When designing microsegmentation within Cisco Secure Workload for a hybrid environment, which TWO components are essential for enforcing traffic policies between on-premises servers and cloud-native instances? (Choose TWO)
An organization is deploying an API that returns user financial records. Which security design pattern should be used to ensure that a user can only access their own records?
You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). You need to ensure that only authorized pods can communicate with a specific backend database service. Which architectural component should be enforced to achieve zero-trust segmentation at the application layer?
A client is deploying a serverless application on AWS and needs to secure the API interactions with Cisco Umbrella. Which design pattern effectively protects the API endpoints from malicious exfiltration without introducing significant latency?
Which Cisco solution is primarily designed to provide visibility and control over SaaS application usage within an enterprise, specifically focusing on data loss prevention and threat detection?
In a hybrid cloud environment, you need to extend security policies from your on-premises Cisco ACI fabric to your cloud-native workloads in AWS. Which component facilitates this policy consistency?
You are designing an application security architecture where sensitive data must be encrypted in transit between microservices. Which approach is the most scalable for implementing mTLS (Mutual TLS) across a service mesh environment?
You are designing a secure infrastructure for a financial services company that exposes REST APIs to external partners. The security team requires mutual TLS (mTLS) authentication between the API gateway and backend microservices, but the backend services are deployed across multiple Kubernetes clusters in different data centers. Which Cisco design approach should you use to enforce mTLS and centralized policy for east-west traffic between these clusters?
You are designing a security architecture for a healthcare company that needs to protect sensitive patient data in a multi-cloud environment. The design must ensure that data stored in Amazon S3 and Azure Blob Storage is encrypted, and that access is logged and monitored for compliance. Which Cisco solution should you include in the design to provide data loss prevention (DLP) and encryption key management across these cloud services?
You are designing a security architecture for a multinational corporation that uses a hybrid cloud environment. The company wants to ensure that all API traffic between on-premises applications and cloud services is inspected for malicious content and that data leakage is prevented. The design must also provide a single policy interface for both on-premises and cloud API security. Which Cisco solution should you design as the central policy enforcement point?
When designing microsegmentation policies in Cisco Secure Workload (Tetration) for a multi-tier application, which THREE factors must be considered to ensure traffic flow integrity?
You are designing a microsegmentation strategy using Cisco Secure Workload (formerly Tetration) for a multi-tier application. Which mechanism allows you to enforce fine-grained security policies between application tiers while maintaining visibility across the hybrid cloud?
You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?
To secure API endpoints exposed via Cisco Secure API Gateway, which policy type is best suited to prevent brute-force attacks on authentication endpoints?
You are designing an API security architecture for a hybrid cloud environment. Which TWO Cisco technologies would you implement to secure the API lifecycle?
An enterprise is migrating legacy apps to a cloud-native architecture. You need to secure inter-service communication. Which Cisco solution provides mutual TLS and fine-grained access control using sidecar proxies?
You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). Which specific architectural component must be deployed within the Kubernetes worker nodes to enforce policy without relying on external firewall hairpining?
You are designing security for a SaaS application integrated with Cisco Cloudlock. A user is persistently attempting to share sensitive documents with external parties. Which Cloudlock feature should be applied to remediate this?
In a Cisco Container Platform (CCP) environment, you need to ensure that pod-to-pod traffic within the same namespace is inspected for malicious patterns. Which design decision satisfies this requirement?
You are designing a secure API architecture where services are deployed in Kubernetes. You need to enforce authentication and rate limiting at the ingress. Which tool should be used for centralized policy enforcement?
Which THREE actions are recommended when designing a secure API architecture using Cisco API Security to mitigate OWASP API Top 10 threats? (Choose THREE)
An organization is deploying APIs on AWS and using Cisco API Security to protect them. The security team needs to detect 'Shadow APIs' that are being called but are not registered in the API documentation. How should the solution be configured?
A developer needs to ensure that microservices within a Kubernetes cluster communicate securely. Which design element ensures that the service-to-service communication is encrypted using mTLS?
Your organization uses a hybrid cloud model. You are tasked with designing a security posture for workloads in AWS and Azure using Cisco Secure Workload. What is the benefit of the 'Anywhere' agent approach?
Which TWO factors must be considered when designing SaaS security using Cisco Cloudlock to ensure compliance with data protection regulations? (Choose TWO)
Which design component is essential for securing traffic in a cloud-native environment using Cisco Secure Workload without relying on physical network appliances?
You are designing an API security strategy. Which mechanism is used to verify the integrity and authenticity of API requests in a microservices environment?
You are designing an API security layer for a public-facing web application. Which security control is most effective against 'Broken Function Level Authorization' (BFLA) attacks?
Which design principle is most important when implementing microsegmentation in an environment with high workload volatility (e.g., auto-scaling groups)?
You are tasked with securing a SaaS application. The security policy requires that all documents containing credit card numbers be restricted from external sharing. Which Cloudlock feature is best suited to enforce this?
You are designing security for a microservices environment. You want to ensure that if one service is compromised, it cannot easily move laterally to other services. What is the most effective architectural design choice?
When designing a microsegmentation strategy with Cisco Secure Workload, which THREE metrics should be monitored to validate policy effectiveness? (Choose THREE)
You are designing a SaaS security strategy using Cisco Cloudlock. A user reports that they are seeing alerts for 'unusual geo-location' on their Salesforce account. How does Cloudlock detect this?
You are designing security for a microservices cluster. You want to ensure that if a pod is compromised, it cannot make unauthorized calls to the database. Which design approach is most effective?
When designing security for a cloud-native architecture, why is it better to use an identity-based model instead of a network-based model for microsegmentation?
You are designing a secure API gateway architecture using Cisco API Connectivity (part of the Cisco AppDynamics/Cisco Networking stack). To protect against OWASP Top 10 threats, which specific feature should be enabled on the API Gateway to validate request payloads?
When designing security for a multi-tenant cloud application, which principle is most effectively addressed by using Cisco Secure Workload to create distinct security domains?
When designing an API security architecture to protect against unauthorized data access, which THREE mechanisms are considered best practices for securing API endpoints in a Cisco environment? (Choose THREE)
You are performing a security assessment of a containerized application architecture. Which TWO of the following configurations are critical for ensuring secure communication between pods in a Cisco ACI-managed Kubernetes environment? (Choose TWO)
When designing security for SaaS applications using Cisco Cloudlock, which TWO capabilities are key to mitigating data exfiltration risks? (Choose TWO)
You are designing application security for a new customer-facing web application hosted on Cisco ACI with a Cisco Secure Firewall (formerly Firepower) cluster managed by Cisco Secure Firewall Management Center. The application uses a REST API that authenticates users via OAuth 2.0 bearer tokens. The security team wants to detect and block attacks that exploit business logic in the API, such as manipulating order quantities or bypassing approval steps, without breaking legitimate token-based traffic. Which design approach should you recommend?
You are designing an application security architecture for a web application that will be published to the internet through a Cisco Application Centric Infrastructure (ACI) fabric with a Cisco Secure Firewall cluster. The application uses a monolithic architecture and stores session state in a database. The security team wants to ensure that only valid HTTP methods and headers are accepted, and that malformed requests are dropped before reaching the application servers. Which design element should you include?
You are designing a security architecture for a large e-commerce platform that uses a microservices architecture deployed on Cisco Container Platform (CCP). The security team wants to detect and prevent attacks that exploit vulnerabilities in the application code, such as SQL injection and cross-site scripting, without modifying the application code. Which Cisco solution should you design to meet this requirement?
You are designing a secure API gateway architecture for a financial institution using Cisco API Security. The design must protect against OWASP API Security Top 10 threats, specifically Broken Object Level Authorization (BOLA) and Excessive Data Exposure. Which TWO design controls should you implement to mitigate these threats? (Choose two.)