SDSI Practice Test 22 — 15 Questions

Question 1

Which TWO Cisco technologies should be used to protect a data center against lateral movement of threats?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch).. Cisco Secure Network Analytics (Stealthwatch) (B) is correct because it uses NetFlow/IPFIX telemetry and behavioral analytics to detect anomalous east-west traffic inside the data center, which is exactly how lateral movement between workloads appears. Cisco Secure Workload (Tetration) (E) is correct because it provides microsegmentation and workload-level policy enforcement based on application dependencies, allowing you to block unauthorized host-to-host communication that lateral movement relies on. Together these two address detection and prevention of lateral threat movement within the data center. Cisco Umbrella (A) is DNS-layer security focused on internet-bound resolution, not internal east-west traffic. Cisco Secure Email (C) protects against email-borne threats at the gateway, unrelated to lateral movement. Cisco AnyConnect (D) is a VPN/remote-access client for securing user connectivity, not for containing internal data center threats.

Answer

Cisco Umbrella.

Answer

Cisco Secure Email.

Answer

Cisco AnyConnect.

Question 2

Which Cisco technology should be included in an automated design to ensure 'Zero Trust' access for remote developers accessing internal development servers?

Accepted Answer

Cisco Secure Access. Cisco Secure Access is Cisco's cloud-delivered Security Service Edge (SSE) platform that enforces Zero Trust Network Access (ZTNA) for remote users, verifying identity and device posture before granting access to internal applications. It replaces implicit network trust with per-session, least-privilege authorization, which is exactly what remote developers need when reaching internal dev servers. The other options are networking, OS, or collaboration products that do not deliver ZTNA.

Answer

Cisco Catalyst Center

Answer

Cisco IOS-XE

Answer

Cisco Webex

Question 3

Which TWO of the following capabilities does Cisco Secure Firewall (FMC) provide to support automated security workflows?

Accepted Answer

Integration with external Threat Intel feeds. Option A is correct because FMC supports integration with external Threat Intelligence feeds (e.g., via STIX/TAXII or custom feeds) to automatically ingest and apply indicators of compromise, enabling dynamic, automated blocking and detection workflows. Option E is correct because FMC exposes a REST API that allows programmatic management of objects, access control policies, and rules, which is the foundation for automation and orchestration with tools like Ansible, Python scripts, or SOAR platforms. The unmarked options do not belong: FMC is not a container orchestration platform (B), does not perform automated code refactoring (C), and does not include an on-board AI training engine for model development (D); its AI/ML capabilities are for detection, not user-driven model training.

Answer

Native container orchestration

Answer

Automated code refactoring

Answer

On-board AI training engine

Question 4

A security architect is designing a DevSecOps pipeline that integrates Cisco Identity Services Engine (ISE) with a CI/CD system to enforce dynamic network access for build agents. The pipeline must ensure that only compliant build agents can access production deployment targets. Which two design considerations are critical for this integration? (Choose two.)

Accepted Answer

Configure Cisco ISE to use RADIUS Change of Authorization (CoA) to terminate sessions of non-compliant build agents.. The critical design considerations are using Cisco ISE pxGrid to share compliance posture with the CI/CD orchestrator and configuring RADIUS CoA to revoke access for non-compliant agents. Together, they enable dynamic, real-time enforcement that adapts to build agent compliance states, which is essential for secure DevSecOps pipelines. Monitor mode, static MAC filtering, and reliance on orchestrator secrets do not provide the necessary dynamic network enforcement.

Answer

Use static MAC address filtering on switches to identify build agents, and manually update the filter list when new agents are added.

Answer

Rely on the CI/CD orchestrator's built-in secrets management to authenticate build agents, and use network ACLs to restrict access to production.

Answer

Deploy Cisco ISE in monitor mode to log all build agent traffic without enforcing policies, allowing the CI/CD system to make its own access decisions.

Question 5

A retail company is designing a DevSecOps pipeline that uses Cisco Secure Workload to enforce micro-segmentation for its containerized applications. The security team wants to automatically generate and apply micro-segmentation policies based on application behavior observed in the CI/CD environment. Which Cisco Secure Workload capability should be leveraged to achieve this automation?

Accepted Answer

Cisco Secure Workload Policy Lifecycle Management with automatic policy generation. Cisco Secure Workload's Policy Lifecycle Management automates the creation of micro-segmentation policies by analyzing actual workload communications. This capability is designed to continuously discover and recommend policies, which can be automatically applied via integration with CI/CD tools. It directly addresses the need for automated, behavior-based policy generation, reducing manual effort and ensuring policies stay current with application changes.

Answer

Cisco Secure Workload Flow Analytics with manual policy export

Answer

Cisco Secure Workload Enforcement Agent with scripted policy deployment

Answer

Cisco Secure Workload API with third-party orchestration tools

Question 6

A DevSecOps team is designing an automated vulnerability remediation workflow for Cisco Secure Workload. When a new workload with a critical CVE is detected, the workflow must isolate the workload and create a ServiceNow incident without manual intervention. Which Cisco Secure Workload capability should be the foundational integration point for this design?

Accepted Answer

REST API with role-based access control and webhook subscriptions. The REST API with role-based access control and webhook subscriptions is the correct foundational integration point because it enables programmatic, secure, and event-driven automation. It allows the DevSecOps pipeline to detect vulnerabilities, enforce isolation policies, and create ServiceNow incidents without manual steps. Other options are either monitoring-only or local mechanisms that cannot orchestrate cross-system remediation.

Answer

Syslog forwarding to a SIEM with automated correlation rules

Answer

SNMP traps for event notification and automated action triggering

Answer

Cisco Secure Workload agent CLI for local script execution

Question 7

A security architect is reviewing the risk register for a financial services network. A new risk has been identified: unmanaged IoT devices on the corporate LAN could be used as pivot points to reach PCI-scoped servers. The business has mandated that the design must prevent any communication between IoT endpoints and PCI zones, even if the IoT devices are compromised. Which Cisco ISE design element should the architect include to enforce this segmentation requirement?

Accepted Answer

Security Group Tags (SGTs) with enforcement on Cisco Catalyst switches using SGACL policies. The requirement is to prevent any communication between IoT and PCI zones, even if IoT devices are compromised. Security Group Tags (SGTs) with SGACL enforcement on Cisco Catalyst switches provide identity-based micro-segmentation directly on the network fabric, ensuring that traffic from IoT-tagged devices to PCI-tagged resources is blocked regardless of IP address changes. This is a core Cisco TrustSec design pattern for regulatory compliance and least-privilege access.

Answer

802.1X with MAC Authentication Bypass (MAB) to profile and authorize IoT devices

Answer

Cisco TrustSec policy with Security Group ACLs applied on the Cisco Secure Firewall

Answer

Change of Authorization (CoA) to dynamically reassign IoT devices to a quarantine VLAN

Question 8

A network security designer is planning a Cisco Identity Services Engine deployment for a large campus with 20,000 endpoints. The design requires high availability and the ability to enforce differentiated authorization policies for wired and wireless users. Which design approach best meets these requirements while minimizing single points of failure?

Accepted Answer

Deploy a distributed ISE deployment with two Policy Administration Nodes and multiple Policy Service Nodes in different locations.. A distributed ISE deployment with redundant PANs and multiple PSNs provides the high availability and scalability required for a large campus. PSNs handle authentication and authorization, while PANs manage configuration and policy. This separation allows differentiated policies for wired and wireless users and eliminates single points of failure.

Answer

Deploy two standalone ISE nodes and configure them as a failover pair using VRRP.

Answer

Deploy a single ISE node with a large VM and enable all personas on the same node.

Answer

Deploy a single standalone ISE node with a backup database.

Question 9

You are designing an application security architecture for a web application that will be published to the internet through a Cisco Application Centric Infrastructure (ACI) fabric with a Cisco Secure Firewall cluster. The application uses a monolithic architecture and stores session state in a database. The security team wants to ensure that only valid HTTP methods and headers are accepted, and that malformed requests are dropped before reaching the application servers. Which design element should you include?

Accepted Answer

A Cisco ACI service graph that inserts a Cisco Secure Firewall between the web and application tiers with a custom Snort rule validating HTTP methods and headers.. To validate HTTP methods and headers before traffic reaches application servers, you need a Layer 7 inspection point. A Cisco ACI service graph can steer traffic through a Cisco Secure Firewall, where a custom Snort rule enforces the allowed methods and header formats. This design integrates network segmentation with deep packet inspection, ensuring malformed requests are dropped at the firewall rather than consuming application resources.

Answer

Cisco Identity Services Engine (ISE) posture assessment for all external users to verify their devices meet security policies.

Answer

A Cisco Secure Firewall access control policy with URL filtering to block requests to known malicious domains.

Answer

Cisco Umbrella DNS-layer security to block requests to the application's domain if the request contains a suspicious User-Agent header.

Question 10

A network security designer is implementing Cisco TrustSec in a campus network to enforce segmentation based on user roles. The design requires that traffic between different security groups be controlled by a centralized policy. Which component is responsible for defining and distributing the security group tags (SGTs) and policies?

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco ISE is the centralized policy engine for TrustSec, responsible for defining and distributing security group tags (SGTs) and security group ACLs (SGACLs). It authenticates users and assigns SGTs, enabling role-based segmentation. Other components like DNA Center, Stealthwatch, and FMC have different roles and do not define TrustSec policies.

Answer

Cisco DNA Center

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Stealthwatch

Question 11

A network security designer is planning segmentation for a new data center that uses Cisco Nexus switches with Cisco Application Centric Infrastructure (ACI). The design must enforce east-west microsegmentation between web, app, and database endpoint groups (EPGs) based on Layer 4 ports and allow a security team to insert a service graph for inspection. Which ACI construct should be used to define the permitted communication?

Accepted Answer

Contracts with filters applied between EPGs. Cisco ACI uses contracts to define allowed communication between EPGs. Contracts contain subjects and filters that specify Layer 3 and Layer 4 parameters, enabling precise east-west microsegmentation. They also support service graph insertion, allowing a firewall or load balancer to be inserted between EPGs for inspection. The other constructs address connectivity, isolation, or fabric access but do not provide the required port-level policy and service insertion.

Answer

VRF instances with route leaking between tenants

Answer

Tenant policies with external routed networks and L3Outs

Answer

Access policies with VLAN pools and interface profiles

Question 12

A security architect is designing a risk mitigation strategy for a network that must comply with PCI DSS. The design must ensure that all cardholder data environment (CDE) traffic is segmented from the corporate network and that any violation of segmentation policy triggers an immediate alert. Which Cisco solution should be used to achieve both micro-segmentation and policy violation alerting?

Accepted Answer

Cisco Secure Workload. The requirement is for micro-segmentation of the CDE with immediate alerting on policy violations. Cisco Secure Workload provides agent-based or agentless micro-segmentation that maps workload dependencies and enforces granular policies. It continuously monitors for violations and can generate alerts, ensuring PCI DSS compliance and rapid response to segmentation breaches.

Answer

Cisco Secure Firewall with access control policies

Answer

Cisco Identity Services Engine (ISE) with TrustSec

Answer

Cisco Nexus Dashboard with network segmentation

Question 13

A security architect is documenting security requirements for a new data center design. The requirements must include a control that provides visibility into all traffic flows, including those between virtual machines, and can detect advanced threats using behavioral analysis. Which Cisco solution should be included in the design to meet these requirements?

Accepted Answer

Cisco Secure Network Analytics. The design requires visibility into all traffic flows, including inter-VM, and behavioral analysis for advanced threats. Cisco Secure Network Analytics collects telemetry from network infrastructure and virtual switches, applying behavioral analytics to detect anomalies. It provides the necessary visibility and threat detection capabilities for the data center environment.

Answer

Cisco Umbrella Investigate

Answer

Cisco Identity Services Engine

Answer

Cisco Secure Firewall Management Center

Question 14

A security architect is designing a solution to meet a regulatory requirement that all administrative access to network devices must be authenticated with multi-factor authentication (MFA) and that all commands executed by administrators must be logged and auditable. Which Cisco solution should be integrated into the design?

Accepted Answer

Cisco Identity Services Engine (ISE) with TACACS+ and external MFA integration. The requirement is for MFA and command auditing for network device administrative access. Cisco ISE with TACACS+ provides centralized device administration, integrates with MFA providers, and logs all commands. This meets the regulatory requirements for authentication and auditability.

Answer

Cisco Secure Firewall Management Center with RADIUS authentication

Answer

Cisco Umbrella with Active Directory integration

Answer

Cisco Secure Network Analytics with LDAP authentication

Question 15

You are designing a secure API gateway architecture for a financial institution using Cisco API Security. The design must protect against OWASP API Security Top 10 threats, specifically Broken Object Level Authorization (BOLA) and Excessive Data Exposure. Which TWO design controls should you implement to mitigate these threats? (Choose two.)

Accepted Answer

Implement response filtering to remove sensitive data fields from API responses based on the user's role and the principle of least privilege.. Broken Object Level Authorization is mitigated by enforcing object-level authorization checks at the API gateway, ensuring users can only access resources they are permitted to. Excessive Data Exposure is mitigated by response filtering, which removes sensitive fields based on user role and least privilege. Together, these controls address the two specific OWASP API Security Top 10 threats mentioned.

Answer

Enable mutual TLS (mTLS) between the API client and the API gateway to ensure strong authentication.

Answer

Deploy a web application firewall (WAF) in front of the API gateway to block SQL injection and cross-site scripting attacks.

Answer

Use rate limiting to restrict the number of API requests per user per minute.