SDSI Practice Test 9 — 10 Questions

Question 1

A security architect is designing a SOC response workflow using Cisco SecureX Orchestration. Which mechanism is most effective for automated remediation of an endpoint identified as compromised via Cisco Secure Endpoint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Triggering a workflow that executes the isolate endpoint action in Cisco Secure Endpoint via API.. Cisco SecureX Orchestration is designed to automate security workflows across Cisco and third-party products. The most direct and effective remediation for a compromised endpoint identified by Cisco Secure Endpoint is to isolate the endpoint using its native API. The isolate endpoint action in Secure Endpoint cuts off all network communication except for the management connection to the Secure Endpoint cloud, preventing lateral movement and data exfiltration while allowing further investigation. This is a built-in, automated response that can be triggered via SecureX Orchestration, making it the correct choice.

Answer

Deploying an umbrella policy change to redirect the host traffic to a sinkhole.

Answer

Configuring a local script on the Cisco ASA to block the host IP address.

Answer

Using Cisco Defense Orchestrator to push a new access control policy to the endpoint.

Question 2

What is the primary benefit of 'Visibility' in the Cisco API Security architecture?

Accepted Answer

Identification of all APIs and shadow endpoints. Visibility in Cisco API Security means discovering and inventorying every API — including undocumented 'shadow' endpoints that teams spun up outside formal governance. Without this inventory, no other security control (auth, rate limiting, schema validation) can be applied to the right surface.

Answer

Automatic translation of API code

Answer

Reduction of API storage costs

Answer

Increased performance of the API calls

Question 3

An organization is deploying APIs on AWS and using Cisco API Security to protect them. The security team needs to detect 'Shadow APIs' that are being called but are not registered in the API documentation. How should the solution be configured?

Accepted Answer

Integrate API Security with the cloud traffic logs to perform behavior analysis and discovery. Cisco API Security discovers shadow APIs by ingesting traffic data (cloud load balancer logs, API gateway logs, VPC flow logs, or agent-based telemetry) and performing behavioral analysis to identify endpoints that are actually being invoked but do not appear in the registered API documentation. This traffic-based discovery is the only way to surface unregistered/undocumented routes, since documentation alone cannot reveal what is truly being called. Integrating with cloud traffic logs enables continuous discovery and comparison against the known API inventory.

Answer

Manually add every route to the Swagger documentation file

Answer

Configure OAuth scopes to restrict access to the API Gateway

Answer

Enable WAF block mode for all undefined routes

Question 4

Which TWO of the following are common components of an AI-driven security operations center (SOC)?

Accepted Answer

Automated incident response playbooks. Automated incident response playbooks (A) are a core AI-driven SOC component because they use orchestration, automation, and response (SOAR) capabilities to trigger predefined actions—such as isolating a host, disabling an account, or blocking an IP—based on alerts, dramatically reducing mean time to respond. User and Entity Behavior Analytics (UEBA) (E) is also fundamental, as it applies machine learning and statistical baselining to detect anomalous user and entity activity (e.g., impossible travel, unusual data access) that signature-based tools would miss. Manual daily log exporting (B) is not a common AI-driven SOC component; it is a labor-intensive, non-scalable manual process that AI/automation aims to replace. Word processing software (C) is general office productivity tooling unrelated to security operations. Physical surveillance cameras (D) belong to physical security systems, not the AI-driven logical security operations center components described here.

Answer

Manual daily log exporting

Answer

Word processing software

Answer

Physical surveillance cameras

Question 5

Which TWO methods are effective for securing email infrastructure against phishing?

Accepted Answer

DMARC/SPF/DKIM implementation.. Option B is correct because implementing SPF, DKIM, and DMARC together authenticates the sending domain: SPF authorizes sending IPs via DNS TXT records, DKIM cryptographically signs messages with a public key published in DNS, and DMARC tells receivers how to handle messages that fail SPF/DKIM alignment, which directly blocks spoofed sender addresses used in phishing. Option D is correct because Cisco Secure Email sandboxing detonates suspicious attachments and URLs in an isolated environment to detect zero-day malware and credential-harvesting links that signature-based filters miss, adding a behavioral layer of phishing defense. Option A is wrong because using only local SMTP relays does not authenticate senders or filter malicious content and can even worsen spoofing exposure. Option C is wrong because disabling all attachments is overly broad, breaks legitimate business mail, and does not stop phishing links or social-engineering text. Option E is wrong because allowing all inbound mail traffic removes any filtering or policy enforcement, directly enabling phishing delivery.

Answer

Using only local SMTP relays.

Answer

Disabling all attachments in emails.

Answer

Allowing all inbound mail traffic.

Question 6

When assessing risk for a remote office branch, the architect decides to use Cisco Umbrella. Which requirement is addressed by implementing the Umbrella roaming client for branch endpoints?

Accepted Answer

Enforcing security policies on endpoints even when they are off the corporate network.. The Umbrella roaming client is lightweight software installed on endpoints (laptops, desktops) that redirects DNS queries to Cisco Umbrella's global network regardless of where the endpoint is — on-premises, at home, or on public Wi-Fi. This ensures DNS-layer security policy enforcement (blocking malicious domains, C2 callbacks, phishing) follows the user off the corporate network, which is the core value proposition of the roaming client. It does not perform DPI, manage router firewalls, or encrypt site-to-site VPN traffic.

Answer

Providing deep packet inspection for local branch-to-branch file transfers.

Answer

Managing local firewall rules on the branch router.

Answer

Providing local site-to-site VPN encryption for branch traffic.

Question 7

A security architect is designing a DR strategy. Which feature of Cisco Secure Firewall ensures that configurations are synchronized between primary and backup units in a high-availability pair?

Accepted Answer

Cisco Secure Firewall Failover Link.. In a Cisco Secure Firewall high-availability (failover) pair, the failover link is the dedicated interface used to exchange hello/heartbeat messages and synchronize state and configuration between the primary and secondary units. It carries the failover communication that keeps the standby unit's configuration and connection state consistent with the active unit. Without a functioning failover link, the pair cannot maintain synchronized state or properly detect peer health.

Answer

Cisco Defense Orchestrator auto-sync.

Answer

Cisco Identity Services Engine RADIUS sync.

Answer

Cisco FMC policy deployment.

Question 8

Which TWO factors must be considered when designing SaaS security using Cisco Cloudlock to ensure compliance with data protection regulations? (Choose TWO)

Accepted Answer

Establishing remediation workflows for policy violations. Option B is correct because Cisco Cloudlock's value in a SaaS compliance program depends on operationalizing its policy engine: when Cloudlock detects a violation (for example, a DLP match or a risky third-party app), remediation workflows such as automated quarantine, revoke sharing, notify user, or alert admin are what actually enforce the regulation and produce an auditable response trail. Option C is correct because Cloudlock's DLP and data classification policies are the foundation of the entire control: you must define which data types are regulated (for example, PII, PCI, PHI) and how they are classified so Cloudlock's API-based scanning of SaaS platforms like Microsoft 365, Google Workspace, and Salesforce can detect and act on them. Option A is not relevant because BGP peering is an internet routing concern for network connectivity, not a SaaS data-protection control, and Cloudlock operates via APIs rather than routing. Option D is not relevant because hardware-based encryption is a vendor infrastructure matter, not something the Cloudlock customer designs or configures for compliance. Option E is not relevant because Cloudlock is an API-based, agentless CASB that monitors sanctioned SaaS usage from the cloud, so endpoint agents are not required.

Answer

Configuring BGP peering with the SaaS provider

Answer

Enabling hardware-based encryption for the SaaS vendor

Answer

Installing agents on all end-user laptops

Question 9

A security architect is designing a remote-work solution. What is the benefit of using Split Tunneling in Cisco Secure Client?

Accepted Answer

It allows internal traffic to be routed over the VPN while local traffic bypasses it.. Split tunneling in Cisco Secure Client allows the VPN client to route only traffic destined for corporate internal networks through the encrypted VPN tunnel, while all other traffic (e.g., internet browsing, local LAN resources) is sent directly out the local network interface. This reduces bandwidth consumption on the VPN headend, lowers latency for cloud/SaaS apps, and avoids backhauling personal traffic. The correct option captures this exact behavior: internal traffic over VPN, local traffic bypasses it.

Answer

It provides dual authentication layers for the user.

Answer

It encrypts only the authentication phase of the VPN connection.

Answer

It enforces all traffic through the corporate firewall.

Question 10

In an AI-enhanced security design, what is 'Supervised Learning' primarily used for?

Accepted Answer

Classification of malicious vs. benign data. Supervised learning uses labeled training data to learn a mapping from inputs to outputs, making it ideal for classification tasks such as distinguishing malicious from benign data. In AI-enhanced security, labeled datasets of known malware and clean files train models to classify new, unseen samples. This is the foundational use case for supervised learning in security analytics.

Answer

Predicting hardware failure

Answer

Automated documentation generation

Answer

Unsupervised clustering of anomalies