SDSI Practice Test 2 — 30 Questions

Question 1

Which THREE of the following technologies should be combined to create a 'Security-as-Code' pipeline for Cisco infrastructure?

Accepted Answer

Git (Version Control). Version control, configuration management, and vulnerability scanning are essential to the workflow.

Answer

Physical console cables

Answer

Local SQL databases

Question 2

Which THREE of the following are considered 'Threat Response' automation actions in a Cisco XDR environment?

Accepted Answer

Blocking a malicious file hash. Isolating an endpoint, blocking a file hash, and blocking a URL are common automated responses.

Answer

Sending a company-wide email

Answer

Rebooting the server hardware

Question 3

You are designing an API security architecture for a hybrid cloud environment. Which TWO Cisco technologies would you implement to secure the API lifecycle?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure API Gateway and Cisco Secure Application (AppDynamics) are standard for API protection.

Answer

Cisco Firepower

Answer

Cisco ISE

Answer

Cisco AnyConnect

Question 4

When designing microsegmentation within Cisco Secure Workload for a hybrid environment, which TWO components are essential for enforcing traffic policies between on-premises servers and cloud-native instances? (Choose TWO)

Accepted Answer

Cisco Secure Workload software agents. Secure Workload relies on agents (for VMs/bare metal) and VPC flow log ingestion/cloud integration (for cloud-native) to build the visibility and enforcement model.

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Umbrella virtual appliance

Answer

Cisco Identity Services Engine (ISE)

Question 5

Which capability is provided by Cisco Cloudlock's integration with the SaaS platform via API?

Accepted Answer

Visibility and remediation of data sharing and user activity. Cloudlock uses APIs to monitor for file sharing, data exposure, and user behavior anomalies within the SaaS environment without requiring agent installation.

Answer

Hardening of the SaaS application code

Answer

Deep packet inspection of all physical network traffic

Answer

Blocking DNS requests at the ISP level

Question 6

Which THREE of the following are essential components of a robust DevSecOps security architecture for Cisco infrastructure?

Accepted Answer

Infrastructure as Code (IaC). Infrastructure as Code, Automated Testing, and Continuous Monitoring are core pillars of DevSecOps.

Answer

Manual Review Committees

Answer

Isolated air-gapped networks

Question 7

You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?

Accepted Answer

Cloudlock API-based CASB integration. Cloudlock uses API-based CASB integration to monitor activity and detect anomalies like abnormal file sharing patterns.

Answer

Cisco Umbrella roaming client

Answer

Cisco ISE Profiling

Answer

Cisco Secure Firewall NAT

Question 8

You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). Which specific architectural component must be deployed within the Kubernetes worker nodes to enforce policy without relying on external firewall hairpining?

Accepted Answer

Secure Workload Software Agent. The Secure Workload software agent (or sensor) is deployed on host nodes to enforce policy at the vSwitch or kernel level, enabling microsegmentation directly at the workload.

Answer

Cisco ASA Virtual Appliance

Answer

Cisco Nexus Dashboard Orchestrator

Answer

Cisco Firepower Management Center

Question 9

You are designing a secure API architecture where services are deployed in Kubernetes. You need to enforce authentication and rate limiting at the ingress. Which tool should be used for centralized policy enforcement?

Accepted Answer

An API Gateway integrated into the Ingress Controller. Cisco API Connectivity Manager (ACM) or an API Gateway integrated with the Ingress Controller handles centralized auth, rate limiting, and observability.

Answer

Using IP-based ACLs on the Kubernetes node

Answer

Hard-coding auth logic into every microservice

Answer

Cisco Secure Firewall running in transparent mode

Question 10

In DevSecOps, what is the role of an 'Artifact Repository' such as Artifactory in relation to security?

Accepted Answer

Store and secure immutable build artifacts. Storing immutable, scanned, and signed artifacts ensures that the code deployed is exactly what was tested.

Answer

Manage user identities

Answer

Monitor real-time network traffic

Answer

Execute live security testing

Question 11

When automating security with Cisco XDR, which component allows for the execution of arbitrary scripts on third-party security tools?

Accepted Answer

Cisco XDR Workflow Engine. The 'Cisco XDR Workflow Engine' allows for custom python/javascript scripts to be executed during an orchestration sequence.

Answer

Cisco XDR Threat Intel module

Answer

Cisco XDR Telemetry API

Answer

Cisco XDR Dashboard

Question 12

When designing a secure multi-cloud strategy for applications, how does Cisco Secure Workload facilitate consistent policy management?

Accepted Answer

By providing a centralized policy plane that integrates with native cloud security controls. Secure Workload uses a common policy engine that translates intent-based policies into the native security rules (like Security Groups) of the respective cloud providers.

Answer

By forcing all traffic to transit a VPN tunnel

Answer

By moving all traffic through a centralized Cisco hardware firewall

Answer

By manually creating ACLs in each cloud provider console

Question 13

You are automating Cisco Secure Firewall policies. Why is 'Version Control' (e.g., Git) considered a security control?

Accepted Answer

Provides audit trails and change history. It provides a source of truth, audit trail, and the ability to revert unauthorized or malicious configuration changes.

Answer

Automatically encrypts all traffic

Answer

Increases bandwidth

Answer

Replaces the need for a firewall

Question 14

A developer needs to ensure that microservices within a Kubernetes cluster communicate securely. Which design element ensures that the service-to-service communication is encrypted using mTLS?

Accepted Answer

Deploying a Service Mesh. A service mesh, such as Istio, automates the configuration of mTLS between microservices.

Answer

Configuring standard Kubernetes Service objects

Answer

Using a physical load balancer in front of the cluster

Answer

Enabling IPsec on the physical nodes

Question 15

Which TWO factors must be considered when designing SaaS security using Cisco Cloudlock to ensure compliance with data protection regulations? (Choose TWO)

Accepted Answer

Establishing remediation workflows for policy violations. Compliance requires identifying sensitive data types and defining automated remediation actions to protect that data.

Answer

Configuring BGP peering with the SaaS provider

Answer

Enabling hardware-based encryption for the SaaS vendor

Answer

Installing agents on all end-user laptops

Question 16

In an AI-based security architecture, which data source provides the most value for training an ML model to detect unauthorized data exfiltration?

Accepted Answer

NetFlow/IPFIX logs. Flow logs (NetFlow/IPFIX) provide the metadata (source, destination, volume) required to detect exfiltration patterns.

Answer

User password history

Answer

System process logs

Answer

DHCP lease logs

Question 17

Following a ransomware incident, an architect must modify the network segmentation strategy. What is the most effective approach to mitigate lateral movement using Cisco TrustSec?

Accepted Answer

Implement SGT-based micro-segmentation at the access layer to enforce policies based on identity rather than IP.. TrustSec SGTs (Scalable Group Tags) allow for dynamic policy enforcement regardless of IP address, making it ideal for mitigating lateral movement.

Answer

Deploy extended ACLs on every core switch port to block peer-to-peer traffic.

Answer

Configure static port-security across the entire enterprise to prevent unauthorized devices.

Answer

Transition all physical cabling to private VLANs without leveraging SGTs.

Question 18

A design requirements gathering phase identifies that users frequently access untrusted SaaS applications. Which Cisco solution should be included to mitigate data exfiltration risks?

Accepted Answer

Cisco Umbrella with CASB capability enabled.. Cisco Cloud Access Security Broker (CASB) functionality within Cisco Umbrella provides visibility and control over SaaS usage.

Answer

Cisco Secure Firewall with IPS enabled.

Answer

Cisco AnyConnect VPN.

Answer

Cisco Identity Services Engine (ISE).

Question 19

A design requirements document specifies a need for 'Network Segmentation' to contain breaches. Which Cisco technology provides the best granular control using Scalable Group Tags (SGTs)?

Accepted Answer

Cisco TrustSec (SGTs).. Cisco TrustSec uses SGTs to enforce segmentation policies based on identity, independent of IP address.

Answer

Cisco Secure Firewall interface zones.

Answer

VLAN-based segmentation.

Answer

Cisco Umbrella local policy.

Question 20

Which design principle should be followed when implementing micro-segmentation in a data center?

Accepted Answer

Implement identity-based segmentation at the workload level.. Micro-segmentation is most effective when it is identity-based and granular.

Answer

Keep all servers in the same VLAN for simplicity.

Answer

Segment based only on IP addresses.

Answer

Disable all firewalls for maximum performance.