SDSI Practice Test 8 — 10 Questions

Question 1

A manufacturing firm wants to secure IoT devices using Cisco TrustSec. Which mechanism ensures that traffic from IoT sensors is isolated from corporate traffic without relying on complex VLAN/ACL management?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Scalable Group Tags (SGTs). Cisco TrustSec uses Scalable Group Tags (SGTs) embedded in the packet (via Cisco Metadata or inline tagging) to enforce group-based policy. IoT sensors are assigned an SGT, and a Security Group ACL (SGACL) on the enforcement device permits or denies traffic based on source/destination tag pairs — no VLANs or IP-based ACLs required. This scales cleanly because policy follows the tag, not the topology.

Answer

Dynamic ARP Inspection

Answer

Private VLANs (PVLANs)

Answer

VLAN Trunking Protocol

Question 2

Which tool provides visibility into encrypted traffic without full decryption in a Cisco network design?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) is designed to identify malware and threats in encrypted traffic without full decryption by using flow metadata, sequence of packet lengths and times (SPLT), and machine learning. It leverages Cisco's Talos threat intelligence and can run on Catalyst switches and ISR/ASR routers. Firepower IPS, ISE, and Stealthwatch do not provide ETA's decryption-free encrypted traffic analysis.

Answer

Cisco Firepower IPS.

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco Stealthwatch.

Question 3

What is the benefit of integrating Cisco Secure Email with Cisco Threat Intelligence (Talos)?

Accepted Answer

It provides real-time threat intelligence for filtering.. Integrating Cisco Secure Email with Cisco Talos provides real-time threat intelligence that feeds directly into the email filtering pipeline. Talos continuously analyzes global email traffic, malware campaigns, and phishing infrastructure, and pushes that intelligence to Secure Email so messages can be blocked or quarantined based on current threat data rather than static signatures. This dynamic, reputation-based filtering is the core security benefit of the integration.

Answer

It increases email storage capacity.

Answer

It creates automated email backups.

Answer

It allows for remote administration of the email server.

Question 4

During a post-incident review, an architect discovers that the SOC could not correlate logs across the Cisco Secure Email and Cisco Secure Endpoint platforms. Which integration should the design specify to improve future incident response?

Accepted Answer

Cisco Security Cloud Control (SecureX). Cisco Security Cloud Control (formerly SecureX) is the platform that aggregates telemetry from Cisco Secure Email, Secure Endpoint, Secure Firewall, and other products into a unified incident view. It enables cross-platform correlation, threat hunting, and automated response workflows, directly solving the SOC's inability to correlate logs across email and endpoint.

Answer

Cisco Webex Control Hub

Answer

Cisco DNA Center

Answer

Cisco ThousandEyes

Question 5

A security designer is choosing a tool for DNS-layer security. Which Cisco product is the standard choice?

Accepted Answer

Cisco Umbrella.. Cisco Umbrella is Cisco's cloud-delivered DNS-layer security platform, blocking malicious domains and IPs before a connection is established. It is the standard Cisco product for DNS-layer security, providing recursive DNS with threat intelligence from Cisco Talos. This makes it the correct choice for DNS-layer protection.

Answer

Cisco Secure Endpoint.

Answer

Cisco ISE.

Answer

Cisco Secure Firewall.

Question 6

Which protocol is used for the control plane communication between Cisco SD-WAN controllers?

Accepted Answer

OMP.. Cisco SD-WAN uses the Overlay Management Protocol (OMP) for control plane communication between SD-WAN controllers (vManage, vBond, vSmart) and between controllers and WAN edge devices. OMP carries routing information, policy, and TLOC (transport locator) attributes, forming the overlay control plane that enables SD-WAN's dynamic path selection.

Answer

EIGRP.

Answer

BGP.

Answer

OSPF.

Question 7

What is the primary function of the 'AnyConnect' (Secure Client) profile?

Accepted Answer

To manage connection and security settings for the endpoint.. The AnyConnect (Secure Client) profile is an XML file that defines how the endpoint's VPN client behaves, including connection entries, authentication methods, split tunneling, and security settings. It is pushed from the headend (ASA or FTD) to the client, allowing centralized management of connection and security policies. This makes option A correct because the profile's primary function is to manage connection and security settings for the endpoint.

Answer

To act as an identity provider.

Answer

To store user credentials.

Answer

To monitor CPU usage on the host.

Question 8

Which THREE design principles are key for a multi-cloud security strategy?

Accepted Answer

Consistent security policies across environments.. Option B is correct because a multi-cloud security strategy requires consistent security policies across environments, so that the same access control, inspection, and segmentation rules are enforced uniformly in AWS, Azure, GCP, and on-premises rather than drifting per provider. Option D is correct because unified threat visibility aggregates logs, events, and telemetry from all clouds into a single view, enabling correlation and detection of threats that span multiple providers instead of relying on fragmented per-cloud consoles. Option E is correct because a centralized management plane such as Cisco Firepower Management Center (FMC) lets administrators define policy once and push it to firewalls and sensors across clouds, which is the practical mechanism for achieving the consistency and visibility described above. Option A is not correct because using different, uncoordinated security tools per cloud creates policy gaps and operational complexity, which is the opposite of a sound multi-cloud design. Option C is not correct because allowing all cross-cloud traffic violates least-privilege and zero-trust principles; cross-cloud flows should be explicitly permitted, inspected, and segmented.

Answer

Using different security tools for each cloud.

Answer

Allowing all cross-cloud traffic.

Question 9

An organization experiences a breach where a malicious file was downloaded. Which Cisco product can be used to perform 'retrospective' analysis on that file's history across the organization?

Accepted Answer

Cisco Secure Endpoint (AMP).. Cisco Secure Endpoint (formerly AMP for Endpoints) maintains a cloud-based file reputation and retrospective analysis capability. When a file is later determined to be malicious, Secure Endpoint can retroactively query its telemetry to identify every endpoint where that file was seen, enabling retrospective detection and response. Stealthwatch is network flow analytics, Secure Email handles email-borne threats, and Umbrella is DNS-layer security — none provide endpoint file-history retrospective analysis.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Email.

Answer

Cisco Umbrella.

Question 10

In DevSecOps, what is the role of an 'Artifact Repository' such as Artifactory in relation to security?

Accepted Answer

Store and secure immutable build artifacts. An artifact repository like Artifactory stores and secures immutable build artifacts, providing a trusted source of truth for binaries, container images, and packages. It supports security through access controls, vulnerability scanning integration, and immutability guarantees that prevent tampering with released artifacts. This makes it a critical control point in the DevSecOps supply chain.

Answer

Manage user identities

Answer

Monitor real-time network traffic

Answer

Execute live security testing