SDSI Practice Test 22 — 15 Questions

Question 1

Which TWO of the following are common benefits of using API-based security automation?

Accepted Answer

Consistent enforcement across infrastructure. Increased speed and consistent enforcement are the two primary benefits.

Answer

Automatic removal of all vulnerabilities

Answer

Unlimited system memory

Answer

Elimination of all human security analysts

Question 2

You are integrating Cisco Umbrella into a CI/CD pipeline. Which API is most appropriate for programmatically blocking domains discovered by your automated security scan?

Accepted Answer

Umbrella Destinations API. The Umbrella 'Destinations API' allows for the automated management of destination lists (blocked domains).

Answer

Umbrella Provisioning API

Answer

Umbrella Reporting API

Answer

Umbrella Log Management API

Question 3

What is the primary role of a 'Security Policy Engine' (e.g., Cisco Secure Firewall) within an automated data center architecture?

Accepted Answer

Centralized policy enforcement. To enforce consistent security policies automatically across physical and virtual workloads.

Answer

Application load balancing

Answer

Server virtualization

Answer

DNS resolution

Question 4

For a DevSecOps pipeline involving Cisco Secure Firewall, what is the 'CI' (Continuous Integration) component responsible for?

Accepted Answer

Validating and testing code changes. CI is responsible for validating code/configuration changes, running automated tests, and building artifacts.

Answer

User access authentication

Answer

Monitoring runtime attacks

Answer

Deploying to production

Question 5

Which THREE criteria are used during the 'Requirements Gathering' phase of a secure architecture design?

Accepted Answer

Business objectives and compliance requirements.. Requirements gathering must account for performance, scalability, and security objectives.

Answer

The color of the hardware rack units.

Answer

The personal email addresses of the network engineering team.

Question 6

Which Cisco product is best for enforcing security policy based on the user's AD group membership?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco ISE integrates with Active Directory to apply policies based on AD group memberships.

Answer

Cisco Umbrella.

Answer

Cisco Secure Firewall.

Answer

Cisco Stealthwatch.

Question 7

During a post-incident review, an architect identifies that Cisco Stealthwatch (Secure Network Analytics) failed to alert on lateral movement due to lack of visibility. Which design modification is required to ensure visibility into internal east-west traffic?

Accepted Answer

Enable NetFlow export from core and distribution layer switches to the Stealthwatch Flow Collector.. Stealthwatch requires flow data (NetFlow/IPFIX/Stealthwatch Flow Sensor) from internal switches and routers to analyze east-west traffic patterns.

Answer

Update the Cisco Secure Endpoint policy to scan memory more frequently on all endpoints.

Answer

Increase the logging interval on the perimeter Cisco Firepower Management Center.

Answer

Integrate the Cisco ISE platform via pxGrid to force all internal hosts to re-authenticate.

Question 8

What is the primary role of Cisco SecureX in a SOC architecture?

Accepted Answer

To provide a centralized platform for visibility and orchestration.. SecureX serves as the unified platform for security visibility and orchestration.

Answer

To provide local firewall policy management.

Answer

To act as a secondary backup firewall.

Answer

To replace all other security tools.

Question 9

Which THREE factors influence the design of a SOC incident response plan?

Accepted Answer

Regulatory compliance requirements (e.g., GDPR).. IRP design is influenced by business needs, legal requirements, and technical capabilities.

Answer

The personal hobbies of the SOC analysts.

Answer

The price of the office furniture.

Question 10

Which risk assessment methodology is best suited to guide a design modification for a cloud-native architecture relying on Cisco Secure Cloud Analytics?

Accepted Answer

NIST SP 800-30 for conducting the assessment.. NIST SP 800-30 is a standard for conducting risk assessments that inform architectural security controls.

Answer

ISO 27002 implementation guide.

Answer

OWASP Top 10 for all infrastructure components.

Answer

PCI-DSS compliance checklist.

Question 11

What is the primary purpose of conducting a risk assessment as part of the security design process?

Accepted Answer

To identify and prioritize security controls based on threat and vulnerability data.. Risk assessments identify vulnerabilities, threats, and asset values, allowing designers to prioritize security controls effectively.

Answer

To automate the patching of all network servers.

Answer

To ensure compliance with local labor laws.

Answer

To select the cheapest security hardware.

Question 12

An organization is updating its SOC incident response toolset. Which Cisco technology provides the ability to perform 'retrospective security' by tracking files that have entered the network in the past?

Accepted Answer

Cisco Secure Endpoint (AMP).. Cisco Secure Endpoint (formerly AMP for Endpoints) performs retrospective analysis by continuously monitoring file activity over time.

Answer

Cisco Secure Network Analytics (Stealthwatch).

Answer

Cisco Firepower IPS.

Answer

Cisco Umbrella.

Question 13

To ensure effective post-incident architecture adaptation, which THREE items must be included in the design documentation for future reference? (Choose three)

Accepted Answer

Modified security policy logic. Proper design documentation must include the security policy changes, the automated response workflow, and the specific log correlation rules created during the incident recovery.

Answer

User password policies

Answer

Hardware rack elevation diagrams

Question 14

A security architect is designing a SIEM integration for a distributed enterprise. Which tool selection criteria best aligns with the requirement to support real-time correlation across disparate cloud and on-premises environments?

Accepted Answer

Prioritize tools that support native Common Event Format (CEF) ingestion and bidirectional API integrations.. The ability to normalize logs from heterogeneous sources is critical for effective correlation in hybrid environments.

Answer

Choose tools that utilize a monolithic database structure to ensure data consistency.

Answer

Focus on tools that strictly utilize hardware-based packet capture for all telemetry.

Answer

Select tools based solely on the number of pre-built connectors available in the marketplace.

Question 15

A design requirement for a new SOC environment mandates that incident data must be centralized. Which Cisco tool is best suited to act as the single pane of glass for integrating disparate security logs and telemetry?

Accepted Answer

Cisco SecureX. Cisco SecureX is designed as an open platform to aggregate data from multiple Cisco and third-party security products.

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Defense Orchestrator (CDO)