SDSI Practice Exam 3 — 20 Questions

Question 1

A design team is implementing Cisco ISE for a hybrid work environment. Which Cisco ISE architectural component is responsible for processing RADIUS and TACACS+ requests while offloading policy decision logic from the Administration node?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policy Service Node (PSN). The Policy Service Node (PSN) is the Cisco ISE persona that receives and processes RADIUS and TACACS+ authentication, authorization, and accounting requests from network devices. PSNs run the policy engine locally, evaluating identity and posture against policy sets, so the PAN does not have to handle every live authentication. This offloads policy decision logic and provides horizontal scalability and redundancy for access requests.

Answer

Primary Administration Node (PAN)

Answer

Monitoring Node (MnT)

Answer

Policy Information Point (PIP)

Question 2

You are designing the security for a SaaS application access scenario. What is the role of the Cloud Access Security Broker (CASB)?

Accepted Answer

To gain visibility into SaaS application usage and prevent data exfiltration.. A CASB sits between users and cloud/SaaS providers, providing visibility into sanctioned and unsanctioned SaaS usage, enforcing DLP policies, and preventing data exfiltration. It operates via API mode, forward proxy, or reverse proxy to inspect traffic and apply granular controls. This makes it the correct answer for gaining SaaS visibility and stopping exfiltration.

Answer

To manage local network switches.

Answer

To encrypt all internet-bound traffic at the gateway.

Answer

To provide physical security for data centers.

Question 3

In a design for a Zero Trust architecture, what is the primary function of the Policy Decision Point (PDP)?

Accepted Answer

To evaluate access requests based on policy. In Zero Trust architecture, the Policy Decision Point (PDP) evaluates access requests against policy, identity, device posture, and context to decide whether to grant, deny, or limit access. It is the brain that makes the authorization decision, which is then enforced by the Policy Enforcement Point (PEP).

Answer

To audit session traffic

Answer

To provide identity management

Answer

To enforce the policy on the endpoint

Question 4

Which document is essential for the SOC to standardize how they handle identified security incidents?

Accepted Answer

Incident Response Plan (IRP).. The Incident Response Plan (IRP) is the document that standardizes how a SOC detects, responds to, and recovers from security incidents. It defines roles, escalation paths, communication procedures, and step-by-step playbooks, ensuring a consistent and repeatable response. This makes it the essential reference for incident handling.

Answer

Vulnerability Assessment Report.

Answer

Vendor Product Data Sheets.

Answer

Network Topology Map.

Question 5

In an AI-based security architecture, which data source provides the most value for training an ML model to detect unauthorized data exfiltration?

Accepted Answer

NetFlow/IPFIX logs. NetFlow/IPFIX logs provide detailed metadata about network flows, including source/destination IPs, ports, protocols, and byte counts, which are highly valuable for training ML models to detect data exfiltration patterns (e.g., large transfers to unusual destinations). This data source captures the network behavior necessary to identify anomalies indicative of exfiltration.

Answer

User password history

Answer

System process logs

Answer

DHCP lease logs

Question 6

Which THREE of the following represent common challenges when implementing automated security in a legacy environment?

Accepted Answer

Cultural resistance to change. Cultural resistance to change (A) is a correct challenge because security automation alters established operational workflows and requires staff to trust tooling over manual, experience-based procedures, and legacy IT teams often resist ceding control to automated remediation. Fragmented or inconsistent log data (D) is correct because legacy systems frequently emit proprietary or non-standard formats (e.g., syslog variants, flat files, no CEF/LEEF normalization), which breaks correlation, SIEM ingestion, and automated event-driven response. Lack of native API support in legacy devices (E) is correct because many older appliances and applications expose only CLI, SNMP, or screen-scraping interfaces rather than REST/SOAP APIs, forcing brittle scripting and preventing clean integration with orchestration and SOAR platforms. Option B is not a challenge in this context, since documentation is generally beneficial and not a barrier to automation, and option C is incorrect because excessive API performance is a benefit, not a problem — the real legacy issue is the absence or poor performance of APIs.

Answer

Too much documentation

Answer

Excessive API performance

Question 7

When designing a secure API environment, which THREE tasks should the API Gateway handle? (Choose THREE)

Accepted Answer

Authentication and authorization verification. Option B is correct because the API Gateway is the central entry point for all client requests, so it should verify authentication tokens (e.g., JWT, OAuth 2.0 access tokens) and enforce authorization policies before forwarding traffic to backend services. Option C is correct because the gateway's core function is to route incoming requests to the appropriate backend microservices based on path, host, headers, or other routing rules, acting as a reverse proxy. Option D is correct because the gateway should enforce request rate limiting (e.g., token bucket or leaky bucket algorithms) to protect backend services from abuse, DoS attacks, and traffic spikes. Option A is not correct because application data storage belongs to backend databases or storage services, not the API Gateway, which should remain stateless. Option E is not correct because hard-coding all business logic in the gateway creates a monolithic bottleneck and violates microservice separation of concerns; business logic belongs in the backend services.

Answer

Application data storage

Answer

Hard-coding all business logic

Question 8

During a risk assessment, which THREE factors are considered critical for determining the design requirements of a secure infrastructure? (Choose three)

Accepted Answer

Regulatory and compliance requirements. Option A (Regulatory and compliance requirements) is correct because laws and standards such as GDPR, HIPAA, PCI DSS, or ISO 27001 impose mandatory controls (encryption, access logging, retention) that directly shape the architecture and security baselines of the infrastructure. Option C (Current threat intelligence and landscape) is correct because knowing the active threat actors, TTPs, and emerging vulnerabilities (e.g., from MITRE ATT&CK or CVE feeds) determines which defensive controls, segmentation, and monitoring capabilities must be designed in. Option E (Criticality of business data and assets) is correct because classifying data and assets by business impact drives the required protection level, such as tiered controls, redundancy, and recovery objectives (RTO/RPO) for the most critical systems. Option B is not a security design driver, since office location and square footage are facilities-planning details rather than risk factors affecting control selection. Option D is also not relevant, as headcount and department budget are organizational and financial inputs, not determinants of the technical security requirements themselves.

Answer

Office physical location and square footage

Answer

Employee headcount and department budget

Question 9

You are designing an API security strategy. Which mechanism is used to verify the integrity and authenticity of API requests in a microservices environment?

Accepted Answer

JSON Web Tokens (JWT). JSON Web Tokens (JWT) are signed (and optionally encrypted) tokens that carry claims about the caller and can be cryptographically verified by any microservice using the issuer's public key. This signature verification provides both integrity (the token was not tampered with) and authenticity (it was issued by a trusted identity provider), which is exactly what is needed to validate API requests in a distributed microservices environment. JWTs are stateless, so each service can verify them independently without a central session store.

Answer

SSL/TLS termination at the server

Answer

Static IP allowlisting

Answer

Standard Basic Authentication

Question 10

You are designing a microsegmentation strategy using Cisco Secure Workload (formerly Tetration) for a multi-tier application. Which mechanism allows you to enforce fine-grained security policies between application tiers while maintaining visibility across the hybrid cloud?

Accepted Answer

Using policy-based agents on endpoints to enforce segmentation. Cisco Secure Workload uses lightweight software agents installed on workloads (servers, VMs, containers) that enforce microsegmentation policies at the workload level, independent of the underlying network. These agents provide visibility into all flows (including east-west traffic within the same subnet) and enforce fine-grained allow/deny policies between application tiers. Because enforcement is host-based, the same policy model works across on-premises, private cloud, and public cloud environments, which is essential for hybrid cloud visibility and control.

Answer

Applying static ACLs on the core switch

Answer

Implementing Cisco ASA zone-based firewalling

Answer

Configuring VRF-Lite on the distribution layer

Question 11

You are designing an email security gateway deployment. What is the benefit of using Cisco Secure Email's 'Outbreak Filters'?

Accepted Answer

It provides predictive protection for zero-day threats. Cisco Secure Email's Outbreak Filters provide predictive protection for zero-day threats by using Cisco Talos threat intelligence and real-time reputation/behavioral analysis to catch malicious messages before signatures are available. They can hold suspicious messages for a short period while Talos analyzes them, then release or quarantine based on the verdict. This 'predictive' capability is what distinguishes Outbreak Filters from standard anti-spam or antivirus.

Answer

It blocks spam based on reputation

Answer

It archives email for compliance

Answer

It encrypts outgoing email

Question 12

What is the purpose of 'Microsegmentation' in a cloud-native architecture?

Accepted Answer

To reduce the attack surface by isolating workloads. Microsegmentation's core security purpose is to reduce the attack surface by isolating workloads from one another, so that a compromise of one workload cannot freely reach others. It enforces least-privilege east-west traffic policies at the workload level rather than relying on perimeter firewalls. This directly limits lateral movement and blast radius within a cloud-native environment.

Answer

To automatically scale services based on demand

Answer

To provide high availability for the service

Answer

To optimize container scheduling

Question 13

Which Cisco solution is primarily designed to provide visibility and protection for SaaS applications like Office 365, Salesforce, and Slack?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is a cloud access security broker (CASB) that provides visibility into and control over SaaS application usage, including Office 365, Salesforce, and Slack. It uses APIs to monitor user activity, detect data exfiltration, and enforce data loss prevention (DLP) policies specifically for cloud applications. Unlike network-based solutions, Cloudlock operates at the application layer, offering granular SaaS security without requiring traffic redirection.

Answer

Cisco Secure Workload

Answer

Cisco Secure Firewall

Answer

Cisco Umbrella

Question 14

When designing a secure remote access solution for a hybrid workforce, which Cisco AnyConnect feature should be prioritized to reduce the attack surface by verifying the posture of the device before granting access?

Accepted Answer

AnyConnect Posture Module.. The AnyConnect Posture Module is the component that performs endpoint posture assessment (hostscan) before or during VPN session establishment, checking for antivirus, firewall, OS patches, and other compliance criteria. It is the mechanism that reduces attack surface by ensuring only compliant devices are granted access, feeding results into DAP for enforcement.

Answer

IKEv2 protocol support.

Answer

Split-tunneling.

Answer

Dynamic Access Policies (DAP).

Question 15

When designing a secure management plane, why is it critical to use a dedicated Out-of-Band (OOB) network?

Accepted Answer

To prevent management plane saturation during a data plane DoS attack.. A dedicated Out-of-Band (OOB) management network physically or logically separates management traffic from production data traffic. When a data plane DoS attack saturates the production links, in-band management would become unreachable, preventing administrators from responding. OOB preserves management access so remediation can occur even under active attack.

Answer

To reduce the cost of cabling.

Answer

To increase the throughput of user traffic.

Answer

To allow for DHCP-based addressing of management interfaces.

Question 16

Which THREE features of Cisco Secure Email help in mitigating email-based threats? (Select 3)

Accepted Answer

Cisco Threat Grid sandboxing. Cisco Threat Grid sandboxing (C) is correct because it detonates suspicious attachments and URLs in an isolated environment to observe malicious behavior and derive verdicts, which is a core defense against weaponized email content. Outbreak filters (D) are correct because they use real-time threat intelligence to quarantine or delay suspicious messages during the early hours of a new outbreak, before traditional signature-based antivirus can catch them. SenderBase reputation service (E) is correct because it evaluates the reputation of sending IP addresses and domains to block or throttle mail from known spam and malware sources at the connection level. DHCP snooping (A) and VLAN isolation (B) are Layer 2 network access controls for switches and are not email security features, so they do not belong in this scenario.

Answer

DHCP snooping

Answer

VLAN isolation

Question 17

Which THREE factors are required to ensure the successful deployment of a Zero Trust microsegmentation architecture? (Choose THREE)

Accepted Answer

A centralized, automated enforcement policy engine. Option B is correct because Zero Trust microsegmentation depends on a centralized, automated enforcement policy engine (e.g., a policy controller/management plane) that consistently translates identity- and context-based rules into allow/deny decisions across all workloads without manual per-host configuration. Option C is correct because you cannot segment what you cannot see: complete visibility into every communication flow (east-west and north-south, typically via flow logs, packet inspection, or agents) is required to baseline legitimate traffic and detect anomalies. Option D is correct because identifying and classifying all workloads (by application, owner, sensitivity, and tags/labels) is the prerequisite for defining meaningful microsegmentation policies and grouping assets into segments. Option A is not correct because a flat network architecture is the opposite of what microsegmentation requires — it removes the internal boundaries that segmentation is meant to create. Option E is not correct because shared administrative credentials violate Zero Trust least-privilege and per-identity authentication principles, increasing lateral movement risk rather than enabling secure deployment.

Answer

A flat network architecture

Answer

Shared administrative credentials for all servers

Question 18

Which THREE of the following are best practices for securing a CI/CD pipeline itself?

Accepted Answer

Scan the pipeline code for vulnerabilities. Option B is correct because scanning the pipeline's own code (e.g., Jenkinsfiles, GitLab CI YAML, GitHub Actions workflows) with SAST/SCA tools detects injection flaws, insecure plugin usage, and vulnerable dependencies before they can be exploited to compromise builds. Option C is correct because isolated, ephemeral build runners (fresh containers or VMs destroyed after each job) prevent cross-job contamination, credential persistence, and lateral movement if a build is compromised. Option D is correct because a dedicated secret management service (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) provides encrypted storage, access control, auditing, and rotation of credentials instead of hardcoding them in pipeline files or environment variables. Option A is wrong because granting root access to all developers violates least privilege and massively expands the attack surface. Option E is wrong because unencrypted communication channels expose credentials, artifacts, and source code to interception; TLS should be enforced everywhere.

Answer

Allow root access to all developers

Answer

Use unencrypted communication channels

Question 19

Which design principle should be followed when implementing micro-segmentation in a data center?

Accepted Answer

Implement identity-based segmentation at the workload level.. Micro-segmentation is designed to enforce least-privilege east-west traffic controls at the granularity of individual workloads, not network topology. Identity-based segmentation at the workload level ties policy to the workload's identity (labels, tags, service accounts, or attributes) rather than to mutable network constructs like IP addresses or VLANs. This allows policies to follow the workload across hosts, clusters, and clouds, which is the core design principle behind Cisco Secure Workload, ACI, and zero-trust architectures.

Answer

Keep all servers in the same VLAN for simplicity.

Answer

Segment based only on IP addresses.

Answer

Disable all firewalls for maximum performance.

Question 20

Which TWO methods are used by Cisco Stealthwatch to detect anomalies in network traffic?

Accepted Answer

Behavioral baseline modeling of host and network patterns.. Cisco Stealthwatch detects anomalies primarily through behavioral baseline modeling (option C), which learns normal host and network communication patterns over time and then flags deviations such as unusual traffic volumes, new peer connections, or atypical protocol usage. It also relies on analysis of NetFlow, IPFIX, and other flow telemetry (option D), since flow records exported by routers and switches provide the scalable metadata Stealthwatch uses for visibility and threat detection. These two methods work together: flow telemetry supplies the data, and behavioral baselining turns it into anomaly alerts. Signature-based matching for every packet (A) and deep packet inspection of every payload byte (B) describe intrusion prevention or full-packet inspection approaches, not Stealthwatch's flow-based analytics. Manual input of all known malicious IP addresses (E) is not a detection method, as Stealthwatch does not depend on manually enumerating every bad IP.

Answer

Signature-based matching for every packet.

Answer

Deep packet inspection of every payload byte.

Answer

Manual input of all known malicious IP addresses.