateway.

Answer

It provides dual authentication layers for the user.

Answer

It encrypts only the authentication phase of the VPN connection.

Answer

It enforces all traffic through the corporate firewall.

Question 14

Which Cisco feature is used to prevent the unauthorized use of dynamic IP addresses on a network?

Accepted Answer

IP Source Guard.. IP Source Guard (IPSG) restricts IP traffic on non-routed ports to only those IP addresses that were assigned via DHCP.

Answer

Port Security.

Answer

Dynamic ARP Inspection (DAI).

Answer

DHCP Snooping.

Question 15

In a Cisco SD-WAN environment, you need to ensure that branch office traffic destined for SaaS applications is optimized and secured. Which design approach is most appropriate?

Accepted Answer

Implementing Cisco Umbrella SIG integration on the SD-WAN edge devices for DIA.. Direct Internet Access (DIA) with Cisco Umbrella integration ensures traffic is secured at the edge without hair-pinning to a DC.

Answer

Using static routing to bypass all security policies for trusted SaaS domains.

Answer

Deploying a dedicated physical firewall at every branch office.

Answer

Hair-pinning all SaaS traffic back to the corporate headend for inspection.