SDSI Application Security Design Practice Test 3 — 15 Questions

Question 1

When designing security for a microservices architecture, why should you implement a 'Zero Trust' approach at the service level?

Accepted Answer

To ensure that every service-to-service call is authenticated and authorized. Zero Trust at the service level ensures that every service-to-service call is authenticated and authorized, regardless of network location. This prevents lateral movement in case of a breach and enforces least privilege. It is essential in microservices architectures where traditional perimeter security is insufficient.

Answer

To rely solely on network perimeter security

Answer

To increase the latency of inter-service communication

Answer

To simplify the management of firewall rules

Question 2

Which TWO factors must be considered when designing SaaS security using Cisco Cloudlock to ensure compliance with data protection regulations? (Choose TWO)

Accepted Answer

Establishing remediation workflows for policy violations. Option B is correct because Cisco Cloudlock's value in a SaaS compliance program depends on operationalizing its policy engine: when Cloudlock detects a violation (for example, a DLP match or a risky third-party app), remediation workflows such as automated quarantine, revoke sharing, notify user, or alert admin are what actually enforce the regulation and produce an auditable response trail. Option C is correct because Cloudlock's DLP and data classification policies are the foundation of the entire control: you must define which data types are regulated (for example, PII, PCI, PHI) and how they are classified so Cloudlock's API-based scanning of SaaS platforms like Microsoft 365, Google Workspace, and Salesforce can detect and act on them. Option A is not relevant because BGP peering is an internet routing concern for network connectivity, not a SaaS data-protection control, and Cloudlock operates via APIs rather than routing. Option D is not relevant because hardware-based encryption is a vendor infrastructure matter, not something the Cloudlock customer designs or configures for compliance. Option E is not relevant because Cloudlock is an API-based, agentless CASB that monitors sanctioned SaaS usage from the cloud, so endpoint agents are not required.

Answer

Configuring BGP peering with the SaaS provider

Answer

Enabling hardware-based encryption for the SaaS vendor

Answer

Installing agents on all end-user laptops

Question 3

Which design component is essential for securing traffic in a cloud-native environment using Cisco Secure Workload without relying on physical network appliances?

Accepted Answer

Workload-level security agents. Cisco Secure Workload secures cloud-native traffic using workload-level security agents installed on hosts, VMs, or containers that enforce policy and provide visibility without physical appliances. This agent-based architecture is what allows policy enforcement to follow the workload across clouds and on-premises environments, satisfying the 'no physical network appliances' constraint.

Answer

Physical tap aggregation

Answer

VLAN-based segmentation

Answer

Direct Connect integration

Question 4

When designing a secure multi-cloud strategy for applications, how does Cisco Secure Workload facilitate consistent policy management?

Accepted Answer

By providing a centralized policy plane that integrates with native cloud security controls. Cisco Secure Workload provides a centralized policy plane that integrates with native cloud security controls (e.g., AWS Security Groups, Azure NSGs, GCP firewall rules) to enforce consistent micro-segmentation policies across multi-cloud environments. This allows a single policy definition to be translated and applied natively in each cloud, avoiding vendor lock-in and manual per-cloud configuration. The centralized plane maintains visibility and enforcement consistency regardless of where workloads run.

Answer

By forcing all traffic to transit a VPN tunnel

Answer

By moving all traffic through a centralized Cisco hardware firewall

Answer

By manually creating ACLs in each cloud provider console

Question 5

You are designing an API security strategy. Which mechanism is used to verify the integrity and authenticity of API requests in a microservices environment?

Accepted Answer

JSON Web Tokens (JWT). JSON Web Tokens (JWT) are signed (and optionally encrypted) tokens that carry claims about the caller and can be cryptographically verified by any microservice using the issuer's public key. This signature verification provides both integrity (the token was not tampered with) and authenticity (it was issued by a trusted identity provider), which is exactly what is needed to validate API requests in a distributed microservices environment. JWTs are stateless, so each service can verify them independently without a central session store.

Answer

SSL/TLS termination at the server

Answer

Static IP allowlisting

Answer

Standard Basic Authentication

Question 6

You are designing an API security layer for a public-facing web application. Which security control is most effective against 'Broken Function Level Authorization' (BFLA) attacks?

Accepted Answer

Strict RBAC/ABAC authorization checks on every function. BFLA occurs when an API endpoint enforces authentication but fails to verify whether the authenticated user is authorized to invoke that specific function (e.g., a regular user calling an admin-only endpoint). The only control that directly addresses this is enforcing strict role- or attribute-based authorization checks on every function invocation, so that each request is validated against the caller's permissions regardless of how the endpoint is reached. Rate limiting, IP blocking, and TLS encryption do not evaluate user privilege, so they cannot stop a legitimate low-privilege user from invoking a high-privilege function.

Answer

Rate limiting

Answer

Blocking traffic from known malicious IP addresses

Answer

Encrypting all traffic with TLS 1.3

Question 7

Which THREE capabilities are provided by Cisco Cloudlock to enhance SaaS security posture? (Choose THREE)

Accepted Answer

Data Loss Prevention (DLP) for SaaS data. Cisco Cloudlock is a cloud-native CASB (Cloud Access Security Broker) that enhances SaaS security posture through API-based monitoring rather than on-premises inspection. Option B is correct because Cloudlock provides Data Loss Prevention (DLP) for SaaS data, scanning content in sanctioned cloud apps such as Microsoft 365, Google Workspace, and Salesforce to detect and remediate exposure of sensitive data (PII, PCI, IP) via policies and regex/EDM classifiers. Option C is correct because Cloudlock includes User and Entity Behavior Analytics (UEBA), which baselines user activity across cloud apps and flags anomalous behavior such as impossible travel, mass downloads, or unusual sharing to detect compromised accounts and insider threats. Option E is correct because Cloudlock performs application auditing and vetting for third-party apps, using its AppFirewall and app-risk scoring to identify OAuth-connected apps with excessive scopes or risky permissions and to block or revoke them. Option A is incorrect because real-time packet capture on the local network is a function of on-premises tools such as Cisco Stealthwatch or Firepower, not the API-based Cloudlock CASB. Option D is incorrect because hardening physical server BIOS settings is a data-center hardware security task unrelated to SaaS security posture management.

Answer

Real-time packet capture on the local network

Answer

Hardening of physical server BIOS settings

Question 8

Which design principle is most important when implementing microsegmentation in an environment with high workload volatility (e.g., auto-scaling groups)?

Accepted Answer

Use label-based dynamic security policies. In environments with high workload volatility, such as auto-scaling groups, IP addresses change frequently, making IP-based policies impractical. Label-based dynamic security policies allow microsegmentation rules to follow workloads as they scale, because labels are applied to pods or instances and policies reference those labels rather than ephemeral IPs. This ensures consistent security enforcement regardless of scaling events.

Answer

Manually update firewall rules when scaling

Answer

Disable scaling to maintain network stability

Answer

Use IP-based static access control lists

Question 9

When designing for cloud-native API security, which TWO components are critical for ensuring visibility into API traffic? (Choose TWO)

Accepted Answer

API Gateway access logs. Option C (API Gateway access logs) is correct because the API gateway is the ingress point for all API calls, and its access logs capture per-request metadata such as client IP, request path, HTTP method, status code, latency, and API key usage, providing the authoritative audit trail needed for API visibility in cloud-native environments. Option E (Traffic telemetry from the service mesh sidecars) is correct because sidecar proxies (e.g., Envoy in Istio/Linkerd) intercept east-west service-to-service traffic and emit metrics, distributed traces, and L7 request telemetry (via OpenTelemetry, Prometheus, or access logs) that reveal internal API calls the gateway never sees. Option A is wrong because manually reading firewall rules only shows static allow/deny policy, not actual API request behavior or payload-level activity. Option B is wrong because disabling TLS exposes data in transit and violates security best practices; visibility should come from TLS-terminating proxies and observability tooling, not from weakening encryption. Option D is wrong because a physical network tap at the data center core cannot inspect encrypted east-west traffic and is impractical for dynamic, ephemeral cloud-native workloads.

Answer

Manual inspection of firewall rules

Answer

Disabling TLS for easier traffic analysis

Answer

Physical network tap at the data center core

Question 10

In the context of microsegmentation, what is the primary benefit of using a 'Whitelist' approach over a 'Blacklist' approach?

Accepted Answer

It provides a more secure, 'deny-all' default posture. A whitelist approach in microsegmentation explicitly allows only known, authorized traffic and denies everything else by default, providing a more secure 'deny-all' posture. This is in contrast to a blacklist approach, which allows all traffic except known bad actors, leaving potential gaps for unknown threats. The whitelist model enforces least privilege and reduces the attack surface.

Answer

It improves performance of the underlying network

Answer

It is easier to configure

Answer

It removes the need for security policies

Question 11

What is the primary role of a Service Mesh in an API architecture?

Accepted Answer

To abstract and manage service-to-service communication. A service mesh is a dedicated infrastructure layer that handles service-to-service communication within a microservices or API architecture. It provides capabilities like traffic management, mutual TLS, observability, and policy enforcement without requiring changes to application code. By abstracting this communication into sidecar proxies or ambient nodes, it decouples networking concerns from business logic, which is its primary role. This is why option D is correct.

Answer

To perform deep packet inspection of external user traffic

Answer

To act as a physical load balancer

Answer

To replace the need for API documentation

Question 12

You are tasked with securing a SaaS application. The security policy requires that all documents containing credit card numbers be restricted from external sharing. Which Cloudlock feature is best suited to enforce this?

Accepted Answer

Data Loss Prevention (DLP) engine. Cloudlock's DLP engine is the feature designed to inspect content (including regex-detectable patterns like credit card numbers) and enforce sharing restrictions on SaaS documents. It classifies data at rest and in motion within sanctioned SaaS apps, then applies policy to block or quarantine external sharing of files containing PCI data. This directly satisfies the requirement to restrict documents containing credit card numbers from external sharing.

Answer

User activity monitoring

Answer

Identity and Access Management (IAM) integration

Answer

DNS-layer security

Question 13

When designing for microsegmentation using Cisco Secure Workload, what is the significance of 'Flow Visibility'?

Accepted Answer

It allows for the modeling and validation of security policies before enforcement. Flow Visibility in Cisco Secure Workload (formerly Tetration) continuously ingests and analyzes actual east-west traffic between workloads, building a dependency map of every conversation. This lets security teams model and simulate microsegmentation policies against real traffic before enforcing them, so they can validate that legitimate flows won't be blocked. It is the foundational 'observe before enforce' phase of the workload protection lifecycle.

Answer

It automates the patching of vulnerabilities

Answer

It is used to bill users for bandwidth usage

Answer

It is used to identify the physical location of servers

Question 14

Which design approach is best for protecting APIs against 'Mass Assignment' vulnerabilities?

Accepted Answer

Implementing strict input validation and allowing only specified fields. Mass assignment (also called over-posting or autobinding) occurs when an API blindly binds client-supplied JSON/XML fields to internal object properties, letting attackers set fields they shouldn't (e.g., isAdmin=true, role=admin). The correct defense is strict input validation combined with an allowlist of explicitly permitted fields (schema-based binding), so any unexpected or privileged field is rejected or ignored. This ensures the API only accepts the fields the developer intended.

Answer

Encrypting all API requests with AES-256

Answer

Disabling all API writes

Answer

Using a strong password policy

Question 15

Which THREE factors are required to ensure the successful deployment of a Zero Trust microsegmentation architecture? (Choose THREE)

Accepted Answer

A centralized, automated enforcement policy engine. Option B is correct because Zero Trust microsegmentation depends on a centralized, automated enforcement policy engine (e.g., a policy controller/management plane) that consistently translates identity- and context-based rules into allow/deny decisions across all workloads without manual per-host configuration. Option C is correct because you cannot segment what you cannot see: complete visibility into every communication flow (east-west and north-south, typically via flow logs, packet inspection, or agents) is required to baseline legitimate traffic and detect anomalies. Option D is correct because identifying and classifying all workloads (by application, owner, sensitivity, and tags/labels) is the prerequisite for defining meaningful microsegmentation policies and grouping assets into segments. Option A is not correct because a flat network architecture is the opposite of what microsegmentation requires — it removes the internal boundaries that segmentation is meant to create. Option E is not correct because shared administrative credentials violate Zero Trust least-privilege and per-identity authentication principles, increasing lateral movement risk rather than enabling secure deployment.

Answer

A flat network architecture

Answer

Shared administrative credentials for all servers