SDSI Application Security Design Practice Test 2 — 15 Questions

Question 1

You are designing an API security architecture for a hybrid cloud environment. Which TWO Cisco technologies would you implement to secure the API lifecycle?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure API Gateway (E) is correct because it is purpose-built for API security across the API lifecycle, providing discovery, threat detection, schema validation, and protection against OWASP API Top 10 attacks such as injection, broken object level authorization, and data exposure in hybrid cloud deployments. Cisco Secure Application for AppDynamics (C) is correct because it integrates runtime application security with APM telemetry, using business transaction monitoring and runtime behavioral analysis to detect and block attacks against APIs and applications in real time, including in hybrid environments. Cisco Firepower (A) is a network firewall/IPS focused on perimeter and network traffic inspection, not API lifecycle security. Cisco ISE (B) is a network access control and identity policy platform for users and devices, not API protection. Cisco AnyConnect (D) is a VPN/endpoint secure access client, unrelated to securing API design, runtime, or lifecycle management.

Answer

Cisco Firepower

Answer

Cisco ISE

Answer

Cisco AnyConnect

Question 2

An enterprise is migrating legacy apps to a cloud-native architecture. You need to secure inter-service communication. Which Cisco solution provides mutual TLS and fine-grained access control using sidecar proxies?

Accepted Answer

Cisco Service Mesh Manager. Cisco Service Mesh Manager (built on Istio) deploys sidecar proxies (Envoy) alongside each microservice, enabling mutual TLS between services and fine-grained, identity-based access control policies. This is exactly the architecture required to secure east-west inter-service communication in a cloud-native environment.

Answer

Cisco Umbrella SIG

Answer

Cisco Secure Application for AppDynamics

Answer

Cisco Secure Firewall

Question 3

You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). Which specific architectural component must be deployed within the Kubernetes worker nodes to enforce policy without relying on external firewall hairpining?

Accepted Answer

Secure Workload Software Agent. The Secure Workload Software Agent must be deployed on Kubernetes worker nodes to enforce microsegmentation policy locally at the workload level. The agent intercepts traffic at the host's network stack (via iptables/eBPF or similar) and applies Tetration's policy without hairpinning traffic to an external firewall. This distributed enforcement model is the core of Cisco Secure Workload's architecture for container and VM environments.

Answer

Cisco ASA Virtual Appliance

Answer

Cisco Nexus Dashboard Orchestrator

Answer

Cisco Firepower Management Center

Question 4

You are designing security for a SaaS application integrated with Cisco Cloudlock. A user is persistently attempting to share sensitive documents with external parties. Which Cloudlock feature should be applied to remediate this?

Accepted Answer

Create a policy to automatically unshare files containing PII with external collaborators. Cisco Cloudlock is a cloud access security broker (CASB) that provides data loss prevention (DLP) and user behavior analytics for SaaS applications. The scenario describes a user persistently sharing sensitive documents externally, which is a data exfiltration risk. The correct remediation is to create a Cloudlock policy that automatically unshares files containing PII when shared with external collaborators. This directly addresses the behavior by enforcing a data-centric control that revokes unauthorized sharing, aligning with Cloudlock's core policy enforcement capabilities.

Answer

Implement MFA for the SaaS login portal

Answer

Enable Cisco Umbrella DNS-layer protection

Answer

Configure an API Key for the SaaS platform

Question 5

In a Cisco Container Platform (CCP) environment, you need to ensure that pod-to-pod traffic within the same namespace is inspected for malicious patterns. Which design decision satisfies this requirement?

Accepted Answer

Deploy a service mesh to implement mutual TLS and traffic monitoring. Deploying a service mesh provides sidecar proxies that can inspect pod-to-pod traffic within a namespace, enforce mutual TLS, and surface L7 telemetry for anomaly detection. This gives the required visibility and inspection of east-west traffic without relying on perimeter controls.

Answer

Use Kubernetes Network Policies to drop traffic

Answer

Implement a Cisco Firepower NGIPS at the perimeter

Answer

Redirect all inter-pod traffic to an external load balancer

Question 6

You are designing a secure API architecture where services are deployed in Kubernetes. You need to enforce authentication and rate limiting at the ingress. Which tool should be used for centralized policy enforcement?

Accepted Answer

An API Gateway integrated into the Ingress Controller. An API Gateway integrated into the Ingress Controller is the correct choice because it centralizes authentication, rate limiting, and other cross-cutting concerns at the ingress layer before traffic reaches microservices. This offloads security logic from individual services and provides a single enforcement point for policies like JWT validation, API key checks, and quota management. Tools like Kong, NGINX Ingress with auth plugins, or Istio Gateway with Envoy filters implement this pattern.

Answer

Using IP-based ACLs on the Kubernetes node

Answer

Hard-coding auth logic into every microservice

Answer

Cisco Secure Firewall running in transparent mode

Question 7

Which THREE actions are recommended when designing a secure API architecture using Cisco API Security to mitigate OWASP API Top 10 threats? (Choose THREE)

Accepted Answer

Implement strict schema validation on all incoming API requests. Option A is correct because strict schema validation on all incoming API requests enforces expected data types, formats, and required fields, which directly mitigates OWASP API threats such as mass assignment, injection, and improper input handling by rejecting malformed or unexpected payloads before they reach backend logic. Option D is correct because continuous monitoring of API traffic for anomalies that indicate data exfiltration helps detect and respond to threats like excessive data exposure and data harvesting, which are core concerns in the OWASP API Top 10. Option E is correct because deploying Cisco API Security to detect Broken Object Level Authorization (BOLA) addresses the top-ranked OWASP API risk, where attackers manipulate object identifiers to access resources belonging to other users; API security tooling can baseline and flag such unauthorized object access patterns. Option B is incorrect because bypassing authentication for performance eliminates access control entirely and would worsen, not mitigate, OWASP API threats such as broken authentication and BOLA. Option C is incorrect because disabling logging of API request headers removes critical audit and forensic visibility needed to detect and investigate attacks, undermining rather than strengthening API security.

Answer

Allow all API traffic to bypass authentication for performance

Answer

Disable all logging of API request headers

Question 8

An organization is deploying APIs on AWS and using Cisco API Security to protect them. The security team needs to detect 'Shadow APIs' that are being called but are not registered in the API documentation. How should the solution be configured?

Accepted Answer

Integrate API Security with the cloud traffic logs to perform behavior analysis and discovery. Cisco API Security discovers shadow APIs by ingesting traffic data (cloud load balancer logs, API gateway logs, VPC flow logs, or agent-based telemetry) and performing behavioral analysis to identify endpoints that are actually being invoked but do not appear in the registered API documentation. This traffic-based discovery is the only way to surface unregistered/undocumented routes, since documentation alone cannot reveal what is truly being called. Integrating with cloud traffic logs enables continuous discovery and comparison against the known API inventory.

Answer

Manually add every route to the Swagger documentation file

Answer

Configure OAuth scopes to restrict access to the API Gateway

Answer

Enable WAF block mode for all undefined routes

Question 9

Which Cisco solution is primarily designed to provide visibility and protection for SaaS applications like Office 365, Salesforce, and Slack?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is a cloud access security broker (CASB) that provides visibility into and control over SaaS application usage, including Office 365, Salesforce, and Slack. It uses APIs to monitor user activity, detect data exfiltration, and enforce data loss prevention (DLP) policies specifically for cloud applications. Unlike network-based solutions, Cloudlock operates at the application layer, offering granular SaaS security without requiring traffic redirection.

Answer

Cisco Secure Workload

Answer

Cisco Secure Firewall

Answer

Cisco Umbrella

Question 10

A developer needs to ensure that microservices within a Kubernetes cluster communicate securely. Which design element ensures that the service-to-service communication is encrypted using mTLS?

Accepted Answer

Deploying a Service Mesh. Deploying a Service Mesh (e.g., Istio, Linkerd) provides mutual TLS (mTLS) for service-to-service communication within a Kubernetes cluster. The service mesh injects sidecar proxies that automatically encrypt and authenticate traffic between microservices, ensuring confidentiality and integrity without application code changes. This is the standard design element for achieving mTLS in Kubernetes.

Answer

Configuring standard Kubernetes Service objects

Answer

Using a physical load balancer in front of the cluster

Answer

Enabling IPsec on the physical nodes

Question 11

When designing for API security, how does Cisco API Security provide protection against 'Excessive Data Exposure' vulnerabilities?

Accepted Answer

By analyzing response schemas to detect sensitive data in API payloads. Cisco API Security analyzes API response schemas and payloads to identify when endpoints return more data than the client actually needs, which is the definition of Excessive Data Exposure (OWASP API #3). By flagging sensitive fields (PII, tokens, internal IDs) in responses, it lets designers trim payloads before attackers can harvest them.

Answer

By implementing strict rate limiting on all users

Answer

By automatically blocking all outgoing API traffic

Answer

By replacing all API keys with OAuth tokens

Question 12

Your organization uses a hybrid cloud model. You are tasked with designing a security posture for workloads in AWS and Azure using Cisco Secure Workload. What is the benefit of the 'Anywhere' agent approach?

Accepted Answer

It provides consistent security policy enforcement across heterogenous environments. The 'Anywhere' agent approach in Cisco Secure Workload provides consistent security policy enforcement across heterogeneous environments, including on-premises, AWS, Azure, and other clouds. It allows you to define policies once and apply them uniformly, regardless of where the workload runs, ensuring a unified security posture.

Answer

It automatically patches the underlying operating system

Answer

It replaces the need for a central management platform

Answer

It eliminates the need for any firewall rules in the cloud

Question 13

Which capability is provided by Cisco Cloudlock's integration with the SaaS platform via API?

Accepted Answer

Visibility and remediation of data sharing and user activity. Cisco Cloudlock is a CASB that connects to SaaS platforms such as Google Workspace, Microsoft 365, and Salesforce via published APIs. Through that API integration it gains visibility into data-at-rest, sharing settings, and user activity, and can then remediate — for example, revoking public share links, quarantining files, or suspending risky accounts — all without inline traffic inspection.

Answer

Hardening of the SaaS application code

Answer

Deep packet inspection of all physical network traffic

Answer

Blocking DNS requests at the ISP level

Question 14

Which THREE criteria should be used to design microsegmentation policies in Cisco Secure Workload? (Choose THREE)

Accepted Answer

Workload attributes and labels (metadata). Option A is correct because Cisco Secure Workload builds microsegmentation policies around workload attributes and labels (metadata such as role, environment, application, and location), which are used to define policy scopes and group workloads logically rather than by network topology. Option B is correct because Secure Workload relies on connectivity telemetry and flow history collected from the workloads to discover actual communication patterns and generate allow-list policies based on observed dependencies. Option D is correct because application processes and behavioral patterns are analyzed to identify which processes communicate, enabling process-level (Layer 7) policy enforcement rather than just IP/port rules. Option C is not correct because physical switch port IDs are not used as a policy construct in Secure Workload; policies are workload-centric, not tied to switch port locations. Option E is not correct because dynamic IP addresses are unreliable identifiers in modern environments and Secure Workload deliberately abstracts policy away from IP addresses by using labels and metadata instead.

Answer

Physical switch port IDs

Answer

Dynamic IP addresses of the servers

Question 15

When designing an API security architecture, what is the primary purpose of 'API Discovery' in the context of Cisco API Security?

Accepted Answer

To inventory all API endpoints and identify shadow or undocumented APIs. API Discovery in Cisco API Security is fundamentally an inventory and visibility function: it enumerates all API endpoints actually in use across the environment and compares them against documented/registered APIs to surface shadow (undocumented) and orphaned (unused) APIs. This gives security teams the complete attack surface picture needed before they can apply any protection. It is a prerequisite for policy enforcement, not a replacement for gateways or a performance feature.

Answer

To replace the need for API gateways

Answer

To increase the API's performance

Answer

To automatically generate API documentation for developers