SDSI Practice Questions 2 — 50 Questions

Question 1

You are designing an email security gateway deployment. What is the benefit of using Cisco Secure Email's 'Outbreak Filters'?

Accepted Answer

It provides predictive protection for zero-day threats. Cisco Secure Email's Outbreak Filters provide predictive protection for zero-day threats by using Cisco Talos threat intelligence and real-time reputation/behavioral analysis to catch malicious messages before signatures are available. They can hold suspicious messages for a short period while Talos analyzes them, then release or quarantine based on the verdict. This 'predictive' capability is what distinguishes Outbreak Filters from standard anti-spam or antivirus.

Answer

It blocks spam based on reputation

Answer

It archives email for compliance

Answer

It encrypts outgoing email

Question 2

What is the purpose of 'Microsegmentation' in a cloud-native architecture?

Accepted Answer

To reduce the attack surface by isolating workloads. Microsegmentation's core security purpose is to reduce the attack surface by isolating workloads from one another, so that a compromise of one workload cannot freely reach others. It enforces least-privilege east-west traffic policies at the workload level rather than relying on perimeter firewalls. This directly limits lateral movement and blast radius within a cloud-native environment.

Answer

To automatically scale services based on demand

Answer

To provide high availability for the service

Answer

To optimize container scheduling

Question 3

Which Cisco solution is primarily designed to provide visibility and protection for SaaS applications like Office 365, Salesforce, and Slack?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is a cloud access security broker (CASB) that provides visibility into and control over SaaS application usage, including Office 365, Salesforce, and Slack. It uses APIs to monitor user activity, detect data exfiltration, and enforce data loss prevention (DLP) policies specifically for cloud applications. Unlike network-based solutions, Cloudlock operates at the application layer, offering granular SaaS security without requiring traffic redirection.

Answer

Cisco Secure Workload

Answer

Cisco Secure Firewall

Answer

Cisco Umbrella

Question 4

When designing a secure remote access solution for a hybrid workforce, which Cisco AnyConnect feature should be prioritized to reduce the attack surface by verifying the posture of the device before granting access?

Accepted Answer

AnyConnect Posture Module.. The AnyConnect Posture Module is the component that performs endpoint posture assessment (hostscan) before or during VPN session establishment, checking for antivirus, firewall, OS patches, and other compliance criteria. It is the mechanism that reduces attack surface by ensuring only compliant devices are granted access, feeding results into DAP for enforcement.

Answer

IKEv2 protocol support.

Answer

Split-tunneling.

Answer

Dynamic Access Policies (DAP).

Question 5

When designing a secure management plane, why is it critical to use a dedicated Out-of-Band (OOB) network?

Accepted Answer

To prevent management plane saturation during a data plane DoS attack.. A dedicated Out-of-Band (OOB) management network physically or logically separates management traffic from production data traffic. When a data plane DoS attack saturates the production links, in-band management would become unreachable, preventing administrators from responding. OOB preserves management access so remediation can occur even under active attack.

Answer

To reduce the cost of cabling.

Answer

To increase the throughput of user traffic.

Answer

To allow for DHCP-based addressing of management interfaces.

Question 6

Which THREE features of Cisco Secure Email help in mitigating email-based threats? (Select 3)

Accepted Answer

Cisco Threat Grid sandboxing. Cisco Threat Grid sandboxing (C) is correct because it detonates suspicious attachments and URLs in an isolated environment to observe malicious behavior and derive verdicts, which is a core defense against weaponized email content. Outbreak filters (D) are correct because they use real-time threat intelligence to quarantine or delay suspicious messages during the early hours of a new outbreak, before traditional signature-based antivirus can catch them. SenderBase reputation service (E) is correct because it evaluates the reputation of sending IP addresses and domains to block or throttle mail from known spam and malware sources at the connection level. DHCP snooping (A) and VLAN isolation (B) are Layer 2 network access controls for switches and are not email security features, so they do not belong in this scenario.

Answer

DHCP snooping

Answer

VLAN isolation

Question 7

Which THREE factors are required to ensure the successful deployment of a Zero Trust microsegmentation architecture? (Choose THREE)

Accepted Answer

A centralized, automated enforcement policy engine. Option B is correct because Zero Trust microsegmentation depends on a centralized, automated enforcement policy engine (e.g., a policy controller/management plane) that consistently translates identity- and context-based rules into allow/deny decisions across all workloads without manual per-host configuration. Option C is correct because you cannot segment what you cannot see: complete visibility into every communication flow (east-west and north-south, typically via flow logs, packet inspection, or agents) is required to baseline legitimate traffic and detect anomalies. Option D is correct because identifying and classifying all workloads (by application, owner, sensitivity, and tags/labels) is the prerequisite for defining meaningful microsegmentation policies and grouping assets into segments. Option A is not correct because a flat network architecture is the opposite of what microsegmentation requires — it removes the internal boundaries that segmentation is meant to create. Option E is not correct because shared administrative credentials violate Zero Trust least-privilege and per-identity authentication principles, increasing lateral movement risk rather than enabling secure deployment.

Answer

A flat network architecture

Answer

Shared administrative credentials for all servers

Question 8

Which THREE of the following are best practices for securing a CI/CD pipeline itself?

Accepted Answer

Scan the pipeline code for vulnerabilities. Option B is correct because scanning the pipeline's own code (e.g., Jenkinsfiles, GitLab CI YAML, GitHub Actions workflows) with SAST/SCA tools detects injection flaws, insecure plugin usage, and vulnerable dependencies before they can be exploited to compromise builds. Option C is correct because isolated, ephemeral build runners (fresh containers or VMs destroyed after each job) prevent cross-job contamination, credential persistence, and lateral movement if a build is compromised. Option D is correct because a dedicated secret management service (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) provides encrypted storage, access control, auditing, and rotation of credentials instead of hardcoding them in pipeline files or environment variables. Option A is wrong because granting root access to all developers violates least privilege and massively expands the attack surface. Option E is wrong because unencrypted communication channels expose credentials, artifacts, and source code to interception; TLS should be enforced everywhere.

Answer

Allow root access to all developers

Answer

Use unencrypted communication channels

Question 9

Which design principle should be followed when implementing micro-segmentation in a data center?

Accepted Answer

Implement identity-based segmentation at the workload level.. Micro-segmentation is designed to enforce least-privilege east-west traffic controls at the granularity of individual workloads, not network topology. Identity-based segmentation at the workload level ties policy to the workload's identity (labels, tags, service accounts, or attributes) rather than to mutable network constructs like IP addresses or VLANs. This allows policies to follow the workload across hosts, clusters, and clouds, which is the core design principle behind Cisco Secure Workload, ACI, and zero-trust architectures.

Answer

Keep all servers in the same VLAN for simplicity.

Answer

Segment based only on IP addresses.

Answer

Disable all firewalls for maximum performance.

Question 10

Which TWO methods are used by Cisco Stealthwatch to detect anomalies in network traffic?

Accepted Answer

Behavioral baseline modeling of host and network patterns.. Cisco Stealthwatch detects anomalies primarily through behavioral baseline modeling (option C), which learns normal host and network communication patterns over time and then flags deviations such as unusual traffic volumes, new peer connections, or atypical protocol usage. It also relies on analysis of NetFlow, IPFIX, and other flow telemetry (option D), since flow records exported by routers and switches provide the scalable metadata Stealthwatch uses for visibility and threat detection. These two methods work together: flow telemetry supplies the data, and behavioral baselining turns it into anomaly alerts. Signature-based matching for every packet (A) and deep packet inspection of every payload byte (B) describe intrusion prevention or full-packet inspection approaches, not Stealthwatch's flow-based analytics. Manual input of all known malicious IP addresses (E) is not a detection method, as Stealthwatch does not depend on manually enumerating every bad IP.

Answer

Signature-based matching for every packet.

Answer

Deep packet inspection of every payload byte.

Answer

Manual input of all known malicious IP addresses.

Question 11

A design requirements document specifies a need for 'Network Segmentation' to contain breaches. Which Cisco technology provides the best granular control using Scalable Group Tags (SGTs)?

Accepted Answer

Cisco TrustSec (SGTs).. Cisco TrustSec with Scalable Group Tags (SGTs) provides the best granular control for network segmentation by enabling identity-based micro-segmentation. SGTs allow policies to be enforced based on group membership rather than IP addresses, which is more scalable and dynamic, effectively containing breaches by limiting lateral movement.

Answer

Cisco Secure Firewall interface zones.

Answer

VLAN-based segmentation.

Answer

Cisco Umbrella local policy.

Question 12

When gathering requirements for a security design, a customer specifies they need to automate the containment of infected endpoints discovered by Cisco Secure Endpoint. Which API integration should the architect document?

Accepted Answer

Cisco Secure Endpoint API. The Cisco Secure Endpoint API (formerly AMP for Endpoints) provides programmatic access to endpoint detection and response (EDR) capabilities, including the ability to isolate (contain) an infected endpoint. Since the requirement is to automate containment of endpoints discovered by Cisco Secure Endpoint, the architect must document the Cisco Secure Endpoint API. This API allows security teams to integrate with SIEM/SOAR platforms to trigger isolation actions automatically.

Answer

Cisco Umbrella Investigate API

Answer

Cisco Secure Firewall API

Answer

Cisco ISE REST API

Question 13

When designing for cloud-native API security, which TWO components are critical for ensuring visibility into API traffic? (Choose TWO)

Accepted Answer

API Gateway access logs. Option C (API Gateway access logs) is correct because the API gateway is the ingress point for all API calls, and its access logs capture per-request metadata such as client IP, request path, HTTP method, status code, latency, and API key usage, providing the authoritative audit trail needed for API visibility in cloud-native environments. Option E (Traffic telemetry from the service mesh sidecars) is correct because sidecar proxies (e.g., Envoy in Istio/Linkerd) intercept east-west service-to-service traffic and emit metrics, distributed traces, and L7 request telemetry (via OpenTelemetry, Prometheus, or access logs) that reveal internal API calls the gateway never sees. Option A is wrong because manually reading firewall rules only shows static allow/deny policy, not actual API request behavior or payload-level activity. Option B is wrong because disabling TLS exposes data in transit and violates security best practices; visibility should come from TLS-terminating proxies and observability tooling, not from weakening encryption. Option D is wrong because a physical network tap at the data center core cannot inspect encrypted east-west traffic and is impractical for dynamic, ephemeral cloud-native workloads.

Answer

Manual inspection of firewall rules

Answer

Disabling TLS for easier traffic analysis

Answer

Physical network tap at the data center core

Question 14

Which TWO of the following are true about 'Policy as Code' in Cisco security infrastructure?

Accepted Answer

Policies are stored in version control systems. Option A is correct because Policy as Code treats policy definitions as source artifacts, so they are stored in version control systems such as Git, enabling history, branching, peer review, and rollback. Option E is correct because Policy as Code supports automated testing and validation pipelines (for example, unit tests, linting, and CI checks) that verify policies before deployment, catching errors early. Option B is incorrect because policies are expressed in high-level declarative languages or DSLs (for example, HashiCorp Sentinel, OPA/Rego, or YAML), not assembly language. Option C is incorrect because automated application does not mean unreviewed application; Policy as Code typically includes review and approval gates in the CI/CD pipeline. Option D is incorrect because Policy as Code applies broadly to cloud, on-premises, and hybrid Cisco security infrastructure, not only cloud-native apps.

Answer

Policies are always written in assembly language

Answer

Policies are automatically applied without review

Answer

Policies are only for cloud-native apps

Question 15

Which THREE of the following are considered 'Threat Response' automation actions in a Cisco XDR environment?

Accepted Answer

Blocking a malicious file hash. In Cisco XDR, Threat Response automation actions are the enforcement steps that directly neutralize an identified indicator or compromised asset. Option B, blocking a malicious file hash, is correct because it pushes a hash-based block (e.g., via Cisco Secure Endpoint or Umbrella) so the known-bad file cannot execute or be downloaded again. Option D, blocking a malicious URL, is correct because it enforces a URL/domain block through Secure Internet Gateway or Umbrella DNS/web policies, preventing users from reaching the attacker's infrastructure. Option E, isolating an infected host, is correct because network isolation via Secure Endpoint cuts the endpoint off from the network while keeping the agent connected for investigation and remediation. Option A, sending a company-wide email, is merely a notification/communication step and not an enforcement action, and Option C, rebooting the server hardware, is a disruptive administrative operation that does not itself contain or remediate the threat.

Answer

Sending a company-wide email

Answer

Rebooting the server hardware

Question 16

In a DevSecOps pipeline, what is the benefit of 'Static Application Security Testing' (SAST)?

Accepted Answer

Identifying vulnerabilities in source code. Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing the application, looking for vulnerabilities such as SQL injection, buffer overflows, hardcoded secrets, and insecure API usage. In a DevSecOps pipeline, SAST is typically run early in the CI stage so developers get immediate feedback and can fix issues before code is merged. This shifts security left and reduces the cost of remediation compared to finding flaws in production.

Answer

Managing user passwords

Answer

Encrypting data in transit

Answer

Monitoring live production traffic

Question 17

Which TWO Cisco products are used to achieve 'Zero Trust' for remote users?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco Identity Services Engine (ISE) (B) is correct because it provides the policy decision and enforcement point for Zero Trust, performing identity-based authentication, authorization, posture assessment, and network access control (via RADIUS, 802.1X, and TrustSec/SGT) so that remote users are granted least-privilege access based on identity and device compliance. Cisco AnyConnect (D) is correct because it is the endpoint client that establishes the secure remote-access tunnel (SSL/TLS or IPsec IKEv2) and feeds endpoint posture and identity context into ISE, enabling continuous trust verification for remote users. Cisco Umbrella (A) is a DNS-layer and secure web gateway security service, not the identity/posture policy engine or the remote-access client required for Zero Trust enforcement. Cisco Stealthwatch (C) is network traffic visibility and anomaly detection (flow analysis), and Cisco Secure Email (E) is email security; neither provides the identity-based access control or remote-user tunnel needed for Zero Trust.

Answer

Cisco Umbrella.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Email.

Question 18

When designing a SaaS integration security plan, which THREE types of activities should be regularly reviewed in Cisco Cloudlock? (Choose THREE)

Accepted Answer

User login patterns and anomalies. Option A (User login patterns and anomalies) is correct because Cisco Cloudlock continuously monitors SaaS user behavior and applies User and Entity Behavior Analytics (UEBA) to detect anomalous logins such as impossible travel, brute-force attempts, or compromised credentials. Option C (External file sharing activities) is correct because Cloudlock's Data Loss Prevention (DLP) and sharing-exposure policies flag files shared publicly or with external domains via links, which is a core SaaS data-exfiltration risk that must be reviewed regularly. Option E (Third-party application integration permissions) is correct because Cloudlock's Cloud Security Assessment and app-governance features audit OAuth scopes granted to third-party apps, identifying over-permissioned or risky integrations that could access SaaS data. Option B (Physical building security logs) does not belong because Cloudlock is a cloud-access security broker (CASB) focused on SaaS API activity, not physical access control systems. Option D (Local printer configuration) does not belong because printer settings are endpoint/peripheral concerns outside Cloudlock's SaaS visibility and policy scope.

Answer

Physical building security logs

Answer

Local printer configuration

Question 19

In a SaaS security design, what is the role of a Cloud Access Security Broker (CASB)?

Accepted Answer

To provide visibility and control over SaaS usage. A CASB's core role is to provide visibility and control over SaaS usage — discovering shadow IT, monitoring user activity, enforcing DLP policies, and controlling access based on context. It sits between users and cloud services (via API or inline proxy) to apply security policy consistently across sanctioned and unsanctioned apps. This visibility-and-control function is the defining characteristic of a CASB.

Answer

To manage identity for the cloud

Answer

To act as a firewall for SaaS traffic

Answer

To encrypt end-to-end traffic

Question 20

A design architect is selecting a tool to monitor the security of a hybrid cloud environment. Which Cisco tool provides visibility into both on-premises and cloud (AWS/Azure) traffic flows?

Accepted Answer

Cisco Secure Network Analytics.. Cisco Secure Network Analytics (formerly Stealthwatch) provides network traffic visibility and threat detection across on-premises and hybrid cloud environments, including AWS and Azure. It uses flow telemetry (NetFlow, IPFIX) and behavioral analytics to detect anomalies in both data center and cloud traffic, making it the correct tool for hybrid cloud security monitoring.

Answer

Cisco ISE.

Answer

Cisco Secure Email.

Answer

Cisco Secure Firewall.