SDSI Practice Exam 2 — 20 Questions

Question 1

To secure API endpoints exposed via Cisco Secure API Gateway, which policy type is best suited to prevent brute-force attacks on authentication endpoints?

Accepted Answer

Rate Limiting Policy. Rate limiting policies are the industry standard for preventing brute-force attacks on sensitive API endpoints.

Answer

Identity Propagation Policy

Answer

Schema Validation Policy

Answer

Transformation Policy

Question 2

You are designing security for a SaaS application integrated with Cisco Cloudlock. A user is persistently attempting to share sensitive documents with external parties. Which Cloudlock feature should be applied to remediate this?

Accepted Answer

Create a policy to automatically unshare files containing PII with external collaborators. Cloudlock allows for automated remediation policies that can revoke sharing permissions based on document sensitivity labels or user behavior.

Answer

Implement MFA for the SaaS login portal

Answer

Enable Cisco Umbrella DNS-layer protection

Answer

Configure an API Key for the SaaS platform

Question 3

When designing an automated security policy deployment for Cisco Secure Workload (formerly Tetration), which mechanism allows you to test policies in a simulation environment before applying them to production?

Accepted Answer

Policy Analysis mode. Cisco Secure Workload allows for 'Policy Simulation' or 'Policy Analysis' to validate the impact of rules before enforcement.

Answer

Agentless vulnerability scanning

Answer

Workload isolation testing

Answer

Inventory change management

Answer

Live enforcement mode

Question 4

In a DevSecOps environment, you need to implement Cisco Secure Firewall Management Center (FMC) rule updates via Ansible. Which approach ensures the highest level of security and idempotency?

Accepted Answer

Utilizing the cisco.fmc Ansible collection. Using the 'cisco.fmc' Ansible collection with structured tasks ensures idempotency by checking the state before applying changes.

Answer

Manually updating via FMC UI then exporting JSON

Answer

Pushing configuration snapshots via SCP

Answer

Executing raw REST API calls via shell scripts

Question 5

Which Cisco technology should be included in an automated design to ensure 'Zero Trust' access for remote developers accessing internal development servers?

Accepted Answer

Cisco Secure Access. Cisco Secure Access (or Duo with VPN) provides the identity-centric access control required for Zero Trust.

Answer

Cisco Catalyst Center

Answer

Cisco IOS-XE

Answer

Cisco Webex

Question 6

When designing automated security for Cisco Secure Workload, what does 'Micro-segmentation' provide in the context of DevSecOps?

Accepted Answer

Reduced lateral movement risk. It restricts lateral movement by only allowing necessary application communications, defined by code-based policies.

Answer

Increased server performance

Answer

Hardware redundancy

Answer

Database optimization

Question 7

Which THREE of the following are key features of Cisco XDR (formerly SecureX) in an automated pipeline?

Accepted Answer

Workflow orchestration. Orchestration, threat intelligence, and incident management are core XDR features.

Answer

Automated server patching

Answer

Network packet capture hardware

Question 8

Which THREE of the following are best practices for securing a CI/CD pipeline itself?

Accepted Answer

Scan the pipeline code for vulnerabilities. Securing the runner, managing secrets, and scanning code are fundamental best practices.

Answer

Allow root access to all developers

Answer

Use unencrypted communication channels

Question 9

Which component of Cisco XDR (formerly Cisco SecureX) is critical for normalizing data from different Cisco security products to enable automated orchestration?

Accepted Answer

Unified Data Model. The 'Cisco XDR Unified Data Model' normalizes disparate logs into a standard format for correlation and automation.

Answer

Cloud-native storage

Answer

Local management agent

Answer

Packet inspection engine

Question 10

What is the primary benefit of 'Shift Left' security in a DevSecOps pipeline?

Accepted Answer

Reduced remediation costs. Shifting security to the beginning of the development cycle lowers remediation costs and reduces risk exposure.

Answer

Automated hardware deployment

Answer

Increased development speed

Answer

Elimination of security teams

Question 11

Which THREE of the following technologies should be combined to create a 'Security-as-Code' pipeline for Cisco infrastructure?

Accepted Answer

Git (Version Control). Version control, configuration management, and vulnerability scanning are essential to the workflow.

Answer

Physical console cables

Answer

Local SQL databases

Question 12

Which THREE of the following are considered 'Threat Response' automation actions in a Cisco XDR environment?

Accepted Answer

Blocking a malicious file hash. Isolating an endpoint, blocking a file hash, and blocking a URL are common automated responses.

Answer

Sending a company-wide email

Answer

Rebooting the server hardware

Question 13

You are designing an API security architecture for a hybrid cloud environment. Which TWO Cisco technologies would you implement to secure the API lifecycle?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure API Gateway and Cisco Secure Application (AppDynamics) are standard for API protection.

Answer

Cisco Firepower

Answer

Cisco ISE

Answer

Cisco AnyConnect

Question 14

When designing microsegmentation within Cisco Secure Workload for a hybrid environment, which TWO components are essential for enforcing traffic policies between on-premises servers and cloud-native instances? (Choose TWO)

Accepted Answer

Cisco Secure Workload software agents. Secure Workload relies on agents (for VMs/bare metal) and VPC flow log ingestion/cloud integration (for cloud-native) to build the visibility and enforcement model.

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Umbrella virtual appliance

Answer

Cisco Identity Services Engine (ISE)

Question 15

Which capability is provided by Cisco Cloudlock's integration with the SaaS platform via API?

Accepted Answer

Visibility and remediation of data sharing and user activity. Cloudlock uses APIs to monitor for file sharing, data exposure, and user behavior anomalies within the SaaS environment without requiring agent installation.

Answer

Hardening of the SaaS application code

Answer

Deep packet inspection of all physical network traffic

Answer

Blocking DNS requests at the ISP level

Question 16

Which THREE of the following are essential components of a robust DevSecOps security architecture for Cisco infrastructure?

Accepted Answer

Infrastructure as Code (IaC). Infrastructure as Code, Automated Testing, and Continuous Monitoring are core pillars of DevSecOps.

Answer

Manual Review Committees

Answer

Isolated air-gapped networks

Question 17

You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?

Accepted Answer

Cloudlock API-based CASB integration. Cloudlock uses API-based CASB integration to monitor activity and detect anomalies like abnormal file sharing patterns.

Answer

Cisco Umbrella roaming client

Answer

Cisco ISE Profiling

Answer

Cisco Secure Firewall NAT

Question 18

You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). Which specific architectural component must be deployed within the Kubernetes worker nodes to enforce policy without relying on external firewall hairpining?

Accepted Answer

Secure Workload Software Agent. The Secure Workload software agent (or sensor) is deployed on host nodes to enforce policy at the vSwitch or kernel level, enabling microsegmentation directly at the workload.

Answer

Cisco ASA Virtual Appliance

Answer

Cisco Nexus Dashboard Orchestrator

Answer

Cisco Firepower Management Center

Question 19

You are designing a secure API architecture where services are deployed in Kubernetes. You need to enforce authentication and rate limiting at the ingress. Which tool should be used for centralized policy enforcement?

Accepted Answer

An API Gateway integrated into the Ingress Controller. Cisco API Connectivity Manager (ACM) or an API Gateway integrated with the Ingress Controller handles centralized auth, rate limiting, and observability.

Answer

Using IP-based ACLs on the Kubernetes node

Answer

Hard-coding auth logic into every microservice

Answer

Cisco Secure Firewall running in transparent mode

Question 20

In DevSecOps, what is the role of an 'Artifact Repository' such as Artifactory in relation to security?

Accepted Answer

Store and secure immutable build artifacts. Storing immutable, scanned, and signed artifacts ensures that the code deployed is exactly what was tested.

Answer

Manage user identities

Answer

Monitor real-time network traffic

Answer

Execute live security testing