SDSI Practice Questions 2 — 50 Questions

Question 1

You are designing an API security strategy. Which mechanism is used to verify the integrity and authenticity of API requests in a microservices environment?

Accepted Answer

JSON Web Tokens (JWT). JWT (JSON Web Token) is the industry standard for securing API requests, typically verified by an API gateway or service mesh.

Answer

SSL/TLS termination at the server

Answer

Static IP allowlisting

Answer

Standard Basic Authentication

Question 2

You are performing a security assessment of a containerized application architecture. Which TWO of the following configurations are critical for ensuring secure communication between pods in a Cisco ACI-managed Kubernetes environment? (Choose TWO)

Accepted Answer

Defining Contracts between EPGs to permit specific traffic types.. In ACI-managed Kubernetes (CNA), security is enforced through Endpoint Groups (EPGs) and contracts that define communication policies between different service tiers.

Answer

Disabling the ACI CNI plugin to allow native Kubernetes network policies.

Answer

Configuring all pods to reside in a single flat, non-segmented network.

Answer

Using physical cabling to separate traffic by VLAN.

Question 3

In a DevSecOps pipeline, what is the benefit of 'Static Application Security Testing' (SAST)?

Accepted Answer

Identifying vulnerabilities in source code. SAST analyzes source code for security vulnerabilities *without* executing the code, catching flaws early.

Answer

Managing user passwords

Answer

Encrypting data in transit

Answer

Monitoring live production traffic

Question 4

Which TWO of the following are common components of an AI-driven security operations center (SOC)?

Accepted Answer

Automated incident response playbooks. Automated incident response and behavior analysis are central to AI-driven SOCs.

Answer

Manual daily log exporting

Answer

Word processing software

Answer

Physical surveillance cameras

Question 5

You are designing a microsegmentation strategy using Cisco Secure Workload (formerly Tetration) for a multi-tier application. Which mechanism allows you to enforce fine-grained security policies between application tiers while maintaining visibility across the hybrid cloud?

Accepted Answer

Using policy-based agents on endpoints to enforce segmentation. Cisco Secure Workload uses software agents on endpoints to enforce microsegmentation policies based on workload identity, rather than IP addresses.

Answer

Applying static ACLs on the core switch

Answer

Implementing Cisco ASA zone-based firewalling

Answer

Configuring VRF-Lite on the distribution layer

Question 6

Which TWO of the following identify risks associated with using AI for security automation?

Accepted Answer

Adversarial machine learning / poisoning. Model drift and adversarial machine learning (data poisoning) are two major concerns.

Answer

Faster network throughput

Answer

Too many security updates

Answer

Increased hardware cost

Question 7

You are designing an API security layer for a public-facing web application. Which security control is most effective against 'Broken Function Level Authorization' (BFLA) attacks?

Accepted Answer

Strict RBAC/ABAC authorization checks on every function. BFLA occurs when a user accesses functions they shouldn't. Proper authorization logic must be enforced at every API endpoint.

Answer

Rate limiting

Answer

Blocking traffic from known malicious IP addresses

Answer

Encrypting all traffic with TLS 1.3

Question 8

What is the primary role of a Service Mesh in an API architecture?

Accepted Answer

To abstract and manage service-to-service communication. A service mesh handles the communication, observability, security, and traffic management between microservices.

Answer

To perform deep packet inspection of external user traffic

Answer

To act as a physical load balancer

Answer

To replace the need for API documentation

Question 9

When designing a secure API environment, which THREE threat categories should be prioritized for detection by Cisco API Security? (Choose THREE)

Accepted Answer

Broken Object Level Authorization (BOLA). API security focuses on common threats like BOLA, excessive data exposure, and broken authentication.

Answer

Local fiber optic cable breaks

Answer

Standard server hardware failures

Question 10

A security architect is designing a SOC response workflow using Cisco SecureX Orchestration. Which mechanism is most effective for automated remediation of an endpoint identified as compromised via Cisco Secure Endpoint?

Accepted Answer

Triggering a workflow that executes the isolate endpoint action in Cisco Secure Endpoint via API.. Cisco SecureX Orchestration uses workflow automation to link threat intelligence from Secure Endpoint to automated containment actions like isolation.

Answer

Deploying an umbrella policy change to redirect the host traffic to a sinkhole.

Answer

Configuring a local script on the Cisco ASA to block the host IP address.

Answer

Using Cisco Defense Orchestrator to push a new access control policy to the endpoint.

Question 11

An organization experiences a surge in successful phishing attacks. The post-incident architecture adaptation requires automated email analysis. Which Cisco product provides the necessary API for integrating email sandboxing data into a SOAR platform?

Accepted Answer

Cisco Secure Email API.. Cisco Secure Email (formerly ESA) offers extensive APIs for extracting threat intelligence and sandboxing results from Advanced Malware Protection (AMP).

Answer

Cisco Firepower Management Center REST API.

Answer

Cisco Defense Orchestrator API.

Answer

Cisco Identity Services Engine ERS API.

Question 12

A security architect is developing a requirements document for a SOC. Which Cisco capability allows the SOC to prioritize alerts by correlating threats across network, endpoint, and cloud?

Accepted Answer

Cisco SecureX cross-product correlation.. Cisco SecureX provides cross-product correlation to reduce alert fatigue and prioritize incidents.

Answer

Cisco Stealthwatch alert grouping.

Answer

Cisco Secure Firewall management center alert correlation.

Answer

Cisco Identity Services Engine monitoring.

Question 13

An architect is reviewing post-incident logs in Cisco SecureX. Which feature allows the analyst to see the timeline of events from different integrated products in one view?

Accepted Answer

SecureX Incident/Event Timeline.. The 'Incident' or 'Timeline' view in SecureX aggregates all related events across the Cisco security stack.

Answer

Stealthwatch Alarms view.

Answer

FMC Event Viewer.

Answer

ISE Auth Reports.

Question 14

When conducting a risk assessment, what is the best way to determine the value of an asset to the organization?

Accepted Answer

Perform a Business Impact Analysis (BIA).. The business impact analysis (BIA) is the standard method for determining asset value.

Answer

Check the manufacturer's list price.

Answer

Ask the IT department for their opinion.

Answer

Check the hardware replacement cost.

Question 15

Which THREE actions are recommended when designing a secure API architecture using Cisco API Security to mitigate OWASP API Top 10 threats? (Choose THREE)

Accepted Answer

Implement strict schema validation on all incoming API requests. Mitigation requires visibility, schema validation, and behavioral analysis to stop common attacks like BOLA and excessive data exposure.

Answer

Allow all API traffic to bypass authentication for performance

Answer

Disable all logging of API request headers

Question 16

Which THREE criteria should be used to design microsegmentation policies in Cisco Secure Workload? (Choose THREE)

Accepted Answer

Workload attributes and labels (metadata). Effective microsegmentation policies rely on workload identity, application context, and observed communication patterns rather than just IP addresses.

Answer

Physical switch port IDs

Answer

Dynamic IP addresses of the servers

Question 17

Which Cisco API Security feature is used to prevent attackers from using automated scripts to brute-force API endpoints?

Accepted Answer

API rate limiting and behavioral analytics. Rate limiting and behavioral analysis are the primary tools to stop automated script attacks against API endpoints.

Answer

DNS-layer filtering

Answer

JWT token encryption

Answer

Schema validation

Question 18

Which security design decision is most critical when migrating an application to the cloud, specifically regarding API security?

Accepted Answer

Implementing API security and identity-based access at the application layer. When moving to the cloud, the perimeter dissolves. You must transition from perimeter-based security to a model that secures the APIs themselves, regardless of where they are accessed from.

Answer

Relying on the cloud provider's firewall

Answer

Maintaining a VPN tunnel to the on-premise data center

Answer

Disabling all API endpoints that are not internal

Question 19

When designing for cloud-native API security, which TWO components are critical for ensuring visibility into API traffic? (Choose TWO)

Accepted Answer

API Gateway access logs. Visibility into APIs requires capturing traffic at the gateway and analyzing logs to map the flow and identify potential threats.

Answer

Manual inspection of firewall rules

Answer

Disabling TLS for easier traffic analysis

Answer

Physical network tap at the data center core

Question 20

What is the primary design benefit of deploying Cisco Secure Workload as a 'software-only' solution in a public cloud environment?

Accepted Answer

It provides consistent security enforcement without relying on physical network appliances. It allows the organization to utilize native cloud features while maintaining consistent security policy across clouds without the latency of hair-pinning traffic to a physical appliance.

Answer

It reduces the need for VPC configuration

Answer

It guarantees 100% protection against all malware

Answer

It automates the creation of virtual machines