SDSI Practice Exam 1 — 20 Questions

Question 1

A security architect is adapting a design post-incident after a credential theft event. Which Cisco ISE feature should be integrated into the architecture to mitigate the risk of compromised static credentials?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enabling MFA integration with Cisco Duo via RADIUS.. Credential theft of static passwords is best mitigated by adding a second authentication factor that cannot be replayed or stolen alongside the password. Integrating Cisco Duo MFA with ISE via RADIUS enforces a second factor (push, TOTP, biometric) at authentication time, so a stolen password alone is insufficient to gain access. This directly addresses the post-incident risk described.

Answer

Deploying Cisco pxGrid to share user identity info with the firewall.

Answer

Configuring Cisco TrustSec to segment user traffic based on IP address.

Answer

Implementing Cisco AnyConnect Device Posture assessment.

Question 2

A SOC analyst requires a tool to gain visibility into encrypted traffic without full decryption. Which Cisco product feature should be included in the design to meet this requirement?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) uses machine learning and network telemetry (NetFlow, TLS metadata such as handshake fields and packet-length sequences) to detect malware in encrypted traffic without decrypting it. It is purpose-built for visibility into encrypted flows while preserving privacy and performance, exactly matching the SOC analyst's requirement.

Answer

Cisco Firepower SSL decryption policies.

Answer

Cisco AnyConnect Network Visibility Module (NVM).

Answer

Cisco Identity Services Engine (ISE) Profiling.

Question 3

A design architect is updating an incident response strategy. What is the role of the 'Post-Incident Architecture Adaptation' phase?

Accepted Answer

To identify and implement changes to prevent recurrence of the incident.. The Post-Incident Architecture Adaptation phase is where lessons learned from an incident are translated into concrete architectural and policy changes to prevent recurrence. It is not about cost accounting, audit documentation, or HR discipline — it is about feeding findings back into the design so the same class of incident is mitigated or eliminated. This aligns with the NIST IR lifecycle 'lessons learned' and continuous improvement stages.

Answer

To document the costs of the incident.

Answer

To update the network documentation for the next annual audit.

Answer

To discipline employees who caused the incident.

Question 4

You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?

Accepted Answer

Cloudlock API-based CASB integration. Cisco Cloudlock integrates with Google Workspace through its API-based CASB connection, using OAuth to read Drive, Gmail, and audit logs. That API access gives Cloudlock visibility into file sharing settings, external collaborators, and user activity, and its behavioral analytics baseline normal user behavior to flag anomalies such as mass external sharing or unusual download volumes. Remediation is then performed through the same APIs.

Answer

Cisco Umbrella roaming client

Answer

Cisco ISE Profiling

Answer

Cisco Secure Firewall NAT

Question 5

Following a major data exfiltration incident, the design team needs to adapt the architecture to prevent lateral movement. Which Cisco Secure Firewall design modification is most effective for mitigating this risk while maintaining operational performance?

Accepted Answer

Implement SGT-based micro-segmentation. SGT-based micro-segmentation using Cisco TrustSec assigns Security Group Tags to workloads and enforces policy based on those tags rather than IP addresses. This allows the firewall to apply granular east-west controls that prevent lateral movement between compromised and target systems, while keeping policy scalable and operationally efficient. It directly addresses lateral movement risk without the performance penalty of inspecting every signature.

Answer

Enable all IPS signatures in blocking mode

Answer

Transition to transparent mode

Answer

Increase firewall inspection timeouts

Question 6

An organization is updating its SOC incident response toolset. Which Cisco technology provides the ability to perform 'retrospective security' by tracking files that have entered the network in the past?

Accepted Answer

Cisco Secure Endpoint (AMP).. Cisco Secure Endpoint (formerly AMP for Endpoints) is built on a continuous file-tracking and retrospective-analysis model: every file that enters an endpoint is fingerprinted (SHA-256) and recorded in the cloud, so when new threat intelligence arrives, the system can retroactively query its historical file database and flag files that were previously deemed clean. This 'retrospective security' capability is the defining feature of the AMP/Secure Endpoint architecture and is what allows the SOC to identify past compromises without re-scanning every host.

Answer

Cisco Secure Network Analytics (Stealthwatch).

Answer

Cisco Firepower IPS.

Answer

Cisco Umbrella.

Question 7

Following a ransomware incident, an architect must modify the network segmentation strategy. What is the most effective approach to mitigate lateral movement using Cisco TrustSec?

Accepted Answer

Implement SGT-based micro-segmentation at the access layer to enforce policies based on identity rather than IP.. Implementing SGT-based micro-segmentation at the access layer with Cisco TrustSec enforces policies based on identity (security group tags) rather than IP addresses, which effectively mitigates lateral movement by restricting communication between groups even within the same VLAN. This approach is dynamic and scalable, allowing granular control that follows the workload or user, not the IP.

Answer

Deploy extended ACLs on every core switch port to block peer-to-peer traffic.

Answer

Configure static port-security across the entire enterprise to prevent unauthorized devices.

Answer

Transition all physical cabling to private VLANs without leveraging SGTs.

Question 8

Which THREE of the following are key AI/ML design considerations when selecting a security automation platform?

Accepted Answer

Explainability and transparency (XAI). Option B (Explainability and transparency, XAI) is correct because security automation platforms increasingly rely on AI/ML models to triage alerts and make risk decisions, so analysts and auditors must be able to understand why a model produced a given verdict to trust, validate, and defend it. Option C (API integration and extensibility) is correct because a security automation platform must interoperate with SIEM, SOAR, EDR, ticketing, and threat-intel systems via REST APIs, webhooks, and plugins, so its ability to integrate and be extended determines how well the AI/ML capabilities fit existing workflows. Option E (Data quality and labeling) is correct because ML model accuracy in security use cases depends directly on well-curated, correctly labeled, and representative training data (e.g., labeled true/false positives), and poor data quality leads to high false-positive rates and unreliable automation. Option A is not a key AI/ML design consideration because vendor team headcount does not determine model explainability, integration capability, or data quality. Option D is not a key AI/ML design consideration for platform selection because local GPU acceleration is an infrastructure/deployment detail, not a core AI/ML design factor, and many platforms deliver inference via cloud or vendor-managed services.

Answer

Number of employees on the vendor's team

Answer

Local hardware GPU acceleration

Question 9

Which THREE actions are recommended when designing a secure API architecture using Cisco API Security to mitigate OWASP API Top 10 threats? (Choose THREE)

Accepted Answer

Implement strict schema validation on all incoming API requests. Option A is correct because strict schema validation on all incoming API requests enforces expected data types, formats, and required fields, which directly mitigates OWASP API threats such as mass assignment, injection, and improper input handling by rejecting malformed or unexpected payloads before they reach backend logic. Option D is correct because continuous monitoring of API traffic for anomalies that indicate data exfiltration helps detect and respond to threats like excessive data exposure and data harvesting, which are core concerns in the OWASP API Top 10. Option E is correct because deploying Cisco API Security to detect Broken Object Level Authorization (BOLA) addresses the top-ranked OWASP API risk, where attackers manipulate object identifiers to access resources belonging to other users; API security tooling can baseline and flag such unauthorized object access patterns. Option B is incorrect because bypassing authentication for performance eliminates access control entirely and would worsen, not mitigate, OWASP API threats such as broken authentication and BOLA. Option C is incorrect because disabling logging of API request headers removes critical audit and forensic visibility needed to detect and investigate attacks, undermining rather than strengthening API security.

Answer

Allow all API traffic to bypass authentication for performance

Answer

Disable all logging of API request headers

Question 10

Which risk assessment methodology is best suited to guide a design modification for a cloud-native architecture relying on Cisco Secure Cloud Analytics?

Accepted Answer

NIST SP 800-30 for conducting the assessment.. NIST SP 800-30 is a risk assessment methodology specifically designed to guide the assessment process, including identifying threats, vulnerabilities, likelihood, and impact. For a cloud-native architecture using Cisco Secure Cloud Analytics, it provides a structured approach to evaluate risks and inform design modifications. It is vendor-neutral and applicable to cloud environments.

Answer

ISO 27002 implementation guide.

Answer

OWASP Top 10 for all infrastructure components.

Answer

PCI-DSS compliance checklist.

Question 11

You are designing application security for a new customer-facing web application hosted on Cisco ACI with a Cisco Secure Firewall (formerly Firepower) cluster managed by Cisco Secure Firewall Management Center. The application uses a REST API that authenticates users via OAuth 2.0 bearer tokens. The security team wants to detect and block attacks that exploit business logic in the API, such as manipulating order quantities or bypassing approval steps, without breaking legitimate token-based traffic. Which design approach should you recommend?

Accepted Answer

Enable Cisco Secure Firewall's TLS decryption on the API server's traffic and apply a custom Snort 3 rule that inspects JSON payload fields for out-of-range quantity values.. Business logic attacks against APIs require visibility into the application payload, not just network metadata. TLS decryption on Cisco Secure Firewall enables inspection of the JSON body, and a custom Snort 3 rule can enforce semantic constraints such as allowed quantity ranges or approval sequences. This design targets the specific manipulation described while preserving legitimate OAuth 2.0 bearer token traffic, because the rule acts on payload fields rather than blocking encrypted sessions wholesale.

Answer

Configure Cisco Application Centric Infrastructure (ACI) microsegmentation contracts to allow only HTTP POST methods to the API endpoint, blocking all other methods.

Answer

Use Cisco Identity Services Engine (ISE) to profile API clients and assign a downloadable ACL that limits each client to a fixed number of API calls per minute.

Answer

Deploy Cisco Umbrella SIG and configure a custom block page for any API request that contains a quantity parameter greater than 100.

Question 12

A risk assessment reveals that internal servers are vulnerable to unauthorized access via SMB protocols. Which Cisco feature should be implemented on the internal switching infrastructure to mitigate this risk?

Accepted Answer

Cisco TrustSec (SGTs).. Cisco TrustSec uses Security Group Tags (SGTs) to enforce role-based access control within the switching infrastructure, allowing segmentation and policy enforcement based on identity/role rather than IP addresses. By tagging SMB traffic and applying SGACLs, unauthorized access to internal servers via SMB can be blocked at the switch level. This is the appropriate internal segmentation control for the described risk.

Answer

ACLs on the core switch.

Answer

Cisco Secure Endpoint scan.

Answer

Cisco Umbrella local policy.

Question 13

Which THREE of the following are key features of Cisco XDR (formerly SecureX) in an automated pipeline?

Accepted Answer

Workflow orchestration. Cisco XDR (formerly SecureX) is built around an automation pipeline in which Workflow orchestration (A) is a core feature, allowing security teams to design, trigger, and chain automated response actions across integrated Cisco and third-party tools. Incident management and response (B) is also central, since XDR correlates detections into incidents, enriches them, and drives response actions from a single console. Threat intelligence aggregation (C) is likewise a key capability, as XDR ingests and normalizes threat intel from multiple sources (e.g., Cisco Talos, third-party feeds) to enrich detections and inform automated workflows. Automated server patching (D) is not a Cisco XDR function; patching is handled by endpoint management or vulnerability/patch management tools, not by the XDR platform itself. Network packet capture hardware (E) is a physical appliance concern (e.g., dedicated capture devices or switches with SPAN/TAP), not a feature of the Cisco XDR software platform.

Answer

Automated server patching

Answer

Network packet capture hardware

Question 14

You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). Which specific architectural component must be deployed within the Kubernetes worker nodes to enforce policy without relying on external firewall hairpining?

Accepted Answer

Secure Workload Software Agent. The Secure Workload Software Agent must be deployed on Kubernetes worker nodes to enforce microsegmentation policy locally at the workload level. The agent intercepts traffic at the host's network stack (via iptables/eBPF or similar) and applies Tetration's policy without hairpinning traffic to an external firewall. This distributed enforcement model is the core of Cisco Secure Workload's architecture for container and VM environments.

Answer

Cisco ASA Virtual Appliance

Answer

Cisco Nexus Dashboard Orchestrator

Answer

Cisco Firepower Management Center

Question 15

A network security designer is evaluating email security solutions. Which feature in Cisco Secure Email (ESA) is most effective against sophisticated Business Email Compromise (BEC) attacks?

Accepted Answer

Advanced Phishing Protection. Advanced Phishing Protection in Cisco Secure Email (ESA) is specifically designed to detect and block sophisticated Business Email Compromise (BEC) attacks that evade traditional signature-based defenses. It uses machine learning and behavioral analysis to identify anomalous sender behavior, such as display name spoofing, lookalike domains, and compromised accounts, which are hallmarks of BEC. Unlike URL filtering or spam quarantine, it focuses on the social engineering tactics and context of the email rather than just malicious links or bulk spam characteristics.

Answer

URL Filtering

Answer

Spam Quarantine

Answer

DKIM Signing

Question 16

A security architect is developing a requirements document for a SOC. Which Cisco capability allows the SOC to prioritize alerts by correlating threats across network, endpoint, and cloud?

Accepted Answer

Cisco SecureX cross-product correlation.. Cisco SecureX is the platform that aggregates and correlates threat intelligence and events across Cisco's portfolio — network (Secure Firewall, Umbrella), endpoint (Secure Endpoint), and cloud (Umbrella, cloud security) — into a single ribbon and threat response view. Its cross-product correlation is what lets a SOC prioritize alerts by seeing that an endpoint detection, a network flow, and a cloud log all relate to the same threat. The other options are single-domain tools that lack cross-domain correlation.

Answer

Cisco Stealthwatch alert grouping.

Answer

Cisco Secure Firewall management center alert correlation.

Answer

Cisco Identity Services Engine monitoring.

Question 17

What is the primary function of Cisco pxGrid in a network design?

Accepted Answer

To exchange security context and data between Cisco and third-party products.. Cisco pxGrid is a platform that enables bidirectional, context-sharing integration between Cisco security products and third-party solutions. It publishes security context — such as identity, endpoint posture, threat detection, and session data — and allows subscribers to query or receive that data to trigger coordinated responses. Its primary function is exchanging security context and data, not enforcing traffic controls itself.

Answer

To encrypt traffic.

Answer

To filter web traffic.

Answer

To manage physical hardware.

Question 18

When designing an API security architecture, what is the primary purpose of 'API Discovery' in the context of Cisco API Security?

Accepted Answer

To inventory all API endpoints and identify shadow or undocumented APIs. API Discovery in Cisco API Security is fundamentally an inventory and visibility function: it enumerates all API endpoints actually in use across the environment and compares them against documented/registered APIs to surface shadow (undocumented) and orphaned (unused) APIs. This gives security teams the complete attack surface picture needed before they can apply any protection. It is a prerequisite for policy enforcement, not a replacement for gateways or a performance feature.

Answer

To replace the need for API gateways

Answer

To increase the API's performance

Answer

To automatically generate API documentation for developers

Question 19

Which aspect of AI-driven security automation helps in 'Reducing Mean Time to Respond (MTTR)'?

Accepted Answer

Automated data correlation. Automated data correlation aggregates and analyzes telemetry from multiple sources (endpoints, network devices, identity systems, threat intelligence feeds) to rapidly identify and prioritize security incidents. By correlating disparate events automatically, security teams can detect and respond to threats much faster, directly reducing Mean Time to Respond (MTTR). This is a core value proposition of AI-driven security automation.

Answer

Updating hardware firmware

Answer

Reducing network latency

Answer

Increasing developer training

Question 20

A security architect is configuring Cisco SecureX for the first time. Which is the most important step to enable centralized incident response?

Accepted Answer

Integrating product API credentials (e.g., Secure Endpoint, Umbrella).. Cisco SecureX aggregates data and enables automated workflows across Cisco security products by integrating their APIs. To enable centralized incident response, you must integrate product API credentials (e.g., Secure Endpoint, Umbrella, Firepower) so SecureX can pull events, correlate them, and trigger response actions. Without API integration, SecureX has no data to work with.

Answer

Setting the dashboard background color.

Answer

Manually uploading log files.

Answer

Renaming all the products in the dashboard.