SDSI Application Security Design Practice Test 4 — 15 Questions

Question 1

In the context of Cisco Cloudlock, what is a 'Shadow IT' application?

Accepted Answer

A SaaS application connected to the enterprise environment without official IT authorization. In Cisco Cloudlock, a 'Shadow IT' application is any SaaS application that is being used within the enterprise environment without explicit IT approval or oversight. Cloudlock discovers these by analyzing traffic and OAuth grants to sanctioned cloud services, revealing unsanctioned apps that may pose data-loss or compliance risks. The defining characteristic is unauthorized SaaS usage, not malicious code or firewall blocking.

Answer

An application that is blocked by the firewall

Answer

A backup tool for the data center

Answer

A malicious script running on an endpoint

Question 2

You are designing security for a microservices environment. You want to ensure that if one service is compromised, it cannot easily move laterally to other services. What is the most effective architectural design choice?

Accepted Answer

Implement microsegmentation between services. Microsegmentation between services enforces least-privilege east-west policies so that a compromised service can only communicate with explicitly authorized peers, directly preventing lateral movement. This is the architectural control designed for the stated goal. It works at workload granularity and is the standard Zero Trust answer for limiting blast radius in microservices.

Answer

Keep all services on the same VLAN

Answer

Disable all internal firewalls for better performance

Answer

Use a single shared database for all services

Question 3

Which Cisco API Security feature is used to prevent attackers from using automated scripts to brute-force API endpoints?

Accepted Answer

API rate limiting and behavioral analytics. API rate limiting caps the number of requests a client can make per time window, which directly throttles brute-force scripts, while behavioral analytics detects patterns like credential stuffing, sequential ID enumeration, and abnormal request velocity that indicate automation. Together they address OWASP API4 (Unrestricted Resource Consumption) and API2 (Broken Authentication) in the API context.

Answer

DNS-layer filtering

Answer

JWT token encryption

Answer

Schema validation

Question 4

What is the primary design benefit of deploying Cisco Secure Workload as a 'software-only' solution in a public cloud environment?

Accepted Answer

It provides consistent security enforcement without relying on physical network appliances. A software-only deployment of Cisco Secure Workload runs as agents or virtual appliances within the cloud environment, so it enforces policy consistently across workloads without depending on physical network appliances that cannot be inserted into cloud traffic paths. This preserves microsegmentation and visibility even as workloads scale and migrate.

Answer

It reduces the need for VPC configuration

Answer

It guarantees 100% protection against all malware

Answer

It automates the creation of virtual machines

Question 5

When designing a secure API lifecycle, which THREE activities should be automated in the CI/CD pipeline? (Choose THREE)

Accepted Answer

API contract/schema testing. Option B (API contract/schema testing) is correct because validating the OpenAPI/Swagger contract against the implementation in CI/CD catches breaking changes, missing fields, and type mismatches early, ensuring consumers and producers stay in sync. Option C (SAST for API code) is correct because static analysis scans source code for vulnerabilities such as injection flaws, hardcoded secrets, and insecure deserialization before deployment, shifting security left. Option D (Automated security policy provisioning for the API gateway) is correct because codifying gateway policies (rate limiting, authentication, WAF rules, TLS enforcement) as infrastructure-as-code ensures consistent, repeatable, and auditable security controls across environments. Option A is wrong because disabling logging harms security monitoring, incident response, and compliance rather than improving security. Option E is wrong because manual CISO review of every commit does not scale and contradicts the goal of automating security activities in the pipeline.

Answer

Disabling all logging for production performance

Answer

Manual code review of every commit by the CISO

Question 6

Which Cisco solution is best suited to prevent data exfiltration from a cloud-native Kubernetes cluster?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload is purpose-built for workload-level protection, including containerized and Kubernetes environments, using agents and flow telemetry to enforce microsegmentation and detect anomalous behavior that could indicate exfiltration. It understands pod-to-pod communication and can apply policies at the container level. The other options are network, wireless, or DNS-layer tools without Kubernetes workload context.

Answer

Cisco DNA Center

Answer

Cisco Umbrella

Answer

Cisco Meraki Dashboard

Question 7

When designing for SaaS security, why should you implement a 'Least Privilege' policy for third-party application integrations?

Accepted Answer

To limit the impact if the third-party application is compromised. Least privilege limits the permissions granted to a third-party integration to only what it strictly needs, so if that third party is breached, the attacker inherits only that narrow scope rather than broad access to the SaaS tenant. This directly reduces blast radius and is a core Zero Trust and SaaS security control. It is a security control, not a licensing, performance, or usability feature.

Answer

To avoid paying license fees

Answer

To improve the application's performance

Answer

To make the application easier to install

Question 8

When designing a microsegmentation strategy with Cisco Secure Workload, which THREE metrics should be monitored to validate policy effectiveness? (Choose THREE)

Accepted Answer

Reduction in unauthorized lateral movement flows. Option B is correct because the core goal of microsegmentation with Cisco Secure Workload is to shrink the attack surface, so a measurable reduction in unauthorized lateral movement flows directly demonstrates that east-west traffic is being constrained by policy. Option D is correct because denied connection attempts show the policy is actively enforcing allow-lists and blocking traffic that violates intent, providing evidence the rules are effective rather than merely present. Option E is correct because tracking the frequency of policy changes reveals policy churn and drift; excessive changes can indicate unstable or ineffective rules and help validate that the policy set has stabilized. Option A is not relevant because server uptime measures availability, not segmentation enforcement, and Option C is not relevant because switch count is a topology/inventory metric unrelated to policy effectiveness.

Answer

Average server uptime

Answer

Total number of network switches used

Question 9

Which design principle is essential when building an API Gateway for high-security environments?

Accepted Answer

Centralized security enforcement at the ingress layer. Centralized security enforcement at the ingress layer means authentication, authorization, rate limiting, schema validation, and threat inspection are all applied consistently at the API Gateway before requests reach backend services. This prevents policy drift and ensures every API consumer passes the same controls.

Answer

Direct routing to services without inspection

Answer

Allowing the backend to perform all security checks

Answer

Encrypting traffic only when it leaves the data center

Question 10

You are designing security for a multi-tier application. Why is it recommended to use a Service Mesh to manage the identity of microservices?

Accepted Answer

To provide cryptographically verifiable workload identity. A service mesh provides each microservice with a cryptographically verifiable identity, typically through mutual TLS (mTLS) certificates issued by a built-in certificate authority (CA). This identity is based on the service's attributes (e.g., Kubernetes service account) rather than its IP address, enabling strong authentication and authorization between services. This is essential for zero-trust security in dynamic environments where IPs change frequently.

Answer

To simplify the management of IP addresses

Answer

To replace the need for firewalls

Answer

To increase the network throughput

Question 11

When designing an API security strategy using Cisco API Security, how should you address APIs that are currently using legacy authentication?

Accepted Answer

Use an API gateway to terminate modern authentication and proxy to the legacy backend. The correct approach is to use an API gateway to terminate modern authentication (e.g., OAuth 2.0, OpenID Connect) and then proxy requests to the legacy backend, which may still use basic auth, API keys, or other legacy methods. This allows you to enforce strong authentication at the edge without modifying the legacy backend, which is often impractical or impossible. Cisco API Security solutions, such as those integrated with Cisco API Gateway, support this pattern by handling token validation, scopes, and policies before forwarding traffic. This decouples security from the legacy system and provides a migration path.

Answer

Force the legacy backend to support modern OAuth

Answer

Block all access to legacy APIs immediately

Answer

Ignore the legacy APIs as they are 'trusted'

Question 12

What is the primary goal of implementing microsegmentation in an enterprise data center?

Accepted Answer

To prevent lateral movement of attackers. Microsegmentation creates granular, workload-level security zones (often down to individual VMs or containers) so that east-west traffic must be explicitly authorized. Its primary security goal is to prevent lateral movement — if an attacker compromises one workload, they cannot freely pivot to others because inter-segment traffic is denied by default. Bandwidth, topology simplification, and server reduction are operational side effects at best, not the goal.

Answer

To increase bandwidth capacity

Answer

To simplify the network topology

Answer

To reduce the number of servers required

Question 13

When designing the architecture for a highly secure API ecosystem, which THREE security layers should be implemented? (Choose THREE)

Accepted Answer

Service Mesh for internal mTLS and authorization. Option B is correct because a service mesh provides mutual TLS (mTLS) between internal microservices, giving strong workload identity and encryption in transit plus fine-grained authorization policies (e.g., via Istio or Linkerd) without changing application code. Option D is correct because a centralized API security and observability platform aggregates API discovery, schema validation, threat detection, and logging/metrics/tracing, enabling consistent policy enforcement and rapid incident response across the ecosystem. Option E is correct because an API Gateway or Ingress Controller terminates external traffic at the edge, enforcing TLS, authentication/authorization, rate limiting, WAF rules, and request validation before traffic reaches backend services. Option A is not appropriate because open-access policies for internal microservices eliminate authentication and authorization, violating zero-trust and least-privilege principles. Option C is not appropriate because physically air-gapping all servers is impractical for a connected API ecosystem and does not address application-layer API threats such as injection, broken object-level authorization, or token abuse.

Answer

Open-access policies for all internal microservices

Answer

Physical air-gapping of all servers

Question 14

Why is it important to include 'Application Context' when defining microsegmentation policies in Cisco Secure Workload?

Accepted Answer

To align security policies with business and application logic. Application Context lets microsegmentation policies be expressed in terms of application tiers, roles, and business logic (e.g., 'web tier to app tier') rather than raw IPs and ports. This aligns security with how the business actually operates, makes policies meaningful and maintainable, and ensures enforcement follows the application even as IPs change. It is about semantic alignment, not performance or readability alone.

Answer

To bypass the need for firewall rules

Answer

To make the policy easier to read for network admins

Answer

To reduce the amount of memory consumed by the agent

Question 15

You are designing a SaaS security strategy using Cisco Cloudlock. A user reports that they are seeing alerts for 'unusual geo-location' on their Salesforce account. How does Cloudlock detect this?

Accepted Answer

By using UEBA to baseline and identify anomalous login activity. Cloudlock uses User and Entity Behavior Analytics (UEBA) to establish a baseline of each user's normal login behavior — typical locations, times, devices, and IP ranges — and then flags deviations such as logins from new or unusual geographies as 'unusual geo-location' alerts. This is behavioral anomaly detection, not blanket geo-blocking or device tracking.

Answer

By blocking all international traffic

Answer

By analyzing the user's browser history

Answer

By tracking the user's GPS coordinates on their phone