SDSI Practice Test 20 — 15 Questions

Question 1

Which THREE criteria are used during the 'Requirements Gathering' phase of a secure architecture design?

Accepted Answer

Business objectives and compliance requirements.. Option C is correct because requirements gathering in secure architecture design must capture business objectives and applicable compliance requirements (e.g., PCI DSS, HIPAA, GDPR), since these drive security controls, data handling, and risk tolerance. Option D is correct because throughput and latency requirements for critical applications define performance constraints that shape topology, link sizing, QoS, and redundancy decisions in the design. Option E is correct because the existing network topology and traffic flow patterns establish the baseline environment, including segmentation, choke points, and trust boundaries, that the secure architecture must integrate with or migrate from. Option A is not a requirements-gathering criterion; rack unit color is a physical aesthetic detail with no bearing on security or functional design. Option B is also irrelevant, as personal email addresses of engineers are not a design requirement and would raise privacy concerns rather than inform architecture.

Answer

The color of the hardware rack units.

Answer

The personal email addresses of the network engineering team.

Question 2

When utilizing Cisco DevNet tools for security, which Python library is the standard for interacting with the Cisco FMC API efficiently?

Accepted Answer

fmcapi. The `fmcapi` library is the de facto standard Python library for interacting with Cisco Firepower Management Center (FMC) REST API. It abstracts the low-level HTTP requests, handles authentication (token generation and refresh), and provides object-oriented classes for FMC objects like access policies, network objects, and rules. This makes it efficient for automation tasks such as bulk configuration, policy management, and reporting. Other options are not recognized libraries for FMC API interaction.

Answer

requests_cisco

Answer

cisco_py

Answer

fmc_sdk

Question 3

You are designing an API security architecture for a hybrid cloud environment. Which TWO Cisco technologies would you implement to secure the API lifecycle?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure API Gateway (E) is correct because it is purpose-built for API security across the API lifecycle, providing discovery, threat detection, schema validation, and protection against OWASP API Top 10 attacks such as injection, broken object level authorization, and data exposure in hybrid cloud deployments. Cisco Secure Application for AppDynamics (C) is correct because it integrates runtime application security with APM telemetry, using business transaction monitoring and runtime behavioral analysis to detect and block attacks against APIs and applications in real time, including in hybrid environments. Cisco Firepower (A) is a network firewall/IPS focused on perimeter and network traffic inspection, not API lifecycle security. Cisco ISE (B) is a network access control and identity policy platform for users and devices, not API protection. Cisco AnyConnect (D) is a VPN/endpoint secure access client, unrelated to securing API design, runtime, or lifecycle management.

Answer

Cisco Firepower

Answer

Cisco ISE

Answer

Cisco AnyConnect

Question 4

An organization wants to monitor all internal traffic for anomalies. Which Cisco tool is used for behavioral analysis of network flows?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch).. Cisco Secure Network Analytics (formerly Stealthwatch) is specifically designed for behavioral analysis of network flows. It collects NetFlow, IPFIX, and other flow telemetry from routers, switches, and firewalls, then applies machine learning and behavioral analytics to detect anomalies such as data exfiltration, lateral movement, or command-and-control traffic. Unlike signature-based tools, it baselines normal traffic patterns and alerts on deviations, making it the correct choice for monitoring internal traffic for anomalies.

Answer

Cisco ISE.

Answer

Cisco Umbrella.

Answer

Cisco Firepower IPS.

Question 5

Which design principle is essential when building an API Gateway for high-security environments?

Accepted Answer

Centralized security enforcement at the ingress layer. Centralized security enforcement at the ingress layer means authentication, authorization, rate limiting, schema validation, and threat inspection are all applied consistently at the API Gateway before requests reach backend services. This prevents policy drift and ensures every API consumer passes the same controls.

Answer

Direct routing to services without inspection

Answer

Allowing the backend to perform all security checks

Answer

Encrypting traffic only when it leaves the data center

Question 6

A security designer is tasked with improving the SOC's incident response time. Which TWO Cisco platform capabilities should be integrated to enable automated threat hunting and containment? (Choose two)

Accepted Answer

Cisco Secure Endpoint. Cisco Secure Endpoint (A) is correct because it provides endpoint detection and response (EDR) telemetry and can automatically isolate a compromised host, which directly supports automated threat hunting and containment at the endpoint layer. Cisco Secure Firewall (D) is correct because its management center (FMC) supports automated threat hunting via correlation/incident policies and can enforce containment by blocking malicious traffic through access control and intrusion policies. Together these platforms feed and act on threat intelligence to shorten SOC response time. Cisco Webex (B) is a collaboration suite, Cisco UCS Manager (C) manages compute hardware, and Cisco Prime Infrastructure (E) is a network management tool; none of these provide the automated threat hunting and containment capabilities required here.

Answer

Cisco Webex

Answer

Cisco UCS Manager

Answer

Cisco Prime Infrastructure

Question 7

You are designing a security architecture for a hybrid cloud environment using Cisco Secure Firewall. Which design pattern effectively mitigates the risk of lateral movement between VPCs in AWS while maintaining centralized policy enforcement?

Accepted Answer

Utilizing a Transit Gateway with a centralized inspection VPC and VPC attachments.. A Transit Gateway with a centralized inspection VPC and VPC attachments allows all inter-VPC traffic to be routed through a single inspection point where Cisco Secure Firewall can enforce policy. This design centralizes security policy, avoids the complexity of managing firewalls in every VPC, and effectively mitigates lateral movement by forcing east-west traffic through inspection before it reaches another VPC.

Answer

Relying solely on AWS Security Groups for inter-VPC traffic.

Answer

Implementing an Overlay Network using Cisco ACI Remote Leaf.

Answer

Deploying individual firewall appliances in each VPC.

Question 8

Which TWO factors are critical for selecting a firewall architecture?

Accepted Answer

Integration with current management ecosystem (e.g., FMC).. Option C is correct because selecting a firewall architecture must account for how the device integrates with the existing management ecosystem, such as Cisco Firepower Management Center (FMC), since centralized policy deployment, event correlation, and compliance reporting depend on that integration. Option E is correct because required throughput and inspection depth directly determine hardware sizing and architecture choices—deep inspection features like TLS decryption, IPS, and application visibility consume substantial CPU/ASIC resources, so the platform must be rated for the expected traffic load with those services enabled. Options A, B, and D are not critical architectural factors: restricting to legacy IPsec gateways is an outdated and overly narrow constraint, local coffee availability is irrelevant to firewall design, and chassis color has no bearing on security, performance, or manageability.

Answer

Using only legacy IPsec gateways.

Answer

Availability of local coffee in the DC.

Answer

The color of the firewall chassis.

Question 9

When designing a firewall for a data center, what is the best practice for handling high-bandwidth traffic inspection?

Accepted Answer

Use hardware-accelerated inspection.. Hardware-accelerated inspection offloads computationally intensive tasks like deep packet inspection (DPI), SSL/TLS decryption, and signature matching to dedicated ASICs, FPGAs, or network processors. This preserves throughput and low latency even at multi-gigabit or terabit speeds, which software-only inspection cannot sustain without massive CPU overhead. In a data center, where traffic volumes are high and latency-sensitive, hardware acceleration is the only practical way to maintain both security and performance.

Answer

Use software-based inspection only.

Answer

Disable deep packet inspection.

Answer

Route all traffic through the management interface.

Question 10

Which THREE of the following technologies should be combined to create a 'Security-as-Code' pipeline for Cisco infrastructure?

Accepted Answer

Git (Version Control). Git (A) is correct because a Security-as-Code pipeline requires version control to store, track, review, and audit infrastructure and policy definitions as code, enabling pull requests, branching, and rollback of security configurations. Static Analysis (SAST) tools (C) are correct because they scan the declarative code and templates for misconfigurations, insecure defaults, and policy violations before deployment, shifting security left in the CI/CD pipeline. Terraform or Ansible (D) is correct because these configuration-management and infrastructure-as-code tools actually apply the desired security posture to Cisco devices and platforms in an idempotent, repeatable, automated manner. Physical console cables (B) are not part of a code-driven pipeline since they represent manual out-of-band access rather than automated, versioned deployment. Local SQL databases (E) are not a Security-as-Code component; state and inventory are typically handled by the IaC tool's state files or a remote backend, not a local SQL store.

Answer

Physical console cables

Answer

Local SQL databases

Question 11

An enterprise is migrating legacy apps to a cloud-native architecture. You need to secure inter-service communication. Which Cisco solution provides mutual TLS and fine-grained access control using sidecar proxies?

Accepted Answer

Cisco Service Mesh Manager. Cisco Service Mesh Manager (built on Istio) deploys sidecar proxies (Envoy) alongside each microservice, enabling mutual TLS between services and fine-grained, identity-based access control policies. This is exactly the architecture required to secure east-west inter-service communication in a cloud-native environment.

Answer

Cisco Umbrella SIG

Answer

Cisco Secure Application for AppDynamics

Answer

Cisco Secure Firewall

Question 12

Which component of Cisco XDR (formerly Cisco SecureX) is critical for normalizing data from different Cisco security products to enable automated orchestration?

Accepted Answer

Unified Data Model. The Unified Data Model (UDM) in Cisco XDR is the normalization layer that translates telemetry from disparate Cisco security products (Umbrella, Secure Endpoint, Secure Firewall, Email Security, etc.) into a common schema. This shared schema is what allows orchestration workflows and automation to reason about events consistently regardless of source product.

Answer

Cloud-native storage

Answer

Local management agent

Answer

Packet inspection engine

Question 13

What is the primary function of an 'API Gateway' in a secure automated environment?

Accepted Answer

Enforce security and rate limits on APIs. An API Gateway sits between clients and backend services and is the enforcement point for authentication, authorization, rate limiting, throttling, and request validation. In secure automated environments it centralizes these controls so individual microservices don't each reimplement them. This makes it the primary security and traffic-control chokepoint for API traffic.

Answer

Host static websites

Answer

Store user data

Answer

Compile application code

Question 14

Which design principle is essential when configuring Cisco Secure Firewall for SaaS application visibility?

Accepted Answer

Enable Application Filtering policies using the cloud-delivered feed.. Cisco Secure Firewall achieves SaaS application visibility by leveraging Application Filtering policies that use cloud-delivered application signatures and metadata feeds. These feeds are continuously updated by Cisco Talos to identify SaaS applications even when they use dynamic IPs, CDNs, or encrypted traffic. Enabling Application Filtering allows the firewall to classify traffic based on application characteristics rather than static IPs or ports, which is essential for accurate visibility and control.

Answer

Disable SSL decryption for all SaaS traffic to improve performance.

Answer

Install local agents on every endpoint.

Answer

Configure static IP-based rules for every SaaS provider.

Question 15

A design requirement for a SOC environment is to have real-time visibility into who is on the network. Which Cisco tool is best for this?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco Identity Services Engine (ISE) is the platform that provides real-time visibility into who is on the network by integrating with identity stores (Active Directory, LDAP), profiling endpoints, and enforcing 802.1X/MAB-based access. It continuously tracks authenticated users, device types, and posture, giving SOC teams live contextual awareness of network participants. This makes ISE the correct tool for the stated requirement.

Answer

Cisco SecureX.

Answer

Cisco Umbrella.

Answer

Cisco Firepower Management Center.