SDSI Practice Test 4 — 25 Questions

Question 1

Which protocol is used for the control plane communication between Cisco SD-WAN controllers?

Accepted Answer

OMP.. Cisco SD-WAN uses the Overlay Management Protocol (OMP) for control plane communication between SD-WAN controllers (vManage, vBond, vSmart) and between controllers and WAN edge devices. OMP carries routing information, policy, and TLOC (transport locator) attributes, forming the overlay control plane that enables SD-WAN's dynamic path selection.

Answer

EIGRP.

Answer

BGP.

Answer

OSPF.

Question 2

What is the primary function of the 'AnyConnect' (Secure Client) profile?

Accepted Answer

To manage connection and security settings for the endpoint.. The AnyConnect (Secure Client) profile is an XML file that defines how the endpoint's VPN client behaves, including connection entries, authentication methods, split tunneling, and security settings. It is pushed from the headend (ASA or FTD) to the client, allowing centralized management of connection and security policies. This makes option A correct because the profile's primary function is to manage connection and security settings for the endpoint.

Answer

To act as an identity provider.

Answer

To store user credentials.

Answer

To monitor CPU usage on the host.

Question 3

Which THREE design principles are key for a multi-cloud security strategy?

Accepted Answer

Consistent security policies across environments.. Option B is correct because a multi-cloud security strategy requires consistent security policies across environments, so that the same access control, inspection, and segmentation rules are enforced uniformly in AWS, Azure, GCP, and on-premises rather than drifting per provider. Option D is correct because unified threat visibility aggregates logs, events, and telemetry from all clouds into a single view, enabling correlation and detection of threats that span multiple providers instead of relying on fragmented per-cloud consoles. Option E is correct because a centralized management plane such as Cisco Firepower Management Center (FMC) lets administrators define policy once and push it to firewalls and sensors across clouds, which is the practical mechanism for achieving the consistency and visibility described above. Option A is not correct because using different, uncoordinated security tools per cloud creates policy gaps and operational complexity, which is the opposite of a sound multi-cloud design. Option C is not correct because allowing all cross-cloud traffic violates least-privilege and zero-trust principles; cross-cloud flows should be explicitly permitted, inspected, and segmented.

Answer

Using different security tools for each cloud.

Answer

Allowing all cross-cloud traffic.

Question 4

An organization experiences a breach where a malicious file was downloaded. Which Cisco product can be used to perform 'retrospective' analysis on that file's history across the organization?

Accepted Answer

Cisco Secure Endpoint (AMP).. Cisco Secure Endpoint (formerly AMP for Endpoints) maintains a cloud-based file reputation and retrospective analysis capability. When a file is later determined to be malicious, Secure Endpoint can retroactively query its telemetry to identify every endpoint where that file was seen, enabling retrospective detection and response. Stealthwatch is network flow analytics, Secure Email handles email-borne threats, and Umbrella is DNS-layer security — none provide endpoint file-history retrospective analysis.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Email.

Answer

Cisco Umbrella.

Question 5

In DevSecOps, what is the role of an 'Artifact Repository' such as Artifactory in relation to security?

Accepted Answer

Store and secure immutable build artifacts. An artifact repository like Artifactory stores and secures immutable build artifacts, providing a trusted source of truth for binaries, container images, and packages. It supports security through access controls, vulnerability scanning integration, and immutability guarantees that prevent tampering with released artifacts. This makes it a critical control point in the DevSecOps supply chain.

Answer

Manage user identities

Answer

Monitor real-time network traffic

Answer

Execute live security testing

Question 6

A security architect is designing a SOC response workflow using Cisco SecureX Orchestration. Which mechanism is most effective for automated remediation of an endpoint identified as compromised via Cisco Secure Endpoint?

Accepted Answer

Triggering a workflow that executes the isolate endpoint action in Cisco Secure Endpoint via API.. Cisco SecureX Orchestration is designed to automate security workflows across Cisco and third-party products. The most direct and effective remediation for a compromised endpoint identified by Cisco Secure Endpoint is to isolate the endpoint using its native API. The isolate endpoint action in Secure Endpoint cuts off all network communication except for the management connection to the Secure Endpoint cloud, preventing lateral movement and data exfiltration while allowing further investigation. This is a built-in, automated response that can be triggered via SecureX Orchestration, making it the correct choice.

Answer

Deploying an umbrella policy change to redirect the host traffic to a sinkhole.

Answer

Configuring a local script on the Cisco ASA to block the host IP address.

Answer

Using Cisco Defense Orchestrator to push a new access control policy to the endpoint.

Question 7

What is the primary benefit of 'Visibility' in the Cisco API Security architecture?

Accepted Answer

Identification of all APIs and shadow endpoints. Visibility in Cisco API Security means discovering and inventorying every API — including undocumented 'shadow' endpoints that teams spun up outside formal governance. Without this inventory, no other security control (auth, rate limiting, schema validation) can be applied to the right surface.

Answer

Automatic translation of API code

Answer

Reduction of API storage costs

Answer

Increased performance of the API calls

Question 8

An organization is deploying APIs on AWS and using Cisco API Security to protect them. The security team needs to detect 'Shadow APIs' that are being called but are not registered in the API documentation. How should the solution be configured?

Accepted Answer

Integrate API Security with the cloud traffic logs to perform behavior analysis and discovery. Cisco API Security discovers shadow APIs by ingesting traffic data (cloud load balancer logs, API gateway logs, VPC flow logs, or agent-based telemetry) and performing behavioral analysis to identify endpoints that are actually being invoked but do not appear in the registered API documentation. This traffic-based discovery is the only way to surface unregistered/undocumented routes, since documentation alone cannot reveal what is truly being called. Integrating with cloud traffic logs enables continuous discovery and comparison against the known API inventory.

Answer

Manually add every route to the Swagger documentation file

Answer

Configure OAuth scopes to restrict access to the API Gateway

Answer

Enable WAF block mode for all undefined routes

Question 9

Which TWO of the following are common components of an AI-driven security operations center (SOC)?

Accepted Answer

Automated incident response playbooks. Automated incident response playbooks (A) are a core AI-driven SOC component because they use orchestration, automation, and response (SOAR) capabilities to trigger predefined actions—such as isolating a host, disabling an account, or blocking an IP—based on alerts, dramatically reducing mean time to respond. User and Entity Behavior Analytics (UEBA) (E) is also fundamental, as it applies machine learning and statistical baselining to detect anomalous user and entity activity (e.g., impossible travel, unusual data access) that signature-based tools would miss. Manual daily log exporting (B) is not a common AI-driven SOC component; it is a labor-intensive, non-scalable manual process that AI/automation aims to replace. Word processing software (C) is general office productivity tooling unrelated to security operations. Physical surveillance cameras (D) belong to physical security systems, not the AI-driven logical security operations center components described here.

Answer

Manual daily log exporting

Answer

Word processing software

Answer

Physical surveillance cameras

Question 10

Which TWO methods are effective for securing email infrastructure against phishing?

Accepted Answer

DMARC/SPF/DKIM implementation.. Option B is correct because implementing SPF, DKIM, and DMARC together authenticates the sending domain: SPF authorizes sending IPs via DNS TXT records, DKIM cryptographically signs messages with a public key published in DNS, and DMARC tells receivers how to handle messages that fail SPF/DKIM alignment, which directly blocks spoofed sender addresses used in phishing. Option D is correct because Cisco Secure Email sandboxing detonates suspicious attachments and URLs in an isolated environment to detect zero-day malware and credential-harvesting links that signature-based filters miss, adding a behavioral layer of phishing defense. Option A is wrong because using only local SMTP relays does not authenticate senders or filter malicious content and can even worsen spoofing exposure. Option C is wrong because disabling all attachments is overly broad, breaks legitimate business mail, and does not stop phishing links or social-engineering text. Option E is wrong because allowing all inbound mail traffic removes any filtering or policy enforcement, directly enabling phishing delivery.

Answer

Using only local SMTP relays.

Answer

Disabling all attachments in emails.

Answer

Allowing all inbound mail traffic.

Question 11

When assessing risk for a remote office branch, the architect decides to use Cisco Umbrella. Which requirement is addressed by implementing the Umbrella roaming client for branch endpoints?

Accepted Answer

Enforcing security policies on endpoints even when they are off the corporate network.. The Umbrella roaming client is lightweight software installed on endpoints (laptops, desktops) that redirects DNS queries to Cisco Umbrella's global network regardless of where the endpoint is — on-premises, at home, or on public Wi-Fi. This ensures DNS-layer security policy enforcement (blocking malicious domains, C2 callbacks, phishing) follows the user off the corporate network, which is the core value proposition of the roaming client. It does not perform DPI, manage router firewalls, or encrypt site-to-site VPN traffic.

Answer

Providing deep packet inspection for local branch-to-branch file transfers.

Answer

Managing local firewall rules on the branch router.

Answer

Providing local site-to-site VPN encryption for branch traffic.

Question 12

A security architect is designing a DR strategy. Which feature of Cisco Secure Firewall ensures that configurations are synchronized between primary and backup units in a high-availability pair?

Accepted Answer

Cisco Secure Firewall Failover Link.. In a Cisco Secure Firewall high-availability (failover) pair, the failover link is the dedicated interface used to exchange hello/heartbeat messages and synchronize state and configuration between the primary and secondary units. It carries the failover communication that keeps the standby unit's configuration and connection state consistent with the active unit. Without a functioning failover link, the pair cannot maintain synchronized state or properly detect peer health.

Answer

Cisco Defense Orchestrator auto-sync.

Answer

Cisco Identity Services Engine RADIUS sync.

Answer

Cisco FMC policy deployment.

Question 13

Which TWO factors must be considered when designing SaaS security using Cisco Cloudlock to ensure compliance with data protection regulations? (Choose TWO)

Accepted Answer

Establishing remediation workflows for policy violations. Option B is correct because Cisco Cloudlock's value in a SaaS compliance program depends on operationalizing its policy engine: when Cloudlock detects a violation (for example, a DLP match or a risky third-party app), remediation workflows such as automated quarantine, revoke sharing, notify user, or alert admin are what actually enforce the regulation and produce an auditable response trail. Option C is correct because Cloudlock's DLP and data classification policies are the foundation of the entire control: you must define which data types are regulated (for example, PII, PCI, PHI) and how they are classified so Cloudlock's API-based scanning of SaaS platforms like Microsoft 365, Google Workspace, and Salesforce can detect and act on them. Option A is not relevant because BGP peering is an internet routing concern for network connectivity, not a SaaS data-protection control, and Cloudlock operates via APIs rather than routing. Option D is not relevant because hardware-based encryption is a vendor infrastructure matter, not something the Cloudlock customer designs or configures for compliance. Option E is not relevant because Cloudlock is an API-based, agentless CASB that monitors sanctioned SaaS usage from the cloud, so endpoint agents are not required.

Answer

Configuring BGP peering with the SaaS provider

Answer

Enabling hardware-based encryption for the SaaS vendor

Answer

Installing agents on all end-user laptops

Question 14

A security architect is designing a remote-work solution. What is the benefit of using Split Tunneling in Cisco Secure Client?

Accepted Answer

It allows internal traffic to be routed over the VPN while local traffic bypasses it.. Split tunneling in Cisco Secure Client allows the VPN client to route only traffic destined for corporate internal networks through the encrypted VPN tunnel, while all other traffic (e.g., internet browsing, local LAN resources) is sent directly out the local network interface. This reduces bandwidth consumption on the VPN headend, lowers latency for cloud/SaaS apps, and avoids backhauling personal traffic. The correct option captures this exact behavior: internal traffic over VPN, local traffic bypasses it.

Answer

It provides dual authentication layers for the user.

Answer

It encrypts only the authentication phase of the VPN connection.

Answer

It enforces all traffic through the corporate firewall.

Question 15

In an AI-enhanced security design, what is 'Supervised Learning' primarily used for?

Accepted Answer

Classification of malicious vs. benign data. Supervised learning uses labeled training data to learn a mapping from inputs to outputs, making it ideal for classification tasks such as distinguishing malicious from benign data. In AI-enhanced security, labeled datasets of known malware and clean files train models to classify new, unseen samples. This is the foundational use case for supervised learning in security analytics.

Answer

Predicting hardware failure

Answer

Automated documentation generation

Answer

Unsupervised clustering of anomalies

Question 16

What is the primary role of Cisco SecureX in a SOC architecture?

Accepted Answer

To provide a centralized platform for visibility and orchestration.. Cisco SecureX is a cloud-native platform that provides a centralized view of security across multiple products and orchestrates workflows. Its primary role in a SOC is to integrate disparate security tools, automate responses, and provide unified visibility, thereby improving efficiency and threat response. It does not replace other tools but enhances them.

Answer

To provide local firewall policy management.

Answer

To act as a secondary backup firewall.

Answer

To replace all other security tools.

Question 17

You are designing security for a multi-cloud environment. Which feature in Cisco Secure Firewall allows for automated policy deployment based on cloud tags?

Accepted Answer

Dynamic Object Groups.. Dynamic Object Groups in Cisco Secure Firewall (formerly Firepower) let policies reference cloud resource tags (AWS tags, Azure tags, GCP labels) instead of static IPs. As cloud instances are created, terminated, or re-tagged, the firewall automatically updates group membership and enforces policy accordingly, enabling automated policy deployment in multi-cloud environments. This is the mechanism designed specifically for tag-driven, dynamic policy.

Answer

Static IP-based Access Control Lists.

Answer

VLAN tagging.

Answer

Network Interface Virtualization.

Question 18

Which Cisco solution provides DNS-layer security to prevent users from connecting to malicious domains?

Accepted Answer

Cisco Umbrella.. Cisco Umbrella is a cloud-delivered security platform that enforces DNS-layer security by resolving DNS queries through its global network. It blocks requests to malicious domains before a connection is established, preventing users from reaching phishing, malware, or command-and-control sites. This proactive blocking at the DNS layer is Umbrella's core function, making it the correct answer.

Answer

Cisco Stealthwatch.

Answer

Cisco ASA Firewall.

Answer

Cisco Secure Endpoint.

Question 19

What is the primary goal of the 'Requirement Gathering' phase in the Cisco security design process?

Accepted Answer

To define the business and technical requirements for the security system.. The Requirement Gathering phase in the Cisco security design process is the foundational step where the security team collaborates with stakeholders to identify and document both business and technical requirements. This includes understanding business objectives, regulatory compliance needs, risk tolerance, and operational constraints, which then inform the technical specifications for the security system. Without this phase, the design lacks alignment with organizational goals and may fail to address critical security gaps.

Answer

To install the hardware.

Answer

To document the budget only.

Answer

To troubleshoot existing issues.

Question 20

A security designer is choosing a firewall architecture for a high-throughput data center core. Which Cisco Firewall platform is purpose-built for this requirement?

Accepted Answer

Cisco Firepower 4100/9300 Series. The Cisco Firepower 4100 and 9300 Series are purpose-built high-throughput data center firewall appliances, designed for the core with multi-hundred-Gbps throughput, high connection rates, and clustering/HA capabilities. They run FTD (Firepower Threat Defense) and integrate with FMC for centralized management, making them the correct choice for a high-throughput data center core.

Answer

Cisco Meraki MX

Answer

Cisco Firepower 1010

Answer

Cisco ASA 5506-X