SDSI Practice Test 4 — 10 Questions

Question 1

Which TWO identity-based design considerations are critical for secure endpoint access? (Select 2)

Accepted Answer

Device posture validation. Device posture validation (A) is critical because identity-based endpoint access must verify the endpoint's health and compliance state—such as OS patch level, disk encryption, and EDR agent status—before granting access, typically enforced via NAC or Zero Trust policy engines. Multi-factor authentication (E) is also critical because it strengthens identity assurance by requiring a second factor (e.g., TOTP, FIDO2 security key, or push notification) beyond a password, mitigating credential theft and replay attacks. Port security configuration (B) is a Layer 2 switch feature that limits MAC addresses per port and is not an identity-based access consideration. Disabling DHCP (C) is not an identity control and would break normal IP address assignment rather than secure endpoint access. Physical cabling security (D) addresses physical-layer protection and does not validate user or device identity for endpoint access.

Answer

Port security configuration

Answer

Disabling DHCP

Answer

Physical cabling security

Question 2

When designing security for SaaS applications using Cisco Cloudlock, which TWO capabilities are key to mitigating data exfiltration risks? (Choose TWO)

Accepted Answer

Monitoring for anomalous user behavior and account takeovers.. Option A is correct because Cisco Cloudlock's User and Entity Behavior Analytics (UEBA) continuously baselines normal SaaS activity and flags anomalies such as impossible travel, mass downloads, or compromised-account indicators, which are leading precursors to data exfiltration. Option B is correct because Cloudlock's Data Loss Prevention (DLP) engine applies consistent, API-based policies across sanctioned SaaS platforms (e.g., Microsoft 365, Google Workspace, Salesforce, Box), detecting and remediating sensitive data (PII, PCI, PHI) in files, posts, and sharing events before it leaves the organization. Option C is not part of Cloudlock's design, since it is a cloud-native CASB that secures SaaS rather than eliminating it. Option D is unrelated and impractical, as Cloudlock governs SaaS data flows via APIs, not by blocking all outbound Internet traffic. Option E is a security anti-pattern; hard-coding credentials into any dashboard violates least-privilege and credential-management principles and is not a Cloudlock capability.

Answer

Replacing all SaaS applications with on-premises alternatives.

Answer

Blocking all outbound Internet traffic from the office network.

Answer

Hard-coding user credentials into the Cloudlock dashboard.

Question 3

Which Cisco solution is best suited to prevent data exfiltration from a cloud-native Kubernetes cluster?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload is purpose-built for workload-level protection, including containerized and Kubernetes environments, using agents and flow telemetry to enforce microsegmentation and detect anomalous behavior that could indicate exfiltration. It understands pod-to-pod communication and can apply policies at the container level. The other options are network, wireless, or DNS-layer tools without Kubernetes workload context.

Answer

Cisco DNA Center

Answer

Cisco Umbrella

Answer

Cisco Meraki Dashboard

Question 4

A SOC manager requests a design that simplifies the incident investigation process. Which TWO Cisco tools should the design include for improved correlation of network traffic and endpoint events? (Choose two)

Accepted Answer

Cisco Secure Network Analytics. Cisco Secure Network Analytics (formerly Stealthwatch) is correct because it provides network traffic visibility and behavioral analytics, using flow telemetry (NetFlow/IPFIX) and entity modeling to detect and correlate suspicious network activity across the infrastructure, which directly supports incident investigation. Cisco Secure Endpoint (formerly AMP for Endpoints) is correct because it delivers endpoint detection and response telemetry—file trajectory, process lineage, and threat verdicts—that can be correlated with network events to reconstruct an incident's scope and root cause. Together these two tools give the SOC the network-plus-endpoint correlation the manager requested. Cisco DNA Spaces is a location analytics and indoor positioning platform, not a security correlation tool, so it does not belong. Cisco Smart Licensing is a license management framework and Cisco Nexus Dashboard is a data center operations and automation console, neither of which correlates network traffic with endpoint events.

Answer

Cisco DNA Spaces

Answer

Cisco Smart Licensing

Answer

Cisco Nexus Dashboard

Question 5

Which Cisco product is specifically designed to provide visibility into encrypted traffic without the need for manual decryption?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) uses machine learning and network telemetry to identify malware in encrypted traffic without decrypting it. It analyzes flow metadata and sequence of packet lengths and times (SPLT) to detect threats, preserving privacy and reducing complexity. This is specifically designed for visibility into encrypted traffic.

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco Stealthwatch.

Answer

Cisco Firepower IPS.

Question 6

When designing automated security for Cisco Secure Workload, what does 'Micro-segmentation' provide in the context of DevSecOps?

Accepted Answer

Reduced lateral movement risk. Micro-segmentation in Cisco Secure Workload enforces granular, workload-level policies (often based on process, user, and flow attributes) that restrict which workloads can communicate with each other. In DevSecOps, this directly limits lateral movement if an attacker compromises a container or VM, because east-west traffic is denied by default except for explicitly allowed flows. It is a containment control, not a performance, redundancy, or database feature.

Answer

Increased server performance

Answer

Hardware redundancy

Answer

Database optimization

Question 7

Which Cisco product provides visibility into traffic within the cloud, helping to identify potential microsegmentation policies?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload (formerly Tetration) provides deep visibility into workload-to-workload traffic in data centers and cloud environments, using flow telemetry to map dependencies and recommend microsegmentation policies. It is the Cisco product explicitly designed to discover traffic patterns and then generate and enforce microsegmentation policy. This matches the question's requirement for cloud traffic visibility to inform microsegmentation.

Answer

Cisco DNA Center

Answer

Cisco Meraki

Answer

Cisco Umbrella

Question 8

When designing an automated security policy deployment for Cisco Secure Workload (formerly Tetration), which mechanism allows you to test policies in a simulation environment before applying them to production?

Accepted Answer

Policy Analysis mode. Policy Analysis mode in Cisco Secure Workload allows you to simulate the effect of a policy against historical flow data without enforcing it, showing which flows would be allowed or denied. This lets you validate policy changes in a safe, non-disruptive way before moving to enforcement. It is the designated simulation mechanism for policy testing.

Answer

Agentless vulnerability scanning

Answer

Workload isolation testing

Answer

Inventory change management

Answer

Live enforcement mode

Question 9

Which protocol is recommended for secure network time synchronization across security devices?

Accepted Answer

NTP with Authentication. NTP with Authentication (such as NTPv4 with symmetric key authentication or Autokey) ensures that time synchronization messages are authenticated, preventing spoofing and man-in-the-middle attacks. Secure network time synchronization is critical for security devices because inaccurate time can break certificate validation, log correlation, and authentication protocols like Kerberos. Plain NTP is vulnerable to spoofing, so authentication is recommended.

Answer

SNMP

Answer

HTTP

Answer

DHCP

Question 10

Which Cisco feature is used to ensure that only authorized devices can connect to the network?

Accepted Answer

Cisco ISE (802.1X).. Cisco ISE with 802.1X provides port-based network access control that authenticates devices and users before granting network access. It enforces identity-based policies so only authorized devices (validated via certificates, credentials, or MAB) can connect, making it the correct feature for ensuring only authorized devices join the network.

Answer

Cisco Umbrella.

Answer

Cisco Firepower IPS.

Answer

Cisco Stealthwatch.