SDSI Application Security Design — 40 Questions

Question 1

When designing microsegmentation policies in Cisco Secure Workload (Tetration) for a multi-tier application, which THREE factors must be considered to ensure traffic flow integrity?

Accepted Answer

Application dependency mapping. Tetration relies on application flow mapping, policy intent, and agent-based enforcement for microsegmentation.

Answer

DHCP lease duration

Answer

User identity mapping

Question 2

You are designing a microsegmentation strategy using Cisco Secure Workload (formerly Tetration) for a multi-tier application. Which mechanism allows you to enforce fine-grained security policies between application tiers while maintaining visibility across the hybrid cloud?

Accepted Answer

Using policy-based agents on endpoints to enforce segmentation. Cisco Secure Workload uses software agents on endpoints to enforce microsegmentation policies based on workload identity, rather than IP addresses.

Answer

Applying static ACLs on the core switch

Answer

Implementing Cisco ASA zone-based firewalling

Answer

Configuring VRF-Lite on the distribution layer

Question 3

In a cloud-native environment, which Cisco solution provides visibility into vulnerabilities within the application code and runtime environment?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure Application for AppDynamics provides full-stack security observability including code vulnerabilities and runtime threats.

Answer

Cisco Secure Endpoint

Answer

Cisco Stealthwatch

Answer

Cisco Secure Malware Analytics

Question 4

You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?

Accepted Answer

Cloudlock API-based CASB integration. Cloudlock uses API-based CASB integration to monitor activity and detect anomalies like abnormal file sharing patterns.

Answer

Cisco Umbrella roaming client

Answer

Cisco ISE Profiling

Answer

Cisco Secure Firewall NAT

Question 5

To secure API endpoints exposed via Cisco Secure API Gateway, which policy type is best suited to prevent brute-force attacks on authentication endpoints?

Accepted Answer

Rate Limiting Policy. Rate limiting policies are the industry standard for preventing brute-force attacks on sensitive API endpoints.

Answer

Identity Propagation Policy

Answer

Schema Validation Policy

Answer

Transformation Policy

Question 6

You are designing an API security architecture for a hybrid cloud environment. Which TWO Cisco technologies would you implement to secure the API lifecycle?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure API Gateway and Cisco Secure Application (AppDynamics) are standard for API protection.

Answer

Cisco Firepower

Answer

Cisco ISE

Answer

Cisco AnyConnect

Question 7

An enterprise is migrating legacy apps to a cloud-native architecture. You need to secure inter-service communication. Which Cisco solution provides mutual TLS and fine-grained access control using sidecar proxies?

Accepted Answer

Cisco Service Mesh Manager. Cisco Service Mesh Manager (based on Istio) provides mTLS and traffic management via sidecar proxies.

Answer

Cisco Umbrella SIG

Answer

Cisco Secure Application for AppDynamics

Answer

Cisco Secure Firewall

Question 8

You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). Which specific architectural component must be deployed within the Kubernetes worker nodes to enforce policy without relying on external firewall hairpining?

Accepted Answer

Secure Workload Software Agent. The Secure Workload software agent (or sensor) is deployed on host nodes to enforce policy at the vSwitch or kernel level, enabling microsegmentation directly at the workload.

Answer

Cisco ASA Virtual Appliance

Answer

Cisco Nexus Dashboard Orchestrator

Answer

Cisco Firepower Management Center

Question 9

You are designing security for a SaaS application integrated with Cisco Cloudlock. A user is persistently attempting to share sensitive documents with external parties. Which Cloudlock feature should be applied to remediate this?

Accepted Answer

Create a policy to automatically unshare files containing PII with external collaborators. Cloudlock allows for automated remediation policies that can revoke sharing permissions based on document sensitivity labels or user behavior.

Answer

Implement MFA for the SaaS login portal

Answer

Enable Cisco Umbrella DNS-layer protection

Answer

Configure an API Key for the SaaS platform

Question 10

When designing microsegmentation within Cisco Secure Workload for a hybrid environment, which TWO components are essential for enforcing traffic policies between on-premises servers and cloud-native instances? (Choose TWO)

Accepted Answer

Cisco Secure Workload software agents. Secure Workload relies on agents (for VMs/bare metal) and VPC flow log ingestion/cloud integration (for cloud-native) to build the visibility and enforcement model.

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Umbrella virtual appliance

Answer

Cisco Identity Services Engine (ISE)

Question 11

In a Cisco Container Platform (CCP) environment, you need to ensure that pod-to-pod traffic within the same namespace is inspected for malicious patterns. Which design decision satisfies this requirement?

Accepted Answer

Deploy a service mesh to implement mutual TLS and traffic monitoring. Service meshes like Istio (integrated with Cisco Service Mesh Manager) allow for mTLS and traffic inspection between microservices.

Answer

Use Kubernetes Network Policies to drop traffic

Answer

Implement a Cisco Firepower NGIPS at the perimeter

Answer

Redirect all inter-pod traffic to an external load balancer

Question 12

You are designing a secure API architecture where services are deployed in Kubernetes. You need to enforce authentication and rate limiting at the ingress. Which tool should be used for centralized policy enforcement?

Accepted Answer

An API Gateway integrated into the Ingress Controller. Cisco API Connectivity Manager (ACM) or an API Gateway integrated with the Ingress Controller handles centralized auth, rate limiting, and observability.

Answer

Using IP-based ACLs on the Kubernetes node

Answer

Hard-coding auth logic into every microservice

Answer

Cisco Secure Firewall running in transparent mode

Question 13

Which THREE actions are recommended when designing a secure API architecture using Cisco API Security to mitigate OWASP API Top 10 threats? (Choose THREE)

Accepted Answer

Implement strict schema validation on all incoming API requests. Mitigation requires visibility, schema validation, and behavioral analysis to stop common attacks like BOLA and excessive data exposure.

Answer

Allow all API traffic to bypass authentication for performance

Answer

Disable all logging of API request headers

Question 14

An organization is deploying APIs on AWS and using Cisco API Security to protect them. The security team needs to detect 'Shadow APIs' that are being called but are not registered in the API documentation. How should the solution be configured?

Accepted Answer

Integrate API Security with the cloud traffic logs to perform behavior analysis and discovery. Cisco API Security performs discovery by analyzing traffic logs and API calls to identify endpoints that are active but missing from the defined schema.

Answer

Manually add every route to the Swagger documentation file

Answer

Configure OAuth scopes to restrict access to the API Gateway

Answer

Enable WAF block mode for all undefined routes

Question 15

Which Cisco solution is primarily designed to provide visibility and protection for SaaS applications like Office 365, Salesforce, and Slack?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is a cloud-native CASB designed to secure SaaS environments.

Answer

Cisco Secure Workload

Answer

Cisco Secure Firewall

Answer

Cisco Umbrella

Question 16

A developer needs to ensure that microservices within a Kubernetes cluster communicate securely. Which design element ensures that the service-to-service communication is encrypted using mTLS?

Accepted Answer

Deploying a Service Mesh. A service mesh, such as Istio, automates the configuration of mTLS between microservices.

Answer

Configuring standard Kubernetes Service objects

Answer

Using a physical load balancer in front of the cluster

Answer

Enabling IPsec on the physical nodes

Question 17

When designing for API security, how does Cisco API Security provide protection against 'Excessive Data Exposure' vulnerabilities?

Accepted Answer

By analyzing response schemas to detect sensitive data in API payloads. Cisco API Security analyzes response bodies to detect if sensitive information (like PII) is being returned in fields that shouldn't contain it.

Answer

By implementing strict rate limiting on all users

Answer

By automatically blocking all outgoing API traffic

Answer

By replacing all API keys with OAuth tokens

Question 18

Your organization uses a hybrid cloud model. You are tasked with designing a security posture for workloads in AWS and Azure using Cisco Secure Workload. What is the benefit of the 'Anywhere' agent approach?

Accepted Answer

It provides consistent security policy enforcement across heterogenous environments. The 'Anywhere' agent allows for consistent policy enforcement across diverse infrastructure, including on-premises and multiple cloud providers.

Answer

It automatically patches the underlying operating system

Answer

It replaces the need for a central management platform

Answer

It eliminates the need for any firewall rules in the cloud

Question 19

Which capability is provided by Cisco Cloudlock's integration with the SaaS platform via API?

Accepted Answer

Visibility and remediation of data sharing and user activity. Cloudlock uses APIs to monitor for file sharing, data exposure, and user behavior anomalies within the SaaS environment without requiring agent installation.

Answer

Hardening of the SaaS application code

Answer

Deep packet inspection of all physical network traffic

Answer

Blocking DNS requests at the ISP level

Question 20

Which THREE criteria should be used to design microsegmentation policies in Cisco Secure Workload? (Choose THREE)

Accepted Answer

Workload attributes and labels (metadata). Effective microsegmentation policies rely on workload identity, application context, and observed communication patterns rather than just IP addresses.

Answer

Physical switch port IDs

Answer

Dynamic IP addresses of the servers