SDSI Practice Exam 4 — 20 Questions

Question 1

A design requirements document specifies a need for 'Network Segmentation' to contain breaches. Which Cisco technology provides the best granular control using Scalable Group Tags (SGTs)?

Accepted Answer

Cisco TrustSec (SGTs).. Cisco TrustSec with Scalable Group Tags (SGTs) provides the best granular control for network segmentation by enabling identity-based micro-segmentation. SGTs allow policies to be enforced based on group membership rather than IP addresses, which is more scalable and dynamic, effectively containing breaches by limiting lateral movement.

Answer

Cisco Secure Firewall interface zones.

Answer

VLAN-based segmentation.

Answer

Cisco Umbrella local policy.

Question 2

When gathering requirements for a security design, a customer specifies they need to automate the containment of infected endpoints discovered by Cisco Secure Endpoint. Which API integration should the architect document?

Accepted Answer

Cisco Secure Endpoint API. The Cisco Secure Endpoint API (formerly AMP for Endpoints) provides programmatic access to endpoint detection and response (EDR) capabilities, including the ability to isolate (contain) an infected endpoint. Since the requirement is to automate containment of endpoints discovered by Cisco Secure Endpoint, the architect must document the Cisco Secure Endpoint API. This API allows security teams to integrate with SIEM/SOAR platforms to trigger isolation actions automatically.

Answer

Cisco Umbrella Investigate API

Answer

Cisco Secure Firewall API

Answer

Cisco ISE REST API

Question 3

When designing for cloud-native API security, which TWO components are critical for ensuring visibility into API traffic? (Choose TWO)

Accepted Answer

API Gateway access logs. Option C (API Gateway access logs) is correct because the API gateway is the ingress point for all API calls, and its access logs capture per-request metadata such as client IP, request path, HTTP method, status code, latency, and API key usage, providing the authoritative audit trail needed for API visibility in cloud-native environments. Option E (Traffic telemetry from the service mesh sidecars) is correct because sidecar proxies (e.g., Envoy in Istio/Linkerd) intercept east-west service-to-service traffic and emit metrics, distributed traces, and L7 request telemetry (via OpenTelemetry, Prometheus, or access logs) that reveal internal API calls the gateway never sees. Option A is wrong because manually reading firewall rules only shows static allow/deny policy, not actual API request behavior or payload-level activity. Option B is wrong because disabling TLS exposes data in transit and violates security best practices; visibility should come from TLS-terminating proxies and observability tooling, not from weakening encryption. Option D is wrong because a physical network tap at the data center core cannot inspect encrypted east-west traffic and is impractical for dynamic, ephemeral cloud-native workloads.

Answer

Manual inspection of firewall rules

Answer

Disabling TLS for easier traffic analysis

Answer

Physical network tap at the data center core

Question 4

Which TWO of the following are true about 'Policy as Code' in Cisco security infrastructure?

Accepted Answer

Policies are stored in version control systems. Option A is correct because Policy as Code treats policy definitions as source artifacts, so they are stored in version control systems such as Git, enabling history, branching, peer review, and rollback. Option E is correct because Policy as Code supports automated testing and validation pipelines (for example, unit tests, linting, and CI checks) that verify policies before deployment, catching errors early. Option B is incorrect because policies are expressed in high-level declarative languages or DSLs (for example, HashiCorp Sentinel, OPA/Rego, or YAML), not assembly language. Option C is incorrect because automated application does not mean unreviewed application; Policy as Code typically includes review and approval gates in the CI/CD pipeline. Option D is incorrect because Policy as Code applies broadly to cloud, on-premises, and hybrid Cisco security infrastructure, not only cloud-native apps.

Answer

Policies are always written in assembly language

Answer

Policies are automatically applied without review

Answer

Policies are only for cloud-native apps

Question 5

Which THREE of the following are considered 'Threat Response' automation actions in a Cisco XDR environment?

Accepted Answer

Blocking a malicious file hash. In Cisco XDR, Threat Response automation actions are the enforcement steps that directly neutralize an identified indicator or compromised asset. Option B, blocking a malicious file hash, is correct because it pushes a hash-based block (e.g., via Cisco Secure Endpoint or Umbrella) so the known-bad file cannot execute or be downloaded again. Option D, blocking a malicious URL, is correct because it enforces a URL/domain block through Secure Internet Gateway or Umbrella DNS/web policies, preventing users from reaching the attacker's infrastructure. Option E, isolating an infected host, is correct because network isolation via Secure Endpoint cuts the endpoint off from the network while keeping the agent connected for investigation and remediation. Option A, sending a company-wide email, is merely a notification/communication step and not an enforcement action, and Option C, rebooting the server hardware, is a disruptive administrative operation that does not itself contain or remediate the threat.

Answer

Sending a company-wide email

Answer

Rebooting the server hardware

Question 6

In a DevSecOps pipeline, what is the benefit of 'Static Application Security Testing' (SAST)?

Accepted Answer

Identifying vulnerabilities in source code. Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing the application, looking for vulnerabilities such as SQL injection, buffer overflows, hardcoded secrets, and insecure API usage. In a DevSecOps pipeline, SAST is typically run early in the CI stage so developers get immediate feedback and can fix issues before code is merged. This shifts security left and reduces the cost of remediation compared to finding flaws in production.

Answer

Managing user passwords

Answer

Encrypting data in transit

Answer

Monitoring live production traffic

Question 7

Which TWO Cisco products are used to achieve 'Zero Trust' for remote users?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco Identity Services Engine (ISE) (B) is correct because it provides the policy decision and enforcement point for Zero Trust, performing identity-based authentication, authorization, posture assessment, and network access control (via RADIUS, 802.1X, and TrustSec/SGT) so that remote users are granted least-privilege access based on identity and device compliance. Cisco AnyConnect (D) is correct because it is the endpoint client that establishes the secure remote-access tunnel (SSL/TLS or IPsec IKEv2) and feeds endpoint posture and identity context into ISE, enabling continuous trust verification for remote users. Cisco Umbrella (A) is a DNS-layer and secure web gateway security service, not the identity/posture policy engine or the remote-access client required for Zero Trust enforcement. Cisco Stealthwatch (C) is network traffic visibility and anomaly detection (flow analysis), and Cisco Secure Email (E) is email security; neither provides the identity-based access control or remote-user tunnel needed for Zero Trust.

Answer

Cisco Umbrella.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Email.

Question 8

When designing a SaaS integration security plan, which THREE types of activities should be regularly reviewed in Cisco Cloudlock? (Choose THREE)

Accepted Answer

User login patterns and anomalies. Option A (User login patterns and anomalies) is correct because Cisco Cloudlock continuously monitors SaaS user behavior and applies User and Entity Behavior Analytics (UEBA) to detect anomalous logins such as impossible travel, brute-force attempts, or compromised credentials. Option C (External file sharing activities) is correct because Cloudlock's Data Loss Prevention (DLP) and sharing-exposure policies flag files shared publicly or with external domains via links, which is a core SaaS data-exfiltration risk that must be reviewed regularly. Option E (Third-party application integration permissions) is correct because Cloudlock's Cloud Security Assessment and app-governance features audit OAuth scopes granted to third-party apps, identifying over-permissioned or risky integrations that could access SaaS data. Option B (Physical building security logs) does not belong because Cloudlock is a cloud-access security broker (CASB) focused on SaaS API activity, not physical access control systems. Option D (Local printer configuration) does not belong because printer settings are endpoint/peripheral concerns outside Cloudlock's SaaS visibility and policy scope.

Answer

Physical building security logs

Answer

Local printer configuration

Question 9

In a SaaS security design, what is the role of a Cloud Access Security Broker (CASB)?

Accepted Answer

To provide visibility and control over SaaS usage. A CASB's core role is to provide visibility and control over SaaS usage — discovering shadow IT, monitoring user activity, enforcing DLP policies, and controlling access based on context. It sits between users and cloud services (via API or inline proxy) to apply security policy consistently across sanctioned and unsanctioned apps. This visibility-and-control function is the defining characteristic of a CASB.

Answer

To manage identity for the cloud

Answer

To act as a firewall for SaaS traffic

Answer

To encrypt end-to-end traffic

Question 10

A design architect is selecting a tool to monitor the security of a hybrid cloud environment. Which Cisco tool provides visibility into both on-premises and cloud (AWS/Azure) traffic flows?

Accepted Answer

Cisco Secure Network Analytics.. Cisco Secure Network Analytics (formerly Stealthwatch) provides network traffic visibility and threat detection across on-premises and hybrid cloud environments, including AWS and Azure. It uses flow telemetry (NetFlow, IPFIX) and behavioral analytics to detect anomalies in both data center and cloud traffic, making it the correct tool for hybrid cloud security monitoring.

Answer

Cisco ISE.

Answer

Cisco Secure Email.

Answer

Cisco Secure Firewall.

Question 11

A manufacturing firm wants to secure IoT devices using Cisco TrustSec. Which mechanism ensures that traffic from IoT sensors is isolated from corporate traffic without relying on complex VLAN/ACL management?

Accepted Answer

Scalable Group Tags (SGTs). Cisco TrustSec uses Scalable Group Tags (SGTs) embedded in the packet (via Cisco Metadata or inline tagging) to enforce group-based policy. IoT sensors are assigned an SGT, and a Security Group ACL (SGACL) on the enforcement device permits or denies traffic based on source/destination tag pairs — no VLANs or IP-based ACLs required. This scales cleanly because policy follows the tag, not the topology.

Answer

Dynamic ARP Inspection

Answer

Private VLANs (PVLANs)

Answer

VLAN Trunking Protocol

Question 12

Which tool provides visibility into encrypted traffic without full decryption in a Cisco network design?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) is designed to identify malware and threats in encrypted traffic without full decryption by using flow metadata, sequence of packet lengths and times (SPLT), and machine learning. It leverages Cisco's Talos threat intelligence and can run on Catalyst switches and ISR/ASR routers. Firepower IPS, ISE, and Stealthwatch do not provide ETA's decryption-free encrypted traffic analysis.

Answer

Cisco Firepower IPS.

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco Stealthwatch.

Question 13

What is the benefit of integrating Cisco Secure Email with Cisco Threat Intelligence (Talos)?

Accepted Answer

It provides real-time threat intelligence for filtering.. Integrating Cisco Secure Email with Cisco Talos provides real-time threat intelligence that feeds directly into the email filtering pipeline. Talos continuously analyzes global email traffic, malware campaigns, and phishing infrastructure, and pushes that intelligence to Secure Email so messages can be blocked or quarantined based on current threat data rather than static signatures. This dynamic, reputation-based filtering is the core security benefit of the integration.

Answer

It increases email storage capacity.

Answer

It creates automated email backups.

Answer

It allows for remote administration of the email server.

Question 14

During a post-incident review, an architect discovers that the SOC could not correlate logs across the Cisco Secure Email and Cisco Secure Endpoint platforms. Which integration should the design specify to improve future incident response?

Accepted Answer

Cisco Security Cloud Control (SecureX). Cisco Security Cloud Control (formerly SecureX) is the platform that aggregates telemetry from Cisco Secure Email, Secure Endpoint, Secure Firewall, and other products into a unified incident view. It enables cross-platform correlation, threat hunting, and automated response workflows, directly solving the SOC's inability to correlate logs across email and endpoint.

Answer

Cisco Webex Control Hub

Answer

Cisco DNA Center

Answer

Cisco ThousandEyes

Question 15

A security designer is choosing a tool for DNS-layer security. Which Cisco product is the standard choice?

Accepted Answer

Cisco Umbrella.. Cisco Umbrella is Cisco's cloud-delivered DNS-layer security platform, blocking malicious domains and IPs before a connection is established. It is the standard Cisco product for DNS-layer security, providing recursive DNS with threat intelligence from Cisco Talos. This makes it the correct choice for DNS-layer protection.

Answer

Cisco Secure Endpoint.

Answer

Cisco ISE.

Answer

Cisco Secure Firewall.

Question 16

Which protocol is used for the control plane communication between Cisco SD-WAN controllers?

Accepted Answer

OMP.. Cisco SD-WAN uses the Overlay Management Protocol (OMP) for control plane communication between SD-WAN controllers (vManage, vBond, vSmart) and between controllers and WAN edge devices. OMP carries routing information, policy, and TLOC (transport locator) attributes, forming the overlay control plane that enables SD-WAN's dynamic path selection.

Answer

EIGRP.

Answer

BGP.

Answer

OSPF.

Question 17

What is the primary function of the 'AnyConnect' (Secure Client) profile?

Accepted Answer

To manage connection and security settings for the endpoint.. The AnyConnect (Secure Client) profile is an XML file that defines how the endpoint's VPN client behaves, including connection entries, authentication methods, split tunneling, and security settings. It is pushed from the headend (ASA or FTD) to the client, allowing centralized management of connection and security policies. This makes option A correct because the profile's primary function is to manage connection and security settings for the endpoint.

Answer

To act as an identity provider.

Answer

To store user credentials.

Answer

To monitor CPU usage on the host.

Question 18

Which THREE design principles are key for a multi-cloud security strategy?

Accepted Answer

Consistent security policies across environments.. Option B is correct because a multi-cloud security strategy requires consistent security policies across environments, so that the same access control, inspection, and segmentation rules are enforced uniformly in AWS, Azure, GCP, and on-premises rather than drifting per provider. Option D is correct because unified threat visibility aggregates logs, events, and telemetry from all clouds into a single view, enabling correlation and detection of threats that span multiple providers instead of relying on fragmented per-cloud consoles. Option E is correct because a centralized management plane such as Cisco Firepower Management Center (FMC) lets administrators define policy once and push it to firewalls and sensors across clouds, which is the practical mechanism for achieving the consistency and visibility described above. Option A is not correct because using different, uncoordinated security tools per cloud creates policy gaps and operational complexity, which is the opposite of a sound multi-cloud design. Option C is not correct because allowing all cross-cloud traffic violates least-privilege and zero-trust principles; cross-cloud flows should be explicitly permitted, inspected, and segmented.

Answer

Using different security tools for each cloud.

Answer

Allowing all cross-cloud traffic.

Question 19

An organization experiences a breach where a malicious file was downloaded. Which Cisco product can be used to perform 'retrospective' analysis on that file's history across the organization?

Accepted Answer

Cisco Secure Endpoint (AMP).. Cisco Secure Endpoint (formerly AMP for Endpoints) maintains a cloud-based file reputation and retrospective analysis capability. When a file is later determined to be malicious, Secure Endpoint can retroactively query its telemetry to identify every endpoint where that file was seen, enabling retrospective detection and response. Stealthwatch is network flow analytics, Secure Email handles email-borne threats, and Umbrella is DNS-layer security — none provide endpoint file-history retrospective analysis.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Email.

Answer

Cisco Umbrella.

Question 20

In DevSecOps, what is the role of an 'Artifact Repository' such as Artifactory in relation to security?

Accepted Answer

Store and secure immutable build artifacts. An artifact repository like Artifactory stores and secures immutable build artifacts, providing a trusted source of truth for binaries, container images, and packages. It supports security through access controls, vulnerability scanning integration, and immutability guarantees that prevent tampering with released artifacts. This makes it a critical control point in the DevSecOps supply chain.

Answer

Manage user identities

Answer

Monitor real-time network traffic

Answer

Execute live security testing