SDSI Practice Test 4 — 25 Questions

Question 1

When designing security for SaaS applications, what is the primary benefit of an API-based CASB like Cisco Cloudlock over a proxy-based CASB?

Accepted Answer

API-based does not require routing user traffic through the CASB. API-based CASBs can monitor data at rest and provide deeper remediation without requiring users to route their traffic through a proxy, which is ideal for cloud-first environments.

Answer

Proxy-based is cheaper

Answer

API-based only works on-premises

Answer

Proxy-based is always faster

Question 2

What is the primary benefit of 'Visibility' in the Cisco API Security architecture?

Accepted Answer

Identification of all APIs and shadow endpoints. Visibility allows you to see all your API endpoints, including shadow APIs, which is the necessary first step for any security strategy.

Answer

Automatic translation of API code

Answer

Reduction of API storage costs

Answer

Increased performance of the API calls

Question 3

An organization is deploying APIs on AWS and using Cisco API Security to protect them. The security team needs to detect 'Shadow APIs' that are being called but are not registered in the API documentation. How should the solution be configured?

Accepted Answer

Integrate API Security with the cloud traffic logs to perform behavior analysis and discovery. Cisco API Security performs discovery by analyzing traffic logs and API calls to identify endpoints that are active but missing from the defined schema.

Answer

Manually add every route to the Swagger documentation file

Answer

Configure OAuth scopes to restrict access to the API Gateway

Answer

Enable WAF block mode for all undefined routes

Question 4

When designing an API security architecture, what is the primary purpose of 'API Discovery' in the context of Cisco API Security?

Accepted Answer

To inventory all API endpoints and identify shadow or undocumented APIs. API Discovery identifies all API endpoints in an environment to ensure that security policies can be applied to undocumented or shadow APIs.

Answer

To replace the need for API gateways

Answer

To increase the API's performance

Answer

To automatically generate API documentation for developers

Question 5

What is the purpose of 'Microsegmentation' in a cloud-native architecture?

Accepted Answer

To reduce the attack surface by isolating workloads. Microsegmentation provides granular security by isolating workloads so that traffic is only allowed if explicitly required, reducing the attack surface.

Answer

To automatically scale services based on demand

Answer

To provide high availability for the service

Answer

To optimize container scheduling

Question 6

You are designing security for a microservices environment. You want to ensure that if one service is compromised, it cannot easily move laterally to other services. What is the most effective architectural design choice?

Accepted Answer

Implement microsegmentation between services. Microsegmentation restricts communication to only the necessary paths, preventing attackers from moving across the network.

Answer

Keep all services on the same VLAN

Answer

Disable all internal firewalls for better performance

Answer

Use a single shared database for all services

Question 7

When designing a microsegmentation strategy with Cisco Secure Workload, which THREE metrics should be monitored to validate policy effectiveness? (Choose THREE)

Accepted Answer

Reduction in unauthorized lateral movement flows. Policy effectiveness is measured by reduced lateral movement, identification of blocked unauthorized flows, and adherence to the Zero Trust model.

Answer

Average server uptime

Answer

Total number of network switches used

Question 8

Which design pattern best mitigates 'Broken Object Level Authorization' (BOLA) in a RESTful API?

Accepted Answer

Explicit authorization check at every endpoint that accepts an object ID. BOLA is mitigated by verifying that the authenticated identity is authorized to perform operations on the specific resource ID provided in the API request.

Answer

Implementing a strong API rate limit

Answer

Using random, non-sequential UUIDs for objects

Answer

Encrypting all API responses

Question 9

When designing security for a cloud-native architecture, why is it better to use an identity-based model instead of a network-based model for microsegmentation?

Accepted Answer

Because identity is persistent while IP addresses are volatile. Identity is persistent; IP addresses are volatile in cloud-native environments, making network-based rules impossible to manage at scale.

Answer

Because it is easier to implement IP-based rules

Answer

Because identity is always known to the network hardware

Answer

Because it doesn't require any policy configuration

Question 10

When designing a post-incident security architecture, which THREE factors are critical for determining the placement of Cisco Secure Firewall sensors?

Accepted Answer

Physical segmentation of the network (VLANs/VRFs).. Sensor placement must account for visibility, traffic volume, and policy enforcement needs.

Answer

The number of users connected to the local office Wi-Fi.

Answer

Local temperature of the server room.

Question 11

During a risk assessment, it is determined that a legacy application cannot be patched. Which Cisco security control should be prioritized to compensate for this vulnerability?

Accepted Answer

Virtual patching via Cisco Secure Firewall IPS.. Network-based IPS (Intrusion Prevention System) can provide virtual patching by blocking exploits targeting the vulnerability.

Answer

Cisco Stealthwatch behavioral alerts.

Answer

Cisco AnyConnect VPN.

Answer

Cisco Umbrella DNS blocking.

Question 12

Which Cisco product is specifically designed to provide visibility into encrypted traffic without the need for manual decryption?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) provides this capability.

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco Stealthwatch.

Answer

Cisco Firepower IPS.

Question 13

A security architect is configuring a design for an enterprise with high-speed (100G) traffic. Which Cisco firewall solution is most appropriate?

Accepted Answer

Cisco Firepower 9300 series.. Cisco Firepower 9300 appliances are designed for high-throughput, high-speed data center environments.

Answer

Cisco Umbrella virtual appliance.

Answer

Cisco Firepower 1000 series.

Answer

Cisco AnyConnect.

Question 14

When designing security for a microservices architecture, why should you implement a 'Zero Trust' approach at the service level?

Accepted Answer

To ensure that every service-to-service call is authenticated and authorized. Zero Trust assumes the network is compromised, requiring explicit authentication and authorization for every request, regardless of origin.

Answer

To rely solely on network perimeter security

Answer

To increase the latency of inter-service communication

Answer

To simplify the management of firewall rules

Question 15

A requirement for an incident response toolset is the ability to automatically contain a workstation upon detecting a specific malware threat. Which Cisco tool provides this 'isolate' capability?

Accepted Answer

Cisco Secure Endpoint (AMP).. Cisco Secure Endpoint (formerly AMP for Endpoints) has a native 'Isolate' feature.

Answer

Cisco AnyConnect.

Answer

Cisco Umbrella roaming client.

Answer

Cisco Secure Firewall.

Question 16

Which risk assessment technique involves evaluating the impact of an attack on the confidentiality, integrity, and availability of an asset?

Accepted Answer

CIA Triad Impact Assessment.. CIA Triad assessment is a standard risk evaluation methodology.

Answer

SWOT Analysis.

Answer

Network Penetration Testing.

Answer

Cost-Benefit Analysis.

Question 17

Which TWO Cisco products are used to achieve 'Zero Trust' for remote users?

Accepted Answer

Cisco Identity Services Engine (ISE).. Zero Trust remote access requires secure connectivity and strict identity verification.

Answer

Cisco Umbrella.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Email.

Question 18

Which THREE steps are required for a successful security design process?

Accepted Answer

Developing a detailed architectural plan and implementation roadmap.. Successful designs require assessment, planning, and validation.

Answer

Ignoring all existing network infrastructure.

Answer

Purchasing the most expensive hardware available.

Question 19

Which design principle should be followed when implementing micro-segmentation in a data center?

Accepted Answer

Implement identity-based segmentation at the workload level.. Identity-based segmentation provides the most granular control at the workload level.

Answer

Segment based only on IP addresses.

Answer

Disable all firewalls for maximum performance.

Answer

Keep all servers in the same VLAN for simplicity.

Question 20

Which design component is essential for securing traffic in a cloud-native environment using Cisco Secure Workload without relying on physical network appliances?

Accepted Answer

Workload-level security agents. The Secure Workload agent is the software component that resides on the workload and enforces policy without needing physical appliances.

Answer

Physical tap aggregation

Answer

VLAN-based segmentation

Answer

Direct Connect integration