SDSI AI Automation And Devsecops Practice Test 3 — 15 Questions

Question 1

In an AI-based security architecture, which data source provides the most value for training an ML model to detect unauthorized data exfiltration?

Accepted Answer

NetFlow/IPFIX logs. NetFlow/IPFIX logs provide detailed metadata about network flows, including source/destination IPs, ports, protocols, and byte counts, which are highly valuable for training ML models to detect data exfiltration patterns (e.g., large transfers to unusual destinations). This data source captures the network behavior necessary to identify anomalies indicative of exfiltration.

Answer

User password history

Answer

System process logs

Answer

DHCP lease logs

Question 2

Which aspect of AI-driven security automation helps in 'Reducing Mean Time to Respond (MTTR)'?

Accepted Answer

Automated data correlation. Automated data correlation aggregates and analyzes telemetry from multiple sources (endpoints, network devices, identity systems, threat intelligence feeds) to rapidly identify and prioritize security incidents. By correlating disparate events automatically, security teams can detect and respond to threats much faster, directly reducing Mean Time to Respond (MTTR). This is a core value proposition of AI-driven security automation.

Answer

Updating hardware firmware

Answer

Reducing network latency

Answer

Increasing developer training

Question 3

In a DevSecOps pipeline, what is the benefit of 'Static Application Security Testing' (SAST)?

Accepted Answer

Identifying vulnerabilities in source code. Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing the application, looking for vulnerabilities such as SQL injection, buffer overflows, hardcoded secrets, and insecure API usage. In a DevSecOps pipeline, SAST is typically run early in the CI stage so developers get immediate feedback and can fix issues before code is merged. This shifts security left and reduces the cost of remediation compared to finding flaws in production.

Answer

Managing user passwords

Answer

Encrypting data in transit

Answer

Monitoring live production traffic

Question 4

Which THREE of the following are essential components of a robust DevSecOps security architecture for Cisco infrastructure?

Accepted Answer

Infrastructure as Code (IaC). Infrastructure as Code (IaC) (A) is essential because it lets Cisco device configurations, policies, and cloud/network resources be defined declaratively in version-controlled templates, enabling repeatable, auditable, and peer-reviewed deployments instead of error-prone manual CLI changes. Continuous Monitoring (C) is required to detect drift, unauthorized configuration changes, and threats in real time across Cisco infrastructure, feeding telemetry into SIEM/SOAR and compliance dashboards so issues are caught and remediated quickly. Automated Testing (D) is essential to validate IaC templates and security controls in CI/CD pipelines (e.g., unit, integration, and policy-as-code checks) before changes reach production, preventing misconfigurations from being deployed. Manual Review Committees (B) are not a core DevSecOps component because they introduce slow, human-gated approvals that contradict the automation and continuous-delivery principles of DevSecOps, even if some review may still occur. Isolated air-gapped networks (E) are not essential to a DevSecOps architecture; while useful in specific high-security environments, they prevent the continuous integration, delivery, and monitoring that DevSecOps depends on.

Answer

Manual Review Committees

Answer

Isolated air-gapped networks

Question 5

Which TWO of the following capabilities does Cisco Secure Firewall (FMC) provide to support automated security workflows?

Accepted Answer

Integration with external Threat Intel feeds. Option A is correct because FMC supports integration with external Threat Intelligence feeds (e.g., via STIX/TAXII or custom feeds) to automatically ingest and apply indicators of compromise, enabling dynamic, automated blocking and detection workflows. Option E is correct because FMC exposes a REST API that allows programmatic management of objects, access control policies, and rules, which is the foundation for automation and orchestration with tools like Ansible, Python scripts, or SOAR platforms. The unmarked options do not belong: FMC is not a container orchestration platform (B), does not perform automated code refactoring (C), and does not include an on-board AI training engine for model development (D); its AI/ML capabilities are for detection, not user-driven model training.

Answer

Native container orchestration

Answer

Automated code refactoring

Answer

On-board AI training engine

Question 6

Which TWO of the following identify risks associated with using AI for security automation?

Accepted Answer

Adversarial machine learning / poisoning. Option C is correct because adversarial machine learning and data poisoning directly target AI models used in security automation: attackers can inject malicious or mislabeled training data or craft adversarial inputs that cause the model to misclassify threats, evade detection, or generate false alerts, undermining the automation's reliability. Option E is correct because model drift occurs when the statistical patterns in production data change over time and diverge from the training distribution, causing the model's accuracy and detection performance to degrade, which is a recognized ongoing risk for deployed AI security systems that requires monitoring and retraining. The unmarked options do not belong: faster network throughput (A) is a performance benefit, not a risk; too many security updates (B) is an operational patch-management concern unrelated to AI-specific risks; and increased hardware cost (D) is a general infrastructure expense, not a risk inherent to using AI for security automation.

Answer

Faster network throughput

Answer

Too many security updates

Answer

Increased hardware cost

Question 7

Which THREE of the following are key features of Cisco XDR (formerly SecureX) in an automated pipeline?

Accepted Answer

Workflow orchestration. Cisco XDR (formerly SecureX) is built around an automation pipeline in which Workflow orchestration (A) is a core feature, allowing security teams to design, trigger, and chain automated response actions across integrated Cisco and third-party tools. Incident management and response (B) is also central, since XDR correlates detections into incidents, enriches them, and drives response actions from a single console. Threat intelligence aggregation (C) is likewise a key capability, as XDR ingests and normalizes threat intel from multiple sources (e.g., Cisco Talos, third-party feeds) to enrich detections and inform automated workflows. Automated server patching (D) is not a Cisco XDR function; patching is handled by endpoint management or vulnerability/patch management tools, not by the XDR platform itself. Network packet capture hardware (E) is a physical appliance concern (e.g., dedicated capture devices or switches with SPAN/TAP), not a feature of the Cisco XDR software platform.

Answer

Automated server patching

Answer

Network packet capture hardware

Question 8

Which TWO of the following are benefits of using 'Infrastructure as Code' (IaC) with Cisco Secure Firewall?

Accepted Answer

Improved auditability of changes. Option B (Improved auditability of changes) is correct because IaC stores firewall configuration as version-controlled declarative files (e.g., Terraform HCL or Ansible playbooks in Git), so every change is tracked with commit history, diffs, and author metadata, providing a clear audit trail. Option C (Configuration consistency across environments) is correct because the same IaC templates are applied repeatedly to dev, test, and production, eliminating manual CLI drift and ensuring identical policy, NAT, and interface settings across deployments. Option A is incorrect because IaC addresses configuration management, not traffic forwarding or bandwidth optimization. Option D is incorrect because firewall policies are still required; IaC only automates how those policies are defined and deployed. Option E is incorrect because IaC provisions and configures software, but it cannot physically repair failed hardware.

Answer

Reduction of network bandwidth usage

Answer

Elimination of the need for firewall policies

Answer

Automatic hardware repair

Question 9

Which THREE of the following are key AI/ML design considerations when selecting a security automation platform?

Accepted Answer

Explainability and transparency (XAI). Option B (Explainability and transparency, XAI) is correct because security automation platforms increasingly rely on AI/ML models to triage alerts and make risk decisions, so analysts and auditors must be able to understand why a model produced a given verdict to trust, validate, and defend it. Option C (API integration and extensibility) is correct because a security automation platform must interoperate with SIEM, SOAR, EDR, ticketing, and threat-intel systems via REST APIs, webhooks, and plugins, so its ability to integrate and be extended determines how well the AI/ML capabilities fit existing workflows. Option E (Data quality and labeling) is correct because ML model accuracy in security use cases depends directly on well-curated, correctly labeled, and representative training data (e.g., labeled true/false positives), and poor data quality leads to high false-positive rates and unreliable automation. Option A is not a key AI/ML design consideration because vendor team headcount does not determine model explainability, integration capability, or data quality. Option D is not a key AI/ML design consideration for platform selection because local GPU acceleration is an infrastructure/deployment detail, not a core AI/ML design factor, and many platforms deliver inference via cloud or vendor-managed services.

Answer

Number of employees on the vendor's team

Answer

Local hardware GPU acceleration

Question 10

Which THREE of the following represent common challenges when implementing automated security in a legacy environment?

Accepted Answer

Cultural resistance to change. Cultural resistance to change (A) is a correct challenge because security automation alters established operational workflows and requires staff to trust tooling over manual, experience-based procedures, and legacy IT teams often resist ceding control to automated remediation. Fragmented or inconsistent log data (D) is correct because legacy systems frequently emit proprietary or non-standard formats (e.g., syslog variants, flat files, no CEF/LEEF normalization), which breaks correlation, SIEM ingestion, and automated event-driven response. Lack of native API support in legacy devices (E) is correct because many older appliances and applications expose only CLI, SNMP, or screen-scraping interfaces rather than REST/SOAP APIs, forcing brittle scripting and preventing clean integration with orchestration and SOAR platforms. Option B is not a challenge in this context, since documentation is generally beneficial and not a barrier to automation, and option C is incorrect because excessive API performance is a benefit, not a problem — the real legacy issue is the absence or poor performance of APIs.

Answer

Too much documentation

Answer

Excessive API performance

Question 11

Which TWO of the following steps are required to integrate a security tool (like Cisco Secure Firewall) into a CI/CD pipeline?

Accepted Answer

Configure API authentication credentials. Option C is correct because integrating a security tool such as Cisco Secure Firewall into a CI/CD pipeline requires configuring API authentication credentials so the pipeline can programmatically authenticate to the firewall's REST API and push policy or configuration changes. Option E is correct because an infrastructure provisioning tool (e.g., Terraform, Ansible, or similar IaC tooling) is needed to declaratively deploy and manage the firewall configuration as part of the automated pipeline stages. Option A is not required, since integration is a software/API-level task and does not mandate replacing existing firewall hardware. Option B is wrong because hardcoding credentials in the build file is an insecure anti-pattern; secrets should be stored in a vault or secret manager. Option D is wrong because disabling all firewall rules for testing would remove the very security controls being validated and is not a legitimate integration step.

Answer

Replace the existing firewall hardware

Answer

Hardcode credentials in the pipeline build file

Answer

Disable all firewall rules for testing

Question 12

Which THREE of the following technologies should be combined to create a 'Security-as-Code' pipeline for Cisco infrastructure?

Accepted Answer

Git (Version Control). Git (A) is correct because a Security-as-Code pipeline requires version control to store, track, review, and audit infrastructure and policy definitions as code, enabling pull requests, branching, and rollback of security configurations. Static Analysis (SAST) tools (C) are correct because they scan the declarative code and templates for misconfigurations, insecure defaults, and policy violations before deployment, shifting security left in the CI/CD pipeline. Terraform or Ansible (D) is correct because these configuration-management and infrastructure-as-code tools actually apply the desired security posture to Cisco devices and platforms in an idempotent, repeatable, automated manner. Physical console cables (B) are not part of a code-driven pipeline since they represent manual out-of-band access rather than automated, versioned deployment. Local SQL databases (E) are not a Security-as-Code component; state and inventory are typically handled by the IaC tool's state files or a remote backend, not a local SQL store.

Answer

Physical console cables

Answer

Local SQL databases

Question 13

Which TWO of the following are common benefits of using API-based security automation?

Accepted Answer

Consistent enforcement across infrastructure. Option C is correct because API-based security automation applies policies programmatically and uniformly across cloud, on-premises, and hybrid infrastructure, ensuring the same controls are enforced everywhere without manual drift. Option E is correct because automating security checks and remediation through APIs integrates into CI/CD pipelines, allowing faster, repeatable deployments without slowing down release cycles. Option A is incorrect because automation can detect and remediate known issues but cannot guarantee the removal of all vulnerabilities, especially unknown or zero-day flaws. Option B is incorrect because memory is a hardware/resource constraint unrelated to API-based automation. Option D is incorrect because automation augments analysts rather than eliminating the need for human judgment, triage, and incident response.

Answer

Automatic removal of all vulnerabilities

Answer

Unlimited system memory

Answer

Elimination of all human security analysts

Question 14

Which THREE of the following are best practices for securing a CI/CD pipeline itself?

Accepted Answer

Scan the pipeline code for vulnerabilities. Option B is correct because scanning the pipeline's own code (e.g., Jenkinsfiles, GitLab CI YAML, GitHub Actions workflows) with SAST/SCA tools detects injection flaws, insecure plugin usage, and vulnerable dependencies before they can be exploited to compromise builds. Option C is correct because isolated, ephemeral build runners (fresh containers or VMs destroyed after each job) prevent cross-job contamination, credential persistence, and lateral movement if a build is compromised. Option D is correct because a dedicated secret management service (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) provides encrypted storage, access control, auditing, and rotation of credentials instead of hardcoding them in pipeline files or environment variables. Option A is wrong because granting root access to all developers violates least privilege and massively expands the attack surface. Option E is wrong because unencrypted communication channels expose credentials, artifacts, and source code to interception; TLS should be enforced everywhere.

Answer

Allow root access to all developers

Answer

Use unencrypted communication channels

Question 15

Which TWO of the following are common components of an AI-driven security operations center (SOC)?

Accepted Answer

Automated incident response playbooks. Automated incident response playbooks (A) are a core AI-driven SOC component because they use orchestration, automation, and response (SOAR) capabilities to trigger predefined actions—such as isolating a host, disabling an account, or blocking an IP—based on alerts, dramatically reducing mean time to respond. User and Entity Behavior Analytics (UEBA) (E) is also fundamental, as it applies machine learning and statistical baselining to detect anomalous user and entity activity (e.g., impossible travel, unusual data access) that signature-based tools would miss. Manual daily log exporting (B) is not a common AI-driven SOC component; it is a labor-intensive, non-scalable manual process that AI/automation aims to replace. Word processing software (C) is general office productivity tooling unrelated to security operations. Physical surveillance cameras (D) belong to physical security systems, not the AI-driven logical security operations center components described here.

Answer

Manual daily log exporting

Answer

Word processing software

Answer

Physical surveillance cameras