SDSI Practice Exam 2 — 20 Questions

Question 1

You are implementing automated policy enforcement for Cisco Secure Access by Duo. Which API allows you to programmatically manage users and authentication settings?

Accepted Answer

Duo Admin API. The Duo Admin API is the RESTful interface designed for programmatic management of users, groups, phones, and authentication settings within Duo. It allows administrators to automate onboarding, policy assignment, and configuration changes, which is exactly what an automated policy enforcement pipeline requires.

Answer

Duo Web SDK

Answer

Duo Auth API

Answer

Duo Telemetry API

Question 2

When designing a VPN solution for a hybrid workforce, which protocol provides the most robust support for DTLS to minimize latency for real-time traffic?

Accepted Answer

Cisco Secure Client with DTLS enabled.. Cisco Secure Client (formerly AnyConnect) with DTLS enabled provides the most robust support for DTLS in a VPN solution. DTLS (Datagram Transport Layer Security) runs over UDP and avoids TCP-over-TCP meltdown, minimizing latency for real-time traffic like voice and video. Cisco Secure Client natively supports DTLS and can fall back to TLS if UDP is blocked.

Answer

SSL VPN Clientless portal.

Answer

L2TP/IPsec.

Answer

IPsec IKEv1.

Question 3

Which THREE of the following are essential components of a robust DevSecOps security architecture for Cisco infrastructure?

Accepted Answer

Infrastructure as Code (IaC). Infrastructure as Code (IaC) (A) is essential because it lets Cisco device configurations, policies, and cloud/network resources be defined declaratively in version-controlled templates, enabling repeatable, auditable, and peer-reviewed deployments instead of error-prone manual CLI changes. Continuous Monitoring (C) is required to detect drift, unauthorized configuration changes, and threats in real time across Cisco infrastructure, feeding telemetry into SIEM/SOAR and compliance dashboards so issues are caught and remediated quickly. Automated Testing (D) is essential to validate IaC templates and security controls in CI/CD pipelines (e.g., unit, integration, and policy-as-code checks) before changes reach production, preventing misconfigurations from being deployed. Manual Review Committees (B) are not a core DevSecOps component because they introduce slow, human-gated approvals that contradict the automation and continuous-delivery principles of DevSecOps, even if some review may still occur. Isolated air-gapped networks (E) are not essential to a DevSecOps architecture; while useful in specific high-security environments, they prevent the continuous integration, delivery, and monitoring that DevSecOps depends on.

Answer

Manual Review Committees

Answer

Isolated air-gapped networks

Question 4

Which risk assessment technique involves evaluating the impact of an attack on the confidentiality, integrity, and availability of an asset?

Accepted Answer

CIA Triad Impact Assessment.. The CIA Triad Impact Assessment evaluates how an attack would degrade Confidentiality, Integrity, and Availability of a specific asset, which is the standard qualitative/quantitative risk technique for scoring asset-level impact. It directly maps threat events to business impact on the three core security pillars, producing the impact half of a risk calculation (Risk = Likelihood × Impact).

Answer

SWOT Analysis.

Answer

Network Penetration Testing.

Answer

Cost-Benefit Analysis.

Question 5

Which of the following is a key requirement for implementing successful DevSecOps in a large organization?

Accepted Answer

Cultural alignment between teams. Cultural alignment between developers and security teams is the foundational requirement for successful DevSecOps.

Answer

Manual approval for every commit

Answer

Removing all open-source code

Answer

Restricting code access to security only

Question 6

What is the primary architectural benefit of deploying an API Gateway in a microservices environment?

Accepted Answer

It centralizes security and policy enforcement for all services. An API Gateway acts as a single entry point for all client requests, centralizing cross-cutting concerns such as authentication, authorization, rate limiting, and logging. This offloads these responsibilities from individual microservices, ensuring consistent policy enforcement and reducing duplication. By handling security at the edge, services can focus on business logic, and internal services remain protected behind the gateway.

Answer

It makes all internal services public-facing

Answer

It eliminates the need for service-to-service security

Answer

It provides data storage for the microservices

Question 7

When conducting a risk assessment, what is the best way to determine the value of an asset to the organization?

Accepted Answer

Perform a Business Impact Analysis (BIA).. A Business Impact Analysis (BIA) is the formal process for determining the criticality and value of assets by assessing the operational, financial, legal, and reputational impact of their loss or disruption. It identifies critical business functions, dependencies, and recovery objectives (RTO/RPO), which directly translate into asset value for risk assessment. Manufacturer price, IT opinion, and hardware replacement cost reflect only acquisition cost, not business value.

Answer

Check the manufacturer's list price.

Answer

Ask the IT department for their opinion.

Answer

Check the hardware replacement cost.

Question 8

Which TWO methods provide identification for IoT devices in an enterprise network?

Accepted Answer

802.1X (EAP-TLS).. Option A, 802.1X with EAP-TLS, is correct because it provides strong, certificate-based mutual authentication that uniquely identifies IoT devices on the enterprise network before granting access. Option D, device profiling with Cisco ISE, is correct because ISE identifies IoT devices by collecting attributes such as MAC OUI, DHCP fingerprints, and HTTP user-agent data to classify and authorize them. Option B, ignoring the device type, is wrong because it provides no identification and defeats access control. Option C, using public Wi-Fi access, is wrong because it is an untrusted network path that does not identify devices to the enterprise. Option E, MAC address spoofing, is wrong because spoofed MAC addresses are easily forged and cannot reliably identify a device.

Answer

Ignoring the device type.

Answer

Using public Wi-Fi access.

Answer

MAC address spoofing.

Question 9

A design team is integrating Cisco Secure Firewall with an existing SIEM. Which telemetry export format is best for comprehensive security analysis?

Accepted Answer

eStreamer. eStreamer is Cisco's dedicated telemetry export protocol for Cisco Secure Firewall (formerly Firepower) that streams detailed event data—including connection, intrusion, file, malware, and Security Intelligence events—directly to a SIEM or external analysis tool. Unlike flow-only protocols, eStreamer delivers rich, contextual security events needed for comprehensive threat analysis and correlation.

Answer

NetFlow

Answer

SNMP

Answer

ICMP

Question 10

Which Cisco product is best for enforcing security policy based on the user's AD group membership?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco Identity Services Engine (ISE) is the product designed to enforce security policy based on user identity and AD group membership. ISE integrates with Active Directory to retrieve group memberships and uses that information in authorization policies, which can then be enforced on network devices via RADIUS, TrustSec, or pxGrid. This makes ISE the correct choice for identity-based policy enforcement tied to AD groups.

Answer

Cisco Umbrella.

Answer

Cisco Secure Firewall.

Answer

Cisco Stealthwatch.

Question 11

Which TWO identity-based design considerations are critical for secure endpoint access? (Select 2)

Accepted Answer

Device posture validation. Device posture validation (A) is critical because identity-based endpoint access must verify the endpoint's health and compliance state—such as OS patch level, disk encryption, and EDR agent status—before granting access, typically enforced via NAC or Zero Trust policy engines. Multi-factor authentication (E) is also critical because it strengthens identity assurance by requiring a second factor (e.g., TOTP, FIDO2 security key, or push notification) beyond a password, mitigating credential theft and replay attacks. Port security configuration (B) is a Layer 2 switch feature that limits MAC addresses per port and is not an identity-based access consideration. Disabling DHCP (C) is not an identity control and would break normal IP address assignment rather than secure endpoint access. Physical cabling security (D) addresses physical-layer protection and does not validate user or device identity for endpoint access.

Answer

Port security configuration

Answer

Disabling DHCP

Answer

Physical cabling security

Question 12

When designing security for SaaS applications using Cisco Cloudlock, which TWO capabilities are key to mitigating data exfiltration risks? (Choose TWO)

Accepted Answer

Monitoring for anomalous user behavior and account takeovers.. Option A is correct because Cisco Cloudlock's User and Entity Behavior Analytics (UEBA) continuously baselines normal SaaS activity and flags anomalies such as impossible travel, mass downloads, or compromised-account indicators, which are leading precursors to data exfiltration. Option B is correct because Cloudlock's Data Loss Prevention (DLP) engine applies consistent, API-based policies across sanctioned SaaS platforms (e.g., Microsoft 365, Google Workspace, Salesforce, Box), detecting and remediating sensitive data (PII, PCI, PHI) in files, posts, and sharing events before it leaves the organization. Option C is not part of Cloudlock's design, since it is a cloud-native CASB that secures SaaS rather than eliminating it. Option D is unrelated and impractical, as Cloudlock governs SaaS data flows via APIs, not by blocking all outbound Internet traffic. Option E is a security anti-pattern; hard-coding credentials into any dashboard violates least-privilege and credential-management principles and is not a Cloudlock capability.

Answer

Replacing all SaaS applications with on-premises alternatives.

Answer

Blocking all outbound Internet traffic from the office network.

Answer

Hard-coding user credentials into the Cloudlock dashboard.

Question 13

Which Cisco solution is best suited to prevent data exfiltration from a cloud-native Kubernetes cluster?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload is purpose-built for workload-level protection, including containerized and Kubernetes environments, using agents and flow telemetry to enforce microsegmentation and detect anomalous behavior that could indicate exfiltration. It understands pod-to-pod communication and can apply policies at the container level. The other options are network, wireless, or DNS-layer tools without Kubernetes workload context.

Answer

Cisco DNA Center

Answer

Cisco Umbrella

Answer

Cisco Meraki Dashboard

Question 14

A SOC manager requests a design that simplifies the incident investigation process. Which TWO Cisco tools should the design include for improved correlation of network traffic and endpoint events? (Choose two)

Accepted Answer

Cisco Secure Network Analytics. Cisco Secure Network Analytics (formerly Stealthwatch) is correct because it provides network traffic visibility and behavioral analytics, using flow telemetry (NetFlow/IPFIX) and entity modeling to detect and correlate suspicious network activity across the infrastructure, which directly supports incident investigation. Cisco Secure Endpoint (formerly AMP for Endpoints) is correct because it delivers endpoint detection and response telemetry—file trajectory, process lineage, and threat verdicts—that can be correlated with network events to reconstruct an incident's scope and root cause. Together these two tools give the SOC the network-plus-endpoint correlation the manager requested. Cisco DNA Spaces is a location analytics and indoor positioning platform, not a security correlation tool, so it does not belong. Cisco Smart Licensing is a license management framework and Cisco Nexus Dashboard is a data center operations and automation console, neither of which correlates network traffic with endpoint events.

Answer

Cisco DNA Spaces

Answer

Cisco Smart Licensing

Answer

Cisco Nexus Dashboard

Question 15

Which Cisco product is specifically designed to provide visibility into encrypted traffic without the need for manual decryption?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) uses machine learning and network telemetry to identify malware in encrypted traffic without decrypting it. It analyzes flow metadata and sequence of packet lengths and times (SPLT) to detect threats, preserving privacy and reducing complexity. This is specifically designed for visibility into encrypted traffic.

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco Stealthwatch.

Answer

Cisco Firepower IPS.

Question 16

When designing automated security for Cisco Secure Workload, what does 'Micro-segmentation' provide in the context of DevSecOps?

Accepted Answer

Reduced lateral movement risk. Micro-segmentation in Cisco Secure Workload enforces granular, workload-level policies (often based on process, user, and flow attributes) that restrict which workloads can communicate with each other. In DevSecOps, this directly limits lateral movement if an attacker compromises a container or VM, because east-west traffic is denied by default except for explicitly allowed flows. It is a containment control, not a performance, redundancy, or database feature.

Answer

Increased server performance

Answer

Hardware redundancy

Answer

Database optimization

Question 17

Which Cisco product provides visibility into traffic within the cloud, helping to identify potential microsegmentation policies?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload (formerly Tetration) provides deep visibility into workload-to-workload traffic in data centers and cloud environments, using flow telemetry to map dependencies and recommend microsegmentation policies. It is the Cisco product explicitly designed to discover traffic patterns and then generate and enforce microsegmentation policy. This matches the question's requirement for cloud traffic visibility to inform microsegmentation.

Answer

Cisco DNA Center

Answer

Cisco Meraki

Answer

Cisco Umbrella

Question 18

When designing an automated security policy deployment for Cisco Secure Workload (formerly Tetration), which mechanism allows you to test policies in a simulation environment before applying them to production?

Accepted Answer

Policy Analysis mode. Policy Analysis mode in Cisco Secure Workload allows you to simulate the effect of a policy against historical flow data without enforcing it, showing which flows would be allowed or denied. This lets you validate policy changes in a safe, non-disruptive way before moving to enforcement. It is the designated simulation mechanism for policy testing.

Answer

Agentless vulnerability scanning

Answer

Workload isolation testing

Answer

Inventory change management

Answer

Live enforcement mode

Question 19

Which protocol is recommended for secure network time synchronization across security devices?

Accepted Answer

NTP with Authentication. NTP with Authentication (such as NTPv4 with symmetric key authentication or Autokey) ensures that time synchronization messages are authenticated, preventing spoofing and man-in-the-middle attacks. Secure network time synchronization is critical for security devices because inaccurate time can break certificate validation, log correlation, and authentication protocols like Kerberos. Plain NTP is vulnerable to spoofing, so authentication is recommended.

Answer

SNMP

Answer

HTTP

Answer

DHCP

Question 20

Which Cisco feature is used to ensure that only authorized devices can connect to the network?

Accepted Answer

Cisco ISE (802.1X).. Cisco ISE with 802.1X provides port-based network access control that authenticates devices and users before granting network access. It enforces identity-based policies so only authorized devices (validated via certificates, credentials, or MAB) can connect, making it the correct feature for ensuring only authorized devices join the network.

Answer

Cisco Umbrella.

Answer

Cisco Firepower IPS.

Answer

Cisco Stealthwatch.