SDSI Practice Exam 3 — 20 Questions

Question 1

When automating security with Cisco XDR, which component allows for the execution of arbitrary scripts on third-party security tools?

Accepted Answer

Cisco XDR Workflow Engine. The 'Cisco XDR Workflow Engine' allows for custom python/javascript scripts to be executed during an orchestration sequence.

Answer

Cisco XDR Threat Intel module

Answer

Cisco XDR Telemetry API

Answer

Cisco XDR Dashboard

Question 2

When designing a secure multi-cloud strategy for applications, how does Cisco Secure Workload facilitate consistent policy management?

Accepted Answer

By providing a centralized policy plane that integrates with native cloud security controls. Secure Workload uses a common policy engine that translates intent-based policies into the native security rules (like Security Groups) of the respective cloud providers.

Answer

By forcing all traffic to transit a VPN tunnel

Answer

By moving all traffic through a centralized Cisco hardware firewall

Answer

By manually creating ACLs in each cloud provider console

Question 3

You are automating Cisco Secure Firewall policies. Why is 'Version Control' (e.g., Git) considered a security control?

Accepted Answer

Provides audit trails and change history. It provides a source of truth, audit trail, and the ability to revert unauthorized or malicious configuration changes.

Answer

Automatically encrypts all traffic

Answer

Increases bandwidth

Answer

Replaces the need for a firewall

Question 4

A developer needs to ensure that microservices within a Kubernetes cluster communicate securely. Which design element ensures that the service-to-service communication is encrypted using mTLS?

Accepted Answer

Deploying a Service Mesh. A service mesh, such as Istio, automates the configuration of mTLS between microservices.

Answer

Configuring standard Kubernetes Service objects

Answer

Using a physical load balancer in front of the cluster

Answer

Enabling IPsec on the physical nodes

Question 5

Which TWO factors must be considered when designing SaaS security using Cisco Cloudlock to ensure compliance with data protection regulations? (Choose TWO)

Accepted Answer

Establishing remediation workflows for policy violations. Compliance requires identifying sensitive data types and defining automated remediation actions to protect that data.

Answer

Configuring BGP peering with the SaaS provider

Answer

Enabling hardware-based encryption for the SaaS vendor

Answer

Installing agents on all end-user laptops

Question 6

In an AI-based security architecture, which data source provides the most value for training an ML model to detect unauthorized data exfiltration?

Accepted Answer

NetFlow/IPFIX logs. Flow logs (NetFlow/IPFIX) provide the metadata (source, destination, volume) required to detect exfiltration patterns.

Answer

User password history

Answer

System process logs

Answer

DHCP lease logs

Question 7

Following a ransomware incident, an architect must modify the network segmentation strategy. What is the most effective approach to mitigate lateral movement using Cisco TrustSec?

Accepted Answer

Implement SGT-based micro-segmentation at the access layer to enforce policies based on identity rather than IP.. TrustSec SGTs (Scalable Group Tags) allow for dynamic policy enforcement regardless of IP address, making it ideal for mitigating lateral movement.

Answer

Deploy extended ACLs on every core switch port to block peer-to-peer traffic.

Answer

Configure static port-security across the entire enterprise to prevent unauthorized devices.

Answer

Transition all physical cabling to private VLANs without leveraging SGTs.

Question 8

A design requirements gathering phase identifies that users frequently access untrusted SaaS applications. Which Cisco solution should be included to mitigate data exfiltration risks?

Accepted Answer

Cisco Umbrella with CASB capability enabled.. Cisco Cloud Access Security Broker (CASB) functionality within Cisco Umbrella provides visibility and control over SaaS usage.

Answer

Cisco Secure Firewall with IPS enabled.

Answer

Cisco AnyConnect VPN.

Answer

Cisco Identity Services Engine (ISE).

Question 9

A design requirements document specifies a need for 'Network Segmentation' to contain breaches. Which Cisco technology provides the best granular control using Scalable Group Tags (SGTs)?

Accepted Answer

Cisco TrustSec (SGTs).. Cisco TrustSec uses SGTs to enforce segmentation policies based on identity, independent of IP address.

Answer

Cisco Secure Firewall interface zones.

Answer

VLAN-based segmentation.

Answer

Cisco Umbrella local policy.

Question 10

Which design principle should be followed when implementing micro-segmentation in a data center?

Accepted Answer

Implement identity-based segmentation at the workload level.. Micro-segmentation is most effective when it is identity-based and granular.

Answer

Keep all servers in the same VLAN for simplicity.

Answer

Segment based only on IP addresses.

Answer

Disable all firewalls for maximum performance.

Question 11

You are designing an API security strategy. Which mechanism is used to verify the integrity and authenticity of API requests in a microservices environment?

Accepted Answer

JSON Web Tokens (JWT). JWT (JSON Web Token) is the industry standard for securing API requests, typically verified by an API gateway or service mesh.

Answer

SSL/TLS termination at the server

Answer

Static IP allowlisting

Answer

Standard Basic Authentication

Question 12

You are performing a security assessment of a containerized application architecture. Which TWO of the following configurations are critical for ensuring secure communication between pods in a Cisco ACI-managed Kubernetes environment? (Choose TWO)

Accepted Answer

Defining Contracts between EPGs to permit specific traffic types.. In ACI-managed Kubernetes (CNA), security is enforced through Endpoint Groups (EPGs) and contracts that define communication policies between different service tiers.

Answer

Disabling the ACI CNI plugin to allow native Kubernetes network policies.

Answer

Configuring all pods to reside in a single flat, non-segmented network.

Answer

Using physical cabling to separate traffic by VLAN.

Question 13

In a DevSecOps pipeline, what is the benefit of 'Static Application Security Testing' (SAST)?

Accepted Answer

Identifying vulnerabilities in source code. SAST analyzes source code for security vulnerabilities *without* executing the code, catching flaws early.

Answer

Managing user passwords

Answer

Encrypting data in transit

Answer

Monitoring live production traffic

Question 14

Which TWO of the following are common components of an AI-driven security operations center (SOC)?

Accepted Answer

Automated incident response playbooks. Automated incident response and behavior analysis are central to AI-driven SOCs.

Answer

Manual daily log exporting

Answer

Word processing software

Answer

Physical surveillance cameras

Question 15

You are designing a microsegmentation strategy using Cisco Secure Workload (formerly Tetration) for a multi-tier application. Which mechanism allows you to enforce fine-grained security policies between application tiers while maintaining visibility across the hybrid cloud?

Accepted Answer

Using policy-based agents on endpoints to enforce segmentation. Cisco Secure Workload uses software agents on endpoints to enforce microsegmentation policies based on workload identity, rather than IP addresses.

Answer

Applying static ACLs on the core switch

Answer

Implementing Cisco ASA zone-based firewalling

Answer

Configuring VRF-Lite on the distribution layer

Question 16

Which TWO of the following identify risks associated with using AI for security automation?

Accepted Answer

Adversarial machine learning / poisoning. Model drift and adversarial machine learning (data poisoning) are two major concerns.

Answer

Faster network throughput

Answer

Too many security updates

Answer

Increased hardware cost

Question 17

You are designing an API security layer for a public-facing web application. Which security control is most effective against 'Broken Function Level Authorization' (BFLA) attacks?

Accepted Answer

Strict RBAC/ABAC authorization checks on every function. BFLA occurs when a user accesses functions they shouldn't. Proper authorization logic must be enforced at every API endpoint.

Answer

Rate limiting

Answer

Blocking traffic from known malicious IP addresses

Answer

Encrypting all traffic with TLS 1.3

Question 18

What is the primary role of a Service Mesh in an API architecture?

Accepted Answer

To abstract and manage service-to-service communication. A service mesh handles the communication, observability, security, and traffic management between microservices.

Answer

To perform deep packet inspection of external user traffic

Answer

To act as a physical load balancer

Answer

To replace the need for API documentation

Question 19

When designing a secure API environment, which THREE threat categories should be prioritized for detection by Cisco API Security? (Choose THREE)

Accepted Answer

Broken Object Level Authorization (BOLA). API security focuses on common threats like BOLA, excessive data exposure, and broken authentication.

Answer

Local fiber optic cable breaks

Answer

Standard server hardware failures

Question 20

A security architect is designing a SOC response workflow using Cisco SecureX Orchestration. Which mechanism is most effective for automated remediation of an endpoint identified as compromised via Cisco Secure Endpoint?

Accepted Answer

Triggering a workflow that executes the isolate endpoint action in Cisco Secure Endpoint via API.. Cisco SecureX Orchestration uses workflow automation to link threat intelligence from Secure Endpoint to automated containment actions like isolation.

Answer

Deploying an umbrella policy change to redirect the host traffic to a sinkhole.

Answer

Configuring a local script on the Cisco ASA to block the host IP address.

Answer

Using Cisco Defense Orchestrator to push a new access control policy to the endpoint.