SDSI Practice Test 1 — 25 Questions

Question 1

You are automating the lifecycle of Cisco Secure Firewall policies. Which tool should be selected to integrate security policy as code (SaC) into a GitHub Actions pipeline?

Accepted Answer

HashiCorp Terraform. Terraform, specifically the 'cisco-fmc' provider, is the industry standard for managing Cisco security infrastructure as code.

Answer

Cisco DNA Center GUI

Answer

Python native sockets

Answer

Cisco Defense Orchestrator Portal

Question 2

In the context of AI-driven security, what does 'False Positive Reduction' primarily achieve?

Accepted Answer

Improved analyst efficiency. It minimizes unnecessary alerts, allowing security teams to focus on high-fidelity, real threats.

Answer

Increased hardware throughput

Answer

Lower bandwidth consumption

Answer

Faster packet forwarding

Question 3

Which of the following is a key requirement for implementing successful DevSecOps in a large organization?

Accepted Answer

Cultural alignment between teams. Cultural alignment between developers and security teams is the foundational requirement for successful DevSecOps.

Answer

Manual approval for every commit

Answer

Removing all open-source code

Answer

Restricting code access to security only

Question 4

Which THREE of the following are key AI/ML design considerations when selecting a security automation platform?

Accepted Answer

Explainability and transparency (XAI). Data quality, model transparency, and integration capabilities are critical for effective AI security.

Answer

Number of employees on the vendor's team

Answer

Local hardware GPU acceleration

Question 5

In a cloud-native environment, which Cisco solution provides visibility into vulnerabilities within the application code and runtime environment?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure Application for AppDynamics provides full-stack security observability including code vulnerabilities and runtime threats.

Answer

Cisco Secure Endpoint

Answer

Cisco Stealthwatch

Answer

Cisco Secure Malware Analytics

Question 6

Which Cisco feature is specifically designed to prevent 'Credential Stuffing' in an automated application environment?

Accepted Answer

Adaptive Authentication. Cisco Secure Access (Duo) Adaptive Authentication uses risk-based policies to detect and block credential stuffing.

Answer

DNS Filtering

Answer

SSL Inspection

Answer

Intrusion Prevention System (IPS)

Question 7

Which TWO of the following are benefits of using 'Infrastructure as Code' (IaC) with Cisco Secure Firewall?

Accepted Answer

Improved auditability of changes. Consistency and auditability are the primary benefits of treating infrastructure as code.

Answer

Reduction of network bandwidth usage

Answer

Elimination of the need for firewall policies

Answer

Automatic hardware repair

Question 8

What is the primary function of an 'API Gateway' in a secure automated environment?

Accepted Answer

Enforce security and rate limits on APIs. The gateway acts as an enforcement point for authentication, rate-limiting, and logging for API calls.

Answer

Host static websites

Answer

Store user data

Answer

Compile application code

Question 9

Which THREE of the following represent common challenges when implementing automated security in a legacy environment?

Accepted Answer

Cultural resistance to change. Lack of APIs, fragmented data, and organizational resistance are common barriers.

Answer

Too much documentation

Answer

Excessive API performance

Question 10

In the context of Cisco Cloudlock, what is a 'Shadow IT' application?

Accepted Answer

A SaaS application connected to the enterprise environment without official IT authorization. A Shadow IT application is a third-party app that users have connected to their enterprise SaaS account without IT approval.

Answer

An application that is blocked by the firewall

Answer

A backup tool for the data center

Answer

A malicious script running on an endpoint

Question 11

When designing a multi-cloud CI/CD security architecture, how should secrets (API keys for Cisco FMC) be managed to ensure compliance?

Accepted Answer

Use a dedicated Secret Management service. Secrets must be stored in a dedicated vault (like HashiCorp Vault or AWS Secrets Manager) and never in code repositories.

Answer

Embed as environment variables in the build runner

Answer

Encrypt with base64 and store in Git

Answer

Hardcode in the Terraform provider block

Question 12

When utilizing Cisco DevNet tools for security, which Python library is the standard for interacting with the Cisco FMC API efficiently?

Accepted Answer

fmcapi. The 'fmcapi' library (a community-supported wrapper) is the industry standard for interacting with FMC in Python scripts.

Answer

requests_cisco

Answer

cisco_py

Answer

fmc_sdk

Question 13

Which Cisco solution is primarily designed to provide visibility and protection for SaaS applications like Office 365, Salesforce, and Slack?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is a cloud-native CASB designed to secure SaaS environments.

Answer

Cisco Secure Workload

Answer

Cisco Secure Firewall

Answer

Cisco Umbrella

Question 14

Which TWO of the following steps are required to integrate a security tool (like Cisco Secure Firewall) into a CI/CD pipeline?

Accepted Answer

Configure API authentication credentials. You need an authentication mechanism (API keys) and a deployment tool (Terraform/Ansible) to manage the infrastructure.

Answer

Replace the existing firewall hardware

Answer

Hardcode credentials in the pipeline build file

Answer

Disable all firewall rules for testing

Question 15

Which TWO of the following are true about 'Policy as Code' in Cisco security infrastructure?

Accepted Answer

Policies are stored in version control systems. It promotes version control and allows for automated testing of policies.

Answer

Policies are always written in assembly language

Answer

Policies are automatically applied without review

Answer

Policies are only for cloud-native apps

Question 16

Which Cisco security solution utilizes AI-based 'Cognitive Intelligence' to detect threats in encrypted traffic without decrypting the payload?

Accepted Answer

Cisco Secure Cloud Analytics. Cisco Secure Cloud Analytics (Stealthwatch) uses Cognitive Intelligence to analyze metadata and flow patterns in encrypted traffic.

Answer

Cisco Secure Firewall

Answer

Cisco Umbrella

Answer

Cisco Secure Email

Question 17

When designing an automated remediation workflow for Cisco Secure Firewall, what is the specific function of the 'Cisco Secure Firewall REST API' in the context of threat intelligence feeds?

Accepted Answer

Dynamic update of Network Objects. The API allows for dynamic injection of IP or Domain lists into 'Network Objects' which are used in policy rules.

Answer

Encryption key rotation

Answer

Automated firmware flashing

Answer

Traffic scrubbing

Question 18

You are implementing automated policy enforcement for Cisco Secure Access by Duo. Which API allows you to programmatically manage users and authentication settings?

Accepted Answer

Duo Admin API. The Duo Admin API is the standard for managing users, policies, and authentication programmatically.

Answer

Duo Web SDK

Answer

Duo Auth API

Answer

Duo Telemetry API

Question 19

You are designing an automated pipeline for Cisco Secure Firewall. If a deployment fails, which mechanism ensures the configuration is reverted to the last known good state?

Accepted Answer

Terraform state rollback. Using Terraform 'state' management or Ansible 'check mode' allows for rollback or verification before committing changes, preventing broken states.

Answer

Manual CLI restore

Answer

FMC Factory Reset

Answer

Automated snapshot deletion

Question 20

Which TWO of the following capabilities does Cisco Secure Firewall (FMC) provide to support automated security workflows?

Accepted Answer

Integration with external Threat Intel feeds. The FMC REST API and the ability to integrate with external threat intelligence feeds are critical for automation.

Answer

Native container orchestration

Answer

Automated code refactoring

Answer

On-board AI training engine