SDSI Practice Test 21 — 15 Questions

Question 1

In the context of AI-driven security, what does 'False Positive Reduction' primarily achieve?

Accepted Answer

Improved analyst efficiency. It minimizes unnecessary alerts, allowing security teams to focus on high-fidelity, real threats.

Answer

Increased hardware throughput

Answer

Lower bandwidth consumption

Answer

Faster packet forwarding

Question 2

When designing an API gateway strategy, why is it important to implement 'Rate Limiting' at the gateway level?

Accepted Answer

To protect backend services from being overwhelmed. Rate limiting at the API gateway caps the number of requests a client can make in a given time window, preventing a single client or botnet from overwhelming backend services. This protects availability, enforces fair usage, and mitigates brute-force and DDoS-style abuse before requests reach the backend.

Answer

To ensure that all users have the same experience

Answer

To increase the speed of the backend services

Answer

To simplify the authentication process

Question 3

Which capability is provided by Cisco Cloudlock's integration with the SaaS platform via API?

Accepted Answer

Visibility and remediation of data sharing and user activity. Cisco Cloudlock is a CASB that connects to SaaS platforms such as Google Workspace, Microsoft 365, and Salesforce via published APIs. Through that API integration it gains visibility into data-at-rest, sharing settings, and user activity, and can then remediate — for example, revoking public share links, quarantining files, or suspending risky accounts — all without inline traffic inspection.

Answer

Hardening of the SaaS application code

Answer

Deep packet inspection of all physical network traffic

Answer

Blocking DNS requests at the ISP level

Question 4

A design requirement specifies that all remote access must be verified through device health checks. Which Cisco tool allows for this posture assessment?

Accepted Answer

Cisco AnyConnect Secure Client with Compliance Module.. Cisco AnyConnect Secure Client with the Compliance Module is the correct answer because it performs endpoint posture assessment before granting remote access. The Compliance Module checks device health attributes such as OS version, antivirus status, and patch level, and reports them to Cisco ISE for policy enforcement. This directly satisfies the requirement that all remote access must be verified through device health checks.

Answer

Cisco Identity Services Engine (ISE) pxGrid.

Answer

Cisco Umbrella roaming client.

Answer

Cisco Secure Firewall VPN portal.

Question 5

An organization experiences a surge in successful phishing attacks. The post-incident architecture adaptation requires automated email analysis. Which Cisco product provides the necessary API for integrating email sandboxing data into a SOAR platform?

Accepted Answer

Cisco Secure Email API.. Cisco Secure Email (formerly Email Security Appliance) provides a dedicated API that exposes email sandboxing verdicts and threat intelligence, enabling SOAR platforms to automate response actions like quarantining malicious messages. The API specifically supports retrieving detailed analysis from Cisco Advanced Malware Protection (AMP) and Threat Grid sandboxing, which is exactly what's needed for post-incident phishing analysis. Other Cisco APIs focus on different security domains (network, policy orchestration, identity) and lack native email sandboxing data.

Answer

Cisco Firepower Management Center REST API.

Answer

Cisco Defense Orchestrator API.

Answer

Cisco Identity Services Engine ERS API.

Question 6

You are tasked with securing a SaaS application. The security policy requires that all documents containing credit card numbers be restricted from external sharing. Which Cloudlock feature is best suited to enforce this?

Accepted Answer

Data Loss Prevention (DLP) engine. Cloudlock's DLP engine is the feature designed to inspect content (including regex-detectable patterns like credit card numbers) and enforce sharing restrictions on SaaS documents. It classifies data at rest and in motion within sanctioned SaaS apps, then applies policy to block or quarantine external sharing of files containing PCI data. This directly satisfies the requirement to restrict documents containing credit card numbers from external sharing.

Answer

User activity monitoring

Answer

Identity and Access Management (IAM) integration

Answer

DNS-layer security

Question 7

Which Cisco platform provides a centralized view of security threats across the entire enterprise?

Accepted Answer

Cisco SecureX.. Cisco SecureX is a cloud-native security platform that integrates with Cisco's security portfolio (e.g., Secure Firewall, Umbrella, AMP) and third-party tools to provide a unified, centralized view of threats across the enterprise. It aggregates and correlates security events, enabling security teams to detect, investigate, and respond to threats from a single dashboard. SecureX is specifically designed for security operations, offering threat hunting, incident response, and automation capabilities.

Answer

Cisco Catalyst Center.

Answer

Cisco Webex Control Hub.

Answer

Cisco DNA Center.

Question 8

A requirement for an incident response toolset is the ability to automatically contain a workstation upon detecting a specific malware threat. Which Cisco tool provides this 'isolate' capability?

Accepted Answer

Cisco Secure Endpoint (AMP).. Cisco Secure Endpoint (formerly AMP for Endpoints) provides endpoint detection and response (EDR) with the ability to isolate a compromised workstation from the network. This 'isolate' capability automatically contains threats upon detection, preventing lateral movement. It is specifically designed for endpoint containment.

Answer

Cisco AnyConnect.

Answer

Cisco Umbrella roaming client.

Answer

Cisco Secure Firewall.

Question 9

Which Cisco feature is used to prevent unauthorized devices from connecting to the wired network by enforcing identity-based access control at the access switch port?

Accepted Answer

802.1X. 802.1X is an IEEE standard for port-based network access control (PNAC) that authenticates devices/users before granting access to the wired or wireless LAN. It uses EAP over LAN (EAPOL) between the supplicant and the authenticator (switch), with RADIUS to the authentication server (e.g., Cisco ISE), enforcing identity-based access at the switch port. This directly matches the requirement of preventing unauthorized devices via identity-based control.

Answer

MAC Authentication Bypass

Answer

Port Security

Answer

DHCP Snooping

Question 10

Which design component is necessary for implementing Cisco TrustSec across a multi-switch campus?

Accepted Answer

SXP (SGT Exchange Protocol).. SXP (SGT Exchange Protocol) is the protocol used to propagate Security Group Tags (SGTs) and the IP-to-SGT bindings from a TrustSec-capable device to devices that cannot natively tag traffic, such as older switches or non-TrustSec network elements. In a multi-switch campus where not every device supports inline tagging, SXP is the necessary design component to carry SGT information across the topology. Without SXP, SGTs cannot be shared with legacy or non-capable devices.

Answer

VLAN Trunking Protocol (VTP).

Answer

LLDP.

Answer

802.1Q.

Question 11

You are designing a SaaS security strategy using Cisco Cloudlock. A user reports that they are seeing alerts for 'unusual geo-location' on their Salesforce account. How does Cloudlock detect this?

Accepted Answer

By using UEBA to baseline and identify anomalous login activity. Cloudlock uses User and Entity Behavior Analytics (UEBA) to establish a baseline of each user's normal login behavior — typical locations, times, devices, and IP ranges — and then flags deviations such as logins from new or unusual geographies as 'unusual geo-location' alerts. This is behavioral anomaly detection, not blanket geo-blocking or device tracking.

Answer

By blocking all international traffic

Answer

By analyzing the user's browser history

Answer

By tracking the user's GPS coordinates on their phone

Question 12

A design requirement for risk mitigation in a data center requires micro-segmentation. Which Cisco technology is specifically designed to provide workload-level segmentation based on identity and policy?

Accepted Answer

Cisco Secure Workload.. Cisco Secure Workload (formerly Tetration) is specifically designed for micro-segmentation at the workload level, using identity-based policies derived from software agents on servers or agentless methods. It provides visibility into application dependencies and enforces granular segmentation based on workload attributes (e.g., process, user, labels) rather than just network addresses. This makes it the correct choice for a requirement that explicitly calls for workload-level segmentation based on identity and policy.

Answer

Cisco Firepower NGFW.

Answer

Cisco AnyConnect.

Answer

Cisco TrustSec/SGTs.

Question 13

Which design pattern best mitigates 'Broken Object Level Authorization' (BOLA) in a RESTful API?

Accepted Answer

Explicit authorization check at every endpoint that accepts an object ID. BOLA occurs when an API endpoint accepts an object ID and returns or modifies the object without verifying that the authenticated user is authorized to access that specific object. The definitive mitigation is an explicit authorization check at every endpoint that accepts an object ID, verifying the caller's ownership or permission on that object before any data is returned or changed. This closes the vulnerability at its root rather than obscuring it.

Answer

Implementing a strong API rate limit

Answer

Using random, non-sequential UUIDs for objects

Answer

Encrypting all API responses

Question 14

Which design factor is most important when deploying a large-scale Cisco Secure Firewall cluster?

Accepted Answer

Ensuring adequate load balancing and capacity planning.. In a large-scale Cisco Secure Firewall cluster, the most important design factor is ensuring adequate load balancing and capacity planning, because cluster throughput, session distribution, and failover behavior depend on how traffic is balanced across nodes and whether each node has sufficient CPU, memory, and interface bandwidth. Without proper capacity planning and load distribution, the cluster becomes a bottleneck or experiences asymmetric flows and failover issues. This directly determines whether the cluster meets performance and availability requirements.

Answer

Ensuring all firewalls have the same firmware version.

Answer

The color of the patch cables used.

Answer

The physical location of the firewalls.

Question 15

Which Cisco feature is designed to protect the control plane of a router from being overwhelmed by traffic?

Accepted Answer

Control Plane Policing (CoPP).. Control Plane Policing (CoPP) is a Cisco IOS feature that allows you to rate-limit traffic destined to the route processor (control plane) of a router. It uses a modular QoS CLI (MQC) policy to classify and police traffic, ensuring that excessive or malicious traffic does not overwhelm the control plane and cause a denial of service. CoPP is specifically designed to protect the control plane, unlike ACLs which filter data plane traffic, or traffic shaping which manages outbound data plane traffic.

Answer

Access Control Lists (ACLs).

Answer

Traffic Shaping.

Answer

NetFlow.