SDSI Practice Test 5 — 25 Questions

Question 1

Which THREE factors are required to ensure the successful deployment of a Zero Trust microsegmentation architecture? (Choose THREE)

Accepted Answer

A centralized, automated enforcement policy engine. Zero Trust requires identity-based policies, visibility into every communication flow, and continuous monitoring/verification.

Answer

A flat network architecture

Answer

Shared administrative credentials for all servers

Question 2

Which Cisco solution is best suited to prevent data exfiltration from a cloud-native Kubernetes cluster?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload provides visibility and microsegmentation, which is the most effective way to prevent exfiltration by limiting what a compromised pod can reach.

Answer

Cisco DNA Center

Answer

Cisco Umbrella

Answer

Cisco Meraki Dashboard

Question 3

Why is it important to include 'Application Context' when defining microsegmentation policies in Cisco Secure Workload?

Accepted Answer

To align security policies with business and application logic. Application context (like application ID, environment, tier) allows for the creation of policies that are aligned with business logic rather than just arbitrary network segments.

Answer

To bypass the need for firewall rules

Answer

To make the policy easier to read for network admins

Answer

To reduce the amount of memory consumed by the agent

Question 4

Which Cisco product would you choose to gain visibility into your SaaS applications and enforce data security policies?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the industry-standard cloud-native CASB for SaaS visibility and security.

Answer

Cisco Umbrella

Answer

Cisco Secure Workload

Answer

Cisco Secure Firewall

Question 5

When designing an architecture to mitigate the risk of data exfiltration, which Cisco solution provides visibility into the data being sent out of the organization?

Accepted Answer

Cisco Secure Firewall with TLS Inspection.. Cisco Secure Firewall (NGFW) with TLS inspection provides visibility into encrypted outbound data.

Answer

Cisco Umbrella (DNS only).

Answer

Cisco ISE.

Answer

Cisco Stealthwatch.

Question 6

Which THREE items are included in a SOC 'Incident Response Tool' evaluation?

Accepted Answer

Cost of the software subscription.. SOC tools must be evaluated for integration, ease of use, and automation capabilities.

Answer

The vendor's headquarters location.

Answer

The number of employees in the vendor's marketing department.

Question 7

You are tasked with securing a SaaS application. The security policy requires that all documents containing credit card numbers be restricted from external sharing. Which Cloudlock feature is best suited to enforce this?

Accepted Answer

Data Loss Prevention (DLP) engine. Cloudlock's DLP engine can identify patterns such as credit card numbers and trigger automatic remediation for files shared externally.

Answer

User activity monitoring

Answer

Identity and Access Management (IAM) integration

Answer

DNS-layer security

Question 8

Why is 'Behavioral Analysis' a critical component of Cisco API Security?

Accepted Answer

To detect anomalous and signature-less threats. Behavioral analysis allows the tool to identify attacks that do not match known signatures, such as a user accessing endpoints in a sequence that indicates a BOLA attack.

Answer

To speed up the API processing

Answer

To reduce API storage requirements

Answer

To replace the need for API documentation

Question 9

You are designing an email security gateway deployment. What is the benefit of using Cisco Secure Email's 'Outbreak Filters'?

Accepted Answer

It provides predictive protection for zero-day threats. Outbreak Filters protect users during the window between a new threat release and the availability of signatures by analyzing email traffic patterns.

Answer

It blocks spam based on reputation

Answer

It archives email for compliance

Answer

It encrypts outgoing email

Question 10

In a SaaS security design, what is the role of a Cloud Access Security Broker (CASB)?

Accepted Answer

To provide visibility and control over SaaS usage. A CASB provides visibility, compliance, and threat protection for data stored in cloud applications.

Answer

To manage identity for the cloud

Answer

To act as a firewall for SaaS traffic

Answer

To encrypt end-to-end traffic

Question 11

Which TWO design principles should be followed when selecting a firewall architecture for a multi-cloud environment? (Select 2)

Accepted Answer

Centralized management of policies. Multi-cloud designs require consistent policies and centralized management to ensure a uniform security posture.

Answer

Physical firewalls for all cloud segments

Answer

Using cloud-native firewalls only

Answer

Deploying firewalls in a single region

Question 12

A design architect is tasked with selecting a SOC tool for 'Threat Hunting'. Which feature in Cisco SecureX is specifically optimized for this task?

Accepted Answer

SecureX Threat Hunting.. The Threat Hunting feature in SecureX allows for broad searching across indicators (IPs, domains, hashes) in multiple integrated products.

Answer

Firepower Management Center dashboard.

Answer

Stealthwatch flow charts.

Answer

ISE Live Logs.

Question 13

Which TWO Cisco products are part of the 'Secure Access' architecture that helps mitigate the risk of unauthorized remote access?

Accepted Answer

Cisco AnyConnect Secure Client.. Secure access relies on strong authentication (ISE) and encrypted transport (AnyConnect/Secure Client).

Answer

Cisco Umbrella.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Endpoint.

Question 14

Which design approach is best for protecting APIs against 'Mass Assignment' vulnerabilities?

Accepted Answer

Implementing strict input validation and allowing only specified fields. Mass assignment happens when API parameters are blindly bound to internal data models. The fix is to use DTOs (Data Transfer Objects) and explicit validation to ensure only allowed fields are accepted.

Answer

Encrypting all API requests with AES-256

Answer

Disabling all API writes

Answer

Using a strong password policy

Question 15

When designing a secure API lifecycle, which THREE activities should be automated in the CI/CD pipeline? (Choose THREE)

Accepted Answer

API contract/schema testing. Automating security in CI/CD ensures that vulnerabilities are caught before they reach production.

Answer

Disabling all logging for production performance

Answer

Manual code review of every commit by the CISO

Question 16

When designing the architecture for a highly secure API ecosystem, which THREE security layers should be implemented? (Choose THREE)

Accepted Answer

Service Mesh for internal mTLS and authorization. A robust API security design incorporates ingress protection, service-to-service authentication, and continuous monitoring.

Answer

Open-access policies for all internal microservices

Answer

Physical air-gapping of all servers

Question 17

You are designing security for a microservices cluster. You want to ensure that if a pod is compromised, it cannot make unauthorized calls to the database. Which design approach is most effective?

Accepted Answer

Use microsegmentation to restrict database access to authorized services only. Microsegmentation allows you to define policies where only specific microservices are allowed to communicate with the database, blocking all other pods.

Answer

Disable all internal network logging

Answer

Put the database in the public cloud

Answer

Open all network ports to the database

Question 18

When designing a SaaS integration security plan, which THREE types of activities should be regularly reviewed in Cisco Cloudlock? (Choose THREE)

Accepted Answer

User login patterns and anomalies. Reviewing data sharing, third-party app access, and account logins is the core of maintaining a secure SaaS environment.

Answer

Physical building security logs

Answer

Local printer configuration

Question 19

You are designing a SaaS security strategy using Cisco Cloudlock. A user reports that they are seeing alerts for 'unusual geo-location' on their Salesforce account. How does Cloudlock detect this?

Accepted Answer

By using UEBA to baseline and identify anomalous login activity. Cloudlock uses UEBA (User and Entity Behavior Analytics) to baseline normal behavior and flag anomalies like logins from unexpected locations.

Answer

By blocking all international traffic

Answer

By analyzing the user's browser history

Answer

By tracking the user's GPS coordinates on their phone

Question 20

When designing an API strategy, what is the 'API Contract' and why is it important for security?

Accepted Answer

A technical specification that allows for automated schema validation and security enforcement. The API contract defines how the API behaves and what it accepts. Security uses this contract for schema validation to block malformed requests.

Answer

A password file for the API

Answer

A legal document for the API usage

Answer

A file that lists all allowed IP addresses