SDSI Practice Exam 4 — 20 Questions

Question 1

An organization experiences a surge in successful phishing attacks. The post-incident architecture adaptation requires automated email analysis. Which Cisco product provides the necessary API for integrating email sandboxing data into a SOAR platform?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco Secure Email API.. Cisco Secure Email (formerly ESA) offers extensive APIs for extracting threat intelligence and sandboxing results from Advanced Malware Protection (AMP).

Answer

Cisco Firepower Management Center REST API.

Answer

Cisco Defense Orchestrator API.

Answer

Cisco Identity Services Engine ERS API.

Question 2

A security architect is developing a requirements document for a SOC. Which Cisco capability allows the SOC to prioritize alerts by correlating threats across network, endpoint, and cloud?

Accepted Answer

Cisco SecureX cross-product correlation.. Cisco SecureX provides cross-product correlation to reduce alert fatigue and prioritize incidents.

Answer

Cisco Stealthwatch alert grouping.

Answer

Cisco Secure Firewall management center alert correlation.

Answer

Cisco Identity Services Engine monitoring.

Question 3

An architect is reviewing post-incident logs in Cisco SecureX. Which feature allows the analyst to see the timeline of events from different integrated products in one view?

Accepted Answer

SecureX Incident/Event Timeline.. The 'Incident' or 'Timeline' view in SecureX aggregates all related events across the Cisco security stack.

Answer

Stealthwatch Alarms view.

Answer

FMC Event Viewer.

Answer

ISE Auth Reports.

Question 4

When conducting a risk assessment, what is the best way to determine the value of an asset to the organization?

Accepted Answer

Perform a Business Impact Analysis (BIA).. The business impact analysis (BIA) is the standard method for determining asset value.

Answer

Check the manufacturer's list price.

Answer

Ask the IT department for their opinion.

Answer

Check the hardware replacement cost.

Question 5

Which THREE actions are recommended when designing a secure API architecture using Cisco API Security to mitigate OWASP API Top 10 threats? (Choose THREE)

Accepted Answer

Implement strict schema validation on all incoming API requests. Mitigation requires visibility, schema validation, and behavioral analysis to stop common attacks like BOLA and excessive data exposure.

Answer

Allow all API traffic to bypass authentication for performance

Answer

Disable all logging of API request headers

Question 6

Which THREE criteria should be used to design microsegmentation policies in Cisco Secure Workload? (Choose THREE)

Accepted Answer

Workload attributes and labels (metadata). Effective microsegmentation policies rely on workload identity, application context, and observed communication patterns rather than just IP addresses.

Answer

Physical switch port IDs

Answer

Dynamic IP addresses of the servers

Question 7

Which Cisco API Security feature is used to prevent attackers from using automated scripts to brute-force API endpoints?

Accepted Answer

API rate limiting and behavioral analytics. Rate limiting and behavioral analysis are the primary tools to stop automated script attacks against API endpoints.

Answer

DNS-layer filtering

Answer

JWT token encryption

Answer

Schema validation

Question 8

Which security design decision is most critical when migrating an application to the cloud, specifically regarding API security?

Accepted Answer

Implementing API security and identity-based access at the application layer. When moving to the cloud, the perimeter dissolves. You must transition from perimeter-based security to a model that secures the APIs themselves, regardless of where they are accessed from.

Answer

Relying on the cloud provider's firewall

Answer

Maintaining a VPN tunnel to the on-premise data center

Answer

Disabling all API endpoints that are not internal

Question 9

When designing for cloud-native API security, which TWO components are critical for ensuring visibility into API traffic? (Choose TWO)

Accepted Answer

API Gateway access logs. Visibility into APIs requires capturing traffic at the gateway and analyzing logs to map the flow and identify potential threats.

Answer

Manual inspection of firewall rules

Answer

Disabling TLS for easier traffic analysis

Answer

Physical network tap at the data center core

Question 10

What is the primary design benefit of deploying Cisco Secure Workload as a 'software-only' solution in a public cloud environment?

Accepted Answer

It provides consistent security enforcement without relying on physical network appliances. It allows the organization to utilize native cloud features while maintaining consistent security policy across clouds without the latency of hair-pinning traffic to a physical appliance.

Answer

It reduces the need for VPC configuration

Answer

It guarantees 100% protection against all malware

Answer

It automates the creation of virtual machines

Question 11

A security design architect needs to ensure that all endpoints have the latest malware signatures. Which tool provides continuous, automated updates?

Accepted Answer

Cisco Secure Endpoint.. Cisco Secure Endpoint automatically updates its malware definitions from Cisco Talos.

Answer

Cisco Secure Firewall.

Answer

Cisco ISE.

Answer

Cisco Umbrella.

Question 12

An enterprise is migrating legacy apps to a cloud-native architecture. You need to secure inter-service communication. Which Cisco solution provides mutual TLS and fine-grained access control using sidecar proxies?

Accepted Answer

Cisco Service Mesh Manager. Cisco Service Mesh Manager (based on Istio) provides mTLS and traffic management via sidecar proxies.

Answer

Cisco Umbrella SIG

Answer

Cisco Secure Application for AppDynamics

Answer

Cisco Secure Firewall

Question 13

In a Cisco Container Platform (CCP) environment, you need to ensure that pod-to-pod traffic within the same namespace is inspected for malicious patterns. Which design decision satisfies this requirement?

Accepted Answer

Deploy a service mesh to implement mutual TLS and traffic monitoring. Service meshes like Istio (integrated with Cisco Service Mesh Manager) allow for mTLS and traffic inspection between microservices.

Answer

Use Kubernetes Network Policies to drop traffic

Answer

Implement a Cisco Firepower NGIPS at the perimeter

Answer

Redirect all inter-pod traffic to an external load balancer

Question 14

When designing for API security, how does Cisco API Security provide protection against 'Excessive Data Exposure' vulnerabilities?

Accepted Answer

By analyzing response schemas to detect sensitive data in API payloads. Cisco API Security analyzes response bodies to detect if sensitive information (like PII) is being returned in fields that shouldn't contain it.

Answer

By implementing strict rate limiting on all users

Answer

By automatically blocking all outgoing API traffic

Answer

By replacing all API keys with OAuth tokens

Question 15

Which design principle is essential when building an API Gateway for high-security environments?

Accepted Answer

Centralized security enforcement at the ingress layer. High-security gateways must perform request validation, authentication, and policy enforcement at the ingress, before any traffic hits the backend services.

Answer

Direct routing to services without inspection

Answer

Allowing the backend to perform all security checks

Answer

Encrypting traffic only when it leaves the data center

Question 16

When designing security for SaaS applications, what is the primary benefit of an API-based CASB like Cisco Cloudlock over a proxy-based CASB?

Accepted Answer

API-based does not require routing user traffic through the CASB. API-based CASBs can monitor data at rest and provide deeper remediation without requiring users to route their traffic through a proxy, which is ideal for cloud-first environments.

Answer

Proxy-based is cheaper

Answer

API-based only works on-premises

Answer

Proxy-based is always faster

Question 17

What is the primary benefit of 'Visibility' in the Cisco API Security architecture?

Accepted Answer

Identification of all APIs and shadow endpoints. Visibility allows you to see all your API endpoints, including shadow APIs, which is the necessary first step for any security strategy.

Answer

Automatic translation of API code

Answer

Reduction of API storage costs

Answer

Increased performance of the API calls

Question 18

An organization is deploying APIs on AWS and using Cisco API Security to protect them. The security team needs to detect 'Shadow APIs' that are being called but are not registered in the API documentation. How should the solution be configured?

Accepted Answer

Integrate API Security with the cloud traffic logs to perform behavior analysis and discovery. Cisco API Security performs discovery by analyzing traffic logs and API calls to identify endpoints that are active but missing from the defined schema.

Answer

Manually add every route to the Swagger documentation file

Answer

Configure OAuth scopes to restrict access to the API Gateway

Answer

Enable WAF block mode for all undefined routes

Question 19

When designing an API security architecture, what is the primary purpose of 'API Discovery' in the context of Cisco API Security?

Accepted Answer

To inventory all API endpoints and identify shadow or undocumented APIs. API Discovery identifies all API endpoints in an environment to ensure that security policies can be applied to undocumented or shadow APIs.

Answer

To replace the need for API gateways

Answer

To increase the API's performance

Answer

To automatically generate API documentation for developers

Question 20

What is the purpose of 'Microsegmentation' in a cloud-native architecture?

Accepted Answer

To reduce the attack surface by isolating workloads. Microsegmentation provides granular security by isolating workloads so that traffic is only allowed if explicitly required, reducing the attack surface.

Answer

To automatically scale services based on demand

Answer

To provide high availability for the service

Answer

To optimize container scheduling