SDSI Practice Test 2 — 25 Questions

Question 1

When designing automated security for Cisco Secure Workload, what does 'Micro-segmentation' provide in the context of DevSecOps?

Accepted Answer

Reduced lateral movement risk. It restricts lateral movement by only allowing necessary application communications, defined by code-based policies.

Answer

Increased server performance

Answer

Hardware redundancy

Answer

Database optimization

Question 2

Which THREE of the following are key features of Cisco XDR (formerly SecureX) in an automated pipeline?

Accepted Answer

Workflow orchestration. Orchestration, threat intelligence, and incident management are core XDR features.

Answer

Automated server patching

Answer

Network packet capture hardware

Question 3

Which THREE of the following are best practices for securing a CI/CD pipeline itself?

Accepted Answer

Scan the pipeline code for vulnerabilities. Securing the runner, managing secrets, and scanning code are fundamental best practices.

Answer

Allow root access to all developers

Answer

Use unencrypted communication channels

Question 4

Which component of Cisco XDR (formerly Cisco SecureX) is critical for normalizing data from different Cisco security products to enable automated orchestration?

Accepted Answer

Unified Data Model. The 'Cisco XDR Unified Data Model' normalizes disparate logs into a standard format for correlation and automation.

Answer

Cloud-native storage

Answer

Local management agent

Answer

Packet inspection engine

Question 5

What is the primary benefit of 'Shift Left' security in a DevSecOps pipeline?

Accepted Answer

Reduced remediation costs. Shifting security to the beginning of the development cycle lowers remediation costs and reduces risk exposure.

Answer

Automated hardware deployment

Answer

Increased development speed

Answer

Elimination of security teams

Question 6

Which THREE of the following technologies should be combined to create a 'Security-as-Code' pipeline for Cisco infrastructure?

Accepted Answer

Git (Version Control). Version control, configuration management, and vulnerability scanning are essential to the workflow.

Answer

Physical console cables

Answer

Local SQL databases

Question 7

Which THREE of the following are considered 'Threat Response' automation actions in a Cisco XDR environment?

Accepted Answer

Blocking a malicious file hash. Isolating an endpoint, blocking a file hash, and blocking a URL are common automated responses.

Answer

Sending a company-wide email

Answer

Rebooting the server hardware

Question 8

You are designing an API security architecture for a hybrid cloud environment. Which TWO Cisco technologies would you implement to secure the API lifecycle?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure API Gateway and Cisco Secure Application (AppDynamics) are standard for API protection.

Answer

Cisco Firepower

Answer

Cisco ISE

Answer

Cisco AnyConnect

Question 9

When designing microsegmentation within Cisco Secure Workload for a hybrid environment, which TWO components are essential for enforcing traffic policies between on-premises servers and cloud-native instances? (Choose TWO)

Accepted Answer

Cisco Secure Workload software agents. Secure Workload relies on agents (for VMs/bare metal) and VPC flow log ingestion/cloud integration (for cloud-native) to build the visibility and enforcement model.

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Umbrella virtual appliance

Answer

Cisco Identity Services Engine (ISE)

Question 10

Which capability is provided by Cisco Cloudlock's integration with the SaaS platform via API?

Accepted Answer

Visibility and remediation of data sharing and user activity. Cloudlock uses APIs to monitor for file sharing, data exposure, and user behavior anomalies within the SaaS environment without requiring agent installation.

Answer

Hardening of the SaaS application code

Answer

Deep packet inspection of all physical network traffic

Answer

Blocking DNS requests at the ISP level

Question 11

Which THREE of the following are essential components of a robust DevSecOps security architecture for Cisco infrastructure?

Accepted Answer

Infrastructure as Code (IaC). Infrastructure as Code, Automated Testing, and Continuous Monitoring are core pillars of DevSecOps.

Answer

Manual Review Committees

Answer

Isolated air-gapped networks

Question 12

You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?

Accepted Answer

Cloudlock API-based CASB integration. Cloudlock uses API-based CASB integration to monitor activity and detect anomalies like abnormal file sharing patterns.

Answer

Cisco Umbrella roaming client

Answer

Cisco ISE Profiling

Answer

Cisco Secure Firewall NAT

Question 13

You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). Which specific architectural component must be deployed within the Kubernetes worker nodes to enforce policy without relying on external firewall hairpining?

Accepted Answer

Secure Workload Software Agent. The Secure Workload software agent (or sensor) is deployed on host nodes to enforce policy at the vSwitch or kernel level, enabling microsegmentation directly at the workload.

Answer

Cisco ASA Virtual Appliance

Answer

Cisco Nexus Dashboard Orchestrator

Answer

Cisco Firepower Management Center

Question 14

You are designing a secure API architecture where services are deployed in Kubernetes. You need to enforce authentication and rate limiting at the ingress. Which tool should be used for centralized policy enforcement?

Accepted Answer

An API Gateway integrated into the Ingress Controller. Cisco API Connectivity Manager (ACM) or an API Gateway integrated with the Ingress Controller handles centralized auth, rate limiting, and observability.

Answer

Using IP-based ACLs on the Kubernetes node

Answer

Hard-coding auth logic into every microservice

Answer

Cisco Secure Firewall running in transparent mode

Question 15

In DevSecOps, what is the role of an 'Artifact Repository' such as Artifactory in relation to security?

Accepted Answer

Store and secure immutable build artifacts. Storing immutable, scanned, and signed artifacts ensures that the code deployed is exactly what was tested.

Answer

Manage user identities

Answer

Monitor real-time network traffic

Answer

Execute live security testing

Question 16

When automating security with Cisco XDR, which component allows for the execution of arbitrary scripts on third-party security tools?

Accepted Answer

Cisco XDR Workflow Engine. The 'Cisco XDR Workflow Engine' allows for custom python/javascript scripts to be executed during an orchestration sequence.

Answer

Cisco XDR Threat Intel module

Answer

Cisco XDR Telemetry API

Answer

Cisco XDR Dashboard

Question 17

When designing a secure multi-cloud strategy for applications, how does Cisco Secure Workload facilitate consistent policy management?

Accepted Answer

By providing a centralized policy plane that integrates with native cloud security controls. Secure Workload uses a common policy engine that translates intent-based policies into the native security rules (like Security Groups) of the respective cloud providers.

Answer

By forcing all traffic to transit a VPN tunnel

Answer

By moving all traffic through a centralized Cisco hardware firewall

Answer

By manually creating ACLs in each cloud provider console

Question 18

You are automating Cisco Secure Firewall policies. Why is 'Version Control' (e.g., Git) considered a security control?

Accepted Answer

Provides audit trails and change history. It provides a source of truth, audit trail, and the ability to revert unauthorized or malicious configuration changes.

Answer

Automatically encrypts all traffic

Answer

Increases bandwidth

Answer

Replaces the need for a firewall

Question 19

A developer needs to ensure that microservices within a Kubernetes cluster communicate securely. Which design element ensures that the service-to-service communication is encrypted using mTLS?

Accepted Answer

Deploying a Service Mesh. A service mesh, such as Istio, automates the configuration of mTLS between microservices.

Answer

Configuring standard Kubernetes Service objects

Answer

Using a physical load balancer in front of the cluster

Answer

Enabling IPsec on the physical nodes

Question 20

Which TWO factors must be considered when designing SaaS security using Cisco Cloudlock to ensure compliance with data protection regulations? (Choose TWO)

Accepted Answer

Establishing remediation workflows for policy violations. Compliance requires identifying sensitive data types and defining automated remediation actions to protect that data.

Answer

Configuring BGP peering with the SaaS provider

Answer

Enabling hardware-based encryption for the SaaS vendor

Answer

Installing agents on all end-user laptops