SDSI Application Security Design — 40 Questions

Question 1

When designing microsegmentation within Cisco Secure Workload for a hybrid environment, which TWO components are essential for enforcing traffic policies between on-premises servers and cloud-native instances? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco Secure Workload software agents. Option B, Cisco Secure Workload software agents, is correct because these agents are installed on the workloads (both on-premises servers and cloud-native instances) and are the enforcement point that applies the microsegmentation policy—label-based allow/deny rules—directly at the host, including in hybrid deployments. Option D, cloud-native traffic telemetry integration, is correct because Cisco Secure Workload relies on flow and telemetry data from cloud environments (for example, via cloud connectors/VPC flow logs and cloud APIs) to discover dependencies, build accurate policy, and maintain visibility across the hybrid estate where agents alone cannot see all inter-instance traffic. Option A, Cisco Firepower Management Center, is not required because FMC manages NGFW/IPS appliances and is not the enforcement or telemetry mechanism for Secure Workload's host-based microsegmentation. Option C, Cisco Umbrella virtual appliance, is not required because Umbrella provides DNS-layer security and secure web gateway functions, not workload microsegmentation policy enforcement. Option E, Cisco Identity Services Engine, is not required because ISE handles network access control and identity-based segmentation for users/devices, not workload-to-workload policy enforcement in Secure Workload.

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Umbrella virtual appliance

Answer

Cisco Identity Services Engine (ISE)

Question 2

An organization is deploying an API that returns user financial records. Which security design pattern should be used to ensure that a user can only access their own records?

Accepted Answer

Implement BOLA (Broken Object Level Authorization) checks in the application logic. BOLA (Broken Object Level Authorization) is OWASP API Security Top 10 #1 and occurs when an API fails to verify that the requesting user actually owns or is authorized to access the specific object ID in the request. Implementing BOLA checks in application logic — validating that the authenticated user's identity matches the resource owner before returning data — is the correct pattern to ensure users only access their own financial records.

Answer

WAF signature-based blocking

Answer

Implementing an API Key for all users

Answer

Rate limiting

Question 3

You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). You need to ensure that only authorized pods can communicate with a specific backend database service. Which architectural component should be enforced to achieve zero-trust segmentation at the application layer?

Accepted Answer

Deploy a service-level policy based on process and label identity via the Secure Workload agent.. Cisco Secure Workload (Tetration) enforces zero-trust microsegmentation by using software agents on hosts/pods that identify workloads via process, labels, and other metadata, then apply policy at the application layer regardless of IP. A service-level policy based on process and label identity ensures only authorized pods can reach the backend database, aligning with zero-trust principles. This is the architectural component that provides identity-based segmentation inside Kubernetes.

Answer

Configure static IP-based ACLs on the physical leaf switches.

Answer

Implement VRF-lite on the nodes to isolate the database traffic.

Answer

null

Answer

Enable port-security on the virtual switch ports connecting the worker nodes.

Question 4

A client is deploying a serverless application on AWS and needs to secure the API interactions with Cisco Umbrella. Which design pattern effectively protects the API endpoints from malicious exfiltration without introducing significant latency?

Accepted Answer

Use the Cisco Umbrella API or DNS-layer security to enforce request filtering at the outbound proxy level.. Using Cisco Umbrella's API or DNS-layer security to filter requests at the outbound proxy level protects serverless API interactions without adding significant latency, because DNS resolution happens before any outbound connection and Umbrella blocks malicious domains at that point. This cloud-delivered model requires no inline appliance in the serverless execution path, preserving the low-latency, event-driven nature of AWS Lambda.

Answer

Route all serverless traffic through an on-premises Cisco Firepower appliance.

Answer

Configure an inline Cisco ASA virtual instance to inspect all API traffic.

Answer

null

Answer

Implement the Cisco Umbrella DNS forwarder within the serverless function environment.

Question 5

Which Cisco solution is primarily designed to provide visibility and control over SaaS application usage within an enterprise, specifically focusing on data loss prevention and threat detection?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is Cisco's Cloud Access Security Broker (CASB) solution, purpose-built to give enterprises visibility and control over SaaS application usage. It discovers sanctioned and unsanctioned cloud apps, enforces DLP policies on data moving to/from SaaS, and detects threats like compromised accounts and insider misuse. This aligns exactly with the question's focus on SaaS visibility, DLP, and threat detection.

Answer

Cisco Stealthwatch

Answer

null

Answer

Cisco ISE

Answer

Cisco Firepower Management Center

Question 6

In a hybrid cloud environment, you need to extend security policies from your on-premises Cisco ACI fabric to your cloud-native workloads in AWS. Which component facilitates this policy consistency?

Accepted Answer

Cisco Cloud APIC. Cisco Cloud APIC is the component that extends Cisco ACI's policy model into public cloud environments such as AWS, Azure, and GCP. It acts as a controller that translates ACI-style policy constructs (tenants, EPGs, contracts) into native cloud constructs like VPCs, security groups, and route tables, providing a single policy fabric across on-premises and cloud. This is exactly what enables consistent security policy enforcement for cloud-native workloads in a hybrid deployment.

Answer

Cisco HyperFlex

Answer

null

Answer

Cisco Secure Firewall Virtual (formerly vFTD)

Answer

Cisco Nexus Dashboard

Question 7

You are designing an application security architecture where sensitive data must be encrypted in transit between microservices. Which approach is the most scalable for implementing mTLS (Mutual TLS) across a service mesh environment?

Accepted Answer

Implement a service mesh with sidecar proxies to manage mTLS termination and rotation automatically.. A service mesh with sidecar proxies (e.g., Istio, Linkerd) centralizes mTLS management by injecting a proxy alongside each microservice. The proxies handle certificate issuance, rotation, and mTLS termination automatically, removing the need for application code changes. This decouples security from business logic and scales horizontally as services are added or removed. The control plane (e.g., Istiod) acts as a CA, distributing short-lived certificates to sidecars, enabling zero-trust networking without manual intervention.

Answer

Use a central VPN concentrator for all intra-cluster traffic.

Answer

Configure individual Load Balancers for every inter-service communication path.

Answer

Hardcode TLS certificates into each microservice binary.

Answer

null

Question 8

You are designing a secure infrastructure for a financial services company that exposes REST APIs to external partners. The security team requires mutual TLS (mTLS) authentication between the API gateway and backend microservices, but the backend services are deployed across multiple Kubernetes clusters in different data centers. Which Cisco design approach should you use to enforce mTLS and centralized policy for east-west traffic between these clusters?

Accepted Answer

Implement Cisco Service Mesh (based on Istio) with a multi-cluster control plane, using Citadel for certificate management and Envoy sidecars for mTLS.. Cisco Service Mesh, based on Istio, is the appropriate design choice because it provides a multi-cluster control plane that can manage mTLS certificates and enforce mutual TLS between microservices using sidecar proxies. This approach centralizes identity and policy, ensuring secure east-west traffic across Kubernetes clusters and satisfying the requirement for mutual authentication between the API gateway and backend services.

Answer

Configure Cisco Identity Services Engine (ISE) to issue certificates to each microservice and enforce mTLS via 802.1X.

Answer

Deploy Cisco Secure Workload agents on each Kubernetes node and configure workload profiles to enforce mTLS between pods.

Answer

Use Cisco Application Centric Infrastructure (ACI) with a shared tenant and contract-based policies to enforce mTLS between microservices.

Question 9

You are designing a security architecture for a healthcare company that needs to protect sensitive patient data in a multi-cloud environment. The design must ensure that data stored in Amazon S3 and Azure Blob Storage is encrypted, and that access is logged and monitored for compliance. Which Cisco solution should you include in the design to provide data loss prevention (DLP) and encryption key management across these cloud services?

Accepted Answer

Cisco Cloudlock with data loss prevention policies and cloud encryption.. Cisco Cloudlock is a cloud access security broker that provides data loss prevention and encryption key management for cloud services. It can discover and classify sensitive data in Amazon S3 and Azure Blob Storage, enforce encryption, and log access for compliance. This makes it the correct choice for protecting patient data across a multi-cloud environment.

Answer

Cisco Identity Services Engine (ISE) with posture assessment for cloud storage.

Answer

Cisco Umbrella with cloud storage enforcement and data encryption.

Answer

Cisco Secure Workload with encryption at rest for cloud workloads.

Question 10

You are designing a security architecture for a multinational corporation that uses a hybrid cloud environment. The company wants to ensure that all API traffic between on-premises applications and cloud services is inspected for malicious content and that data leakage is prevented. The design must also provide a single policy interface for both on-premises and cloud API security. Which Cisco solution should you design as the central policy enforcement point?

Accepted Answer

Cisco API Security with a centralized management console and distributed enforcement points.. Cisco API Security is designed to provide centralized policy management and distributed enforcement for API traffic across hybrid environments. It can inspect API traffic for malicious content and data leakage, and it offers a single policy interface for both on-premises and cloud deployments, making it the correct choice for this scenario.

Answer

Cisco Umbrella with secure web gateway and API traffic inspection.

Answer

Cisco Secure Workload with API visibility and microsegmentation policies.

Answer

Cisco Cloudlock with API inspection and data loss prevention policies.

Question 11

When designing microsegmentation policies in Cisco Secure Workload (Tetration) for a multi-tier application, which THREE factors must be considered to ensure traffic flow integrity?

Accepted Answer

Application dependency mapping. Application dependency mapping (A) is correct because Cisco Secure Workload (Tetration) builds microsegmentation policy from observed flow telemetry, so you must first map which workloads communicate with which others, on which ports and protocols, to write allow rules that preserve legitimate multi-tier traffic. Workload inventory classification (C) is correct because labeling workloads by role (for example web, app, or database tier), environment, and application scope is what lets Tetration group endpoints into policy scopes and apply consistent, intent-based rules rather than per-IP exceptions. Infrastructure zone isolation (D) is correct because segmentation boundaries such as data center zones, VRF/VLAN segments, and security zones determine which flows are even permitted to cross boundaries, so policies must respect those zones to avoid breaking routing or creating unintended east-west paths. DHCP lease duration (B) is not a microsegmentation design factor because Tetration policies are based on workload identity and labels rather than transient IP addressing, and user identity mapping (E) is not required for traffic flow integrity in this scenario since the question concerns workload-to-workload policy, not user-based access control.

Answer

DHCP lease duration

Answer

User identity mapping

Question 12

You are designing a microsegmentation strategy using Cisco Secure Workload (formerly Tetration) for a multi-tier application. Which mechanism allows you to enforce fine-grained security policies between application tiers while maintaining visibility across the hybrid cloud?

Accepted Answer

Using policy-based agents on endpoints to enforce segmentation. Cisco Secure Workload uses lightweight software agents installed on workloads (servers, VMs, containers) that enforce microsegmentation policies at the workload level, independent of the underlying network. These agents provide visibility into all flows (including east-west traffic within the same subnet) and enforce fine-grained allow/deny policies between application tiers. Because enforcement is host-based, the same policy model works across on-premises, private cloud, and public cloud environments, which is essential for hybrid cloud visibility and control.

Answer

Applying static ACLs on the core switch

Answer

Implementing Cisco ASA zone-based firewalling

Answer

Configuring VRF-Lite on the distribution layer

Question 13

In a cloud-native environment, which Cisco solution provides visibility into vulnerabilities within the application code and runtime environment?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure Application for AppDynamics provides full-stack security observability including code vulnerabilities and runtime threats.

Answer

Cisco Secure Endpoint

Answer

Cisco Stealthwatch

Answer

Cisco Secure Malware Analytics

Question 14

You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?

Accepted Answer

Cloudlock API-based CASB integration. Cisco Cloudlock integrates with Google Workspace through its API-based CASB connection, using OAuth to read Drive, Gmail, and audit logs. That API access gives Cloudlock visibility into file sharing settings, external collaborators, and user activity, and its behavioral analytics baseline normal user behavior to flag anomalies such as mass external sharing or unusual download volumes. Remediation is then performed through the same APIs.

Answer

Cisco Umbrella roaming client

Answer

Cisco ISE Profiling

Answer

Cisco Secure Firewall NAT

Question 15

To secure API endpoints exposed via Cisco Secure API Gateway, which policy type is best suited to prevent brute-force attacks on authentication endpoints?

Accepted Answer

Rate Limiting Policy. A Rate Limiting Policy is best suited to prevent brute-force attacks on authentication endpoints because it restricts the number of requests a client can make within a specified time window. This mitigates repeated login attempts that characterize brute-force attacks.

Answer

Identity Propagation Policy

Answer

Schema Validation Policy

Answer

Transformation Policy

Question 16

You are designing an API security architecture for a hybrid cloud environment. Which TWO Cisco technologies would you implement to secure the API lifecycle?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure API Gateway (E) is correct because it is purpose-built for API security across the API lifecycle, providing discovery, threat detection, schema validation, and protection against OWASP API Top 10 attacks such as injection, broken object level authorization, and data exposure in hybrid cloud deployments. Cisco Secure Application for AppDynamics (C) is correct because it integrates runtime application security with APM telemetry, using business transaction monitoring and runtime behavioral analysis to detect and block attacks against APIs and applications in real time, including in hybrid environments. Cisco Firepower (A) is a network firewall/IPS focused on perimeter and network traffic inspection, not API lifecycle security. Cisco ISE (B) is a network access control and identity policy platform for users and devices, not API protection. Cisco AnyConnect (D) is a VPN/endpoint secure access client, unrelated to securing API design, runtime, or lifecycle management.

Answer

Cisco Firepower

Answer

Cisco ISE

Answer

Cisco AnyConnect

Question 17

An enterprise is migrating legacy apps to a cloud-native architecture. You need to secure inter-service communication. Which Cisco solution provides mutual TLS and fine-grained access control using sidecar proxies?

Accepted Answer

Cisco Service Mesh Manager. Cisco Service Mesh Manager (built on Istio) deploys sidecar proxies (Envoy) alongside each microservice, enabling mutual TLS between services and fine-grained, identity-based access control policies. This is exactly the architecture required to secure east-west inter-service communication in a cloud-native environment.

Answer

Cisco Umbrella SIG

Answer

Cisco Secure Application for AppDynamics

Answer

Cisco Secure Firewall

Question 18

You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). Which specific architectural component must be deployed within the Kubernetes worker nodes to enforce policy without relying on external firewall hairpining?

Accepted Answer

Secure Workload Software Agent. The Secure Workload Software Agent must be deployed on Kubernetes worker nodes to enforce microsegmentation policy locally at the workload level. The agent intercepts traffic at the host's network stack (via iptables/eBPF or similar) and applies Tetration's policy without hairpinning traffic to an external firewall. This distributed enforcement model is the core of Cisco Secure Workload's architecture for container and VM environments.

Answer

Cisco ASA Virtual Appliance

Answer

Cisco Nexus Dashboard Orchestrator

Answer

Cisco Firepower Management Center

Question 19

You are designing security for a SaaS application integrated with Cisco Cloudlock. A user is persistently attempting to share sensitive documents with external parties. Which Cloudlock feature should be applied to remediate this?

Accepted Answer

Create a policy to automatically unshare files containing PII with external collaborators. Cisco Cloudlock is a cloud access security broker (CASB) that provides data loss prevention (DLP) and user behavior analytics for SaaS applications. The scenario describes a user persistently sharing sensitive documents externally, which is a data exfiltration risk. The correct remediation is to create a Cloudlock policy that automatically unshares files containing PII when shared with external collaborators. This directly addresses the behavior by enforcing a data-centric control that revokes unauthorized sharing, aligning with Cloudlock's core policy enforcement capabilities.

Answer

Implement MFA for the SaaS login portal

Answer

Enable Cisco Umbrella DNS-layer protection

Answer

Configure an API Key for the SaaS platform

Question 20

In a Cisco Container Platform (CCP) environment, you need to ensure that pod-to-pod traffic within the same namespace is inspected for malicious patterns. Which design decision satisfies this requirement?

Accepted Answer

Deploy a service mesh to implement mutual TLS and traffic monitoring. Deploying a service mesh provides sidecar proxies that can inspect pod-to-pod traffic within a namespace, enforce mutual TLS, and surface L7 telemetry for anomaly detection. This gives the required visibility and inspection of east-west traffic without relying on perimeter controls.

Answer

Use Kubernetes Network Policies to drop traffic

Answer

Implement a Cisco Firepower NGIPS at the perimeter

Answer

Redirect all inter-pod traffic to an external load balancer