SDSI Application Security Design — 10 Questions

Question 1

When designing microsegmentation policies in Cisco Secure Workload (Tetration) for a multi-tier application, which THREE factors must be considered to ensure traffic flow integrity?

Accepted Answer

Application dependency mapping. Tetration relies on application flow mapping, policy intent, and agent-based enforcement for microsegmentation.

Answer

DHCP lease duration

Answer

User identity mapping

Question 2

You are designing a microsegmentation strategy using Cisco Secure Workload (formerly Tetration) for a multi-tier application. Which mechanism allows you to enforce fine-grained security policies between application tiers while maintaining visibility across the hybrid cloud?

Accepted Answer

Using policy-based agents on endpoints to enforce segmentation. Cisco Secure Workload uses software agents on endpoints to enforce microsegmentation policies based on workload identity, rather than IP addresses.

Answer

Applying static ACLs on the core switch

Answer

Implementing Cisco ASA zone-based firewalling

Answer

Configuring VRF-Lite on the distribution layer

Question 3

In a cloud-native environment, which Cisco solution provides visibility into vulnerabilities within the application code and runtime environment?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure Application for AppDynamics provides full-stack security observability including code vulnerabilities and runtime threats.

Answer

Cisco Secure Endpoint

Answer

Cisco Stealthwatch

Answer

Cisco Secure Malware Analytics

Question 4

You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?

Accepted Answer

Cloudlock API-based CASB integration. Cloudlock uses API-based CASB integration to monitor activity and detect anomalies like abnormal file sharing patterns.

Answer

Cisco Umbrella roaming client

Answer

Cisco ISE Profiling

Answer

Cisco Secure Firewall NAT

Question 5

To secure API endpoints exposed via Cisco Secure API Gateway, which policy type is best suited to prevent brute-force attacks on authentication endpoints?

Accepted Answer

Rate Limiting Policy. Rate limiting policies are the industry standard for preventing brute-force attacks on sensitive API endpoints.

Answer

Identity Propagation Policy

Answer

Schema Validation Policy

Answer

Transformation Policy

Question 6

You are designing an API security architecture for a hybrid cloud environment. Which TWO Cisco technologies would you implement to secure the API lifecycle?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure API Gateway and Cisco Secure Application (AppDynamics) are standard for API protection.

Answer

Cisco Firepower

Answer

Cisco ISE

Answer

Cisco AnyConnect

Question 7

An enterprise is migrating legacy apps to a cloud-native architecture. You need to secure inter-service communication. Which Cisco solution provides mutual TLS and fine-grained access control using sidecar proxies?

Accepted Answer

Cisco Service Mesh Manager. Cisco Service Mesh Manager (based on Istio) provides mTLS and traffic management via sidecar proxies.

Answer

Cisco Umbrella SIG

Answer

Cisco Secure Application for AppDynamics

Answer

Cisco Secure Firewall

Question 8

You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). Which specific architectural component must be deployed within the Kubernetes worker nodes to enforce policy without relying on external firewall hairpining?

Accepted Answer

Secure Workload Software Agent. The Secure Workload software agent (or sensor) is deployed on host nodes to enforce policy at the vSwitch or kernel level, enabling microsegmentation directly at the workload.

Answer

Cisco ASA Virtual Appliance

Answer

Cisco Nexus Dashboard Orchestrator

Answer

Cisco Firepower Management Center

Question 9

You are designing security for a SaaS application integrated with Cisco Cloudlock. A user is persistently attempting to share sensitive documents with external parties. Which Cloudlock feature should be applied to remediate this?

Accepted Answer

Create a policy to automatically unshare files containing PII with external collaborators. Cloudlock allows for automated remediation policies that can revoke sharing permissions based on document sensitivity labels or user behavior.

Answer

Implement MFA for the SaaS login portal

Answer

Enable Cisco Umbrella DNS-layer protection

Answer

Configure an API Key for the SaaS platform

Question 10

When designing microsegmentation within Cisco Secure Workload for a hybrid environment, which TWO components are essential for enforcing traffic policies between on-premises servers and cloud-native instances? (Choose TWO)

Accepted Answer

Cisco Secure Workload software agents. Secure Workload relies on agents (for VMs/bare metal) and VPC flow log ingestion/cloud integration (for cloud-native) to build the visibility and enforcement model.

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Umbrella virtual appliance

Answer

Cisco Identity Services Engine (ISE)