SDSI Application Security Design Practice Test 5 — 15 Questions

Question 1

When designing security for SaaS applications, what is the primary benefit of an API-based CASB like Cisco Cloudlock over a proxy-based CASB?

Accepted Answer

API-based does not require routing user traffic through the CASB. API-based CASBs like Cisco Cloudlock connect directly to SaaS APIs (e.g., Microsoft 365, Google Workspace, Salesforce) using OAuth, so they can scan data at rest and enforce policies without proxying user traffic. This avoids the latency, certificate, and routing complexity that proxy-based CASBs introduce.

Answer

Proxy-based is cheaper

Answer

API-based only works on-premises

Answer

Proxy-based is always faster

Question 2

Which design pattern best mitigates 'Broken Object Level Authorization' (BOLA) in a RESTful API?

Accepted Answer

Explicit authorization check at every endpoint that accepts an object ID. BOLA occurs when an API endpoint accepts an object ID and returns or modifies the object without verifying that the authenticated user is authorized to access that specific object. The definitive mitigation is an explicit authorization check at every endpoint that accepts an object ID, verifying the caller's ownership or permission on that object before any data is returned or changed. This closes the vulnerability at its root rather than obscuring it.

Answer

Implementing a strong API rate limit

Answer

Using random, non-sequential UUIDs for objects

Answer

Encrypting all API responses

Question 3

What is the purpose of 'Microsegmentation' in a cloud-native architecture?

Accepted Answer

To reduce the attack surface by isolating workloads. Microsegmentation's core security purpose is to reduce the attack surface by isolating workloads from one another, so that a compromise of one workload cannot freely reach others. It enforces least-privilege east-west traffic policies at the workload level rather than relying on perimeter firewalls. This directly limits lateral movement and blast radius within a cloud-native environment.

Answer

To automatically scale services based on demand

Answer

To provide high availability for the service

Answer

To optimize container scheduling

Question 4

Which security design decision is most critical when migrating an application to the cloud, specifically regarding API security?

Accepted Answer

Implementing API security and identity-based access at the application layer. Migrating to cloud shifts the trust boundary: the cloud provider secures the infrastructure, but the application owner must secure the API layer. Implementing API security and identity-based access at the application layer (D) ensures authentication, authorization, and threat detection travel with the workload regardless of which cloud or region it runs in.

Answer

Relying on the cloud provider's firewall

Answer

Maintaining a VPN tunnel to the on-premise data center

Answer

Disabling all API endpoints that are not internal

Question 5

Which THREE components in Cisco Secure Workload are essential for building a Zero Trust segmentation policy? (Choose THREE)

Accepted Answer

Policy enforcement agents. Option A (Policy enforcement agents) is correct because Cisco Secure Workload relies on agents installed on workloads (or agentless integrations) to enforce the microsegmentation policies at the workload level, translating the intent-based policy into actual allow/deny rules on the host. Option C (Flow telemetry analysis) is correct because Secure Workload continuously ingests flow data from the agents and network devices to map actual workload-to-workload communication, which is the foundation for defining least-privilege segmentation rules. Option E (Workload discovery and profiling) is correct because before any Zero Trust policy can be built, Secure Workload must discover workloads, label them by attributes (e.g., environment, role, application), and profile their behavior to create accurate policy scopes. Option B (Manual IP address manual entry) is not part of the Zero Trust segmentation workflow in Secure Workload, which uses dynamic labels and policy constructs rather than static IP lists. Option D (Physical cable management) is a Layer 1 cabling task unrelated to building segmentation policy in Cisco Secure Workload.

Answer

Manual IP address manual entry

Answer

Physical cable management

Question 6

Which THREE actions are essential for maintaining a secure SaaS posture using Cloudlock? (Choose THREE)

Accepted Answer

Monitor for anomalous user behavior (UEBA). Option A is correct because Cloudlock (Cisco Cloudlock/Cisco Cloud Security) provides User and Entity Behavior Analytics (UEBA) that baselines normal SaaS activity and flags anomalous behavior such as impossible travel, mass downloads, or unusual login patterns, which is essential to a secure SaaS posture. Option B is correct because Cloudlock's Cloud App Analytics and CASB capabilities surface OAuth-connected third-party apps and their scopes, letting administrators review and revoke risky or unauthorized integrations that could exfiltrate data. Option C is correct because Cloudlock's DLP engine relies on continuously tuned policies and regex/dictionary rules to detect sensitive data (PII, PCI, PHI) in SaaS traffic, and stale policies create blind spots, so ongoing monitoring and updates are essential. Option D is incorrect because disabling all public internet access would break SaaS delivery entirely; SaaS security depends on controlled, monitored access, not blanket blocking. Option E is incorrect because enterprise server drivers are an on-premises infrastructure concern and have no bearing on Cloudlock's SaaS security posture management.

Answer

Disable all public internet access

Answer

Update all enterprise server drivers

Question 7

You are designing security for a microservices cluster. You want to ensure that if a pod is compromised, it cannot make unauthorized calls to the database. Which design approach is most effective?

Accepted Answer

Use microsegmentation to restrict database access to authorized services only. Microsegmentation applies least-privilege network policy so that each workload can only communicate with the specific services it needs. In a microservices cluster, this means the database only accepts connections from authorized service identities (e.g., the billing service's service account), so a compromised pod cannot reach the database even if it is on the same network. This contains lateral movement and limits blast radius.

Answer

Disable all internal network logging

Answer

Put the database in the public cloud

Answer

Open all network ports to the database

Question 8

When designing an API strategy, what is the 'API Contract' and why is it important for security?

Accepted Answer

A technical specification that allows for automated schema validation and security enforcement. An API Contract is a formal, machine-readable specification (typically OpenAPI/Swagger, RAML, or gRPC proto) that defines endpoints, methods, parameters, request/response schemas, and authentication requirements. Because it is machine-readable, it enables automated schema validation of every request and response, and it lets security controls (input validation, auth scopes, rate limits) be enforced consistently at the gateway. This makes it a security asset, not just documentation.

Answer

A password file for the API

Answer

A legal document for the API usage

Answer

A file that lists all allowed IP addresses

Question 9

What is the primary benefit of 'Visibility' in the Cisco API Security architecture?

Accepted Answer

Identification of all APIs and shadow endpoints. Visibility in Cisco API Security means discovering and inventorying every API — including undocumented 'shadow' endpoints that teams spun up outside formal governance. Without this inventory, no other security control (auth, rate limiting, schema validation) can be applied to the right surface.

Answer

Automatic translation of API code

Answer

Reduction of API storage costs

Answer

Increased performance of the API calls

Question 10

Which Cisco product would you choose to gain visibility into your SaaS applications and enforce data security policies?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock (part of Cisco Cloud Security/Umbrella CASB) is the SaaS security product that provides API-based visibility into sanctioned and unsanctioned SaaS apps and enforces DLP policies on data at rest and in motion. It discovers SaaS usage, classifies sensitive data, and applies granular controls. The other options address network, workload, or firewall layers, not SaaS application governance.

Answer

Cisco Umbrella

Answer

Cisco Secure Workload

Answer

Cisco Secure Firewall

Question 11

What is the benefit of using 'Identity-Based' microsegmentation in Cisco Secure Workload?

Accepted Answer

It provides stable policies that persist through workload moves and scaling. Identity-based microsegmentation in Cisco Secure Workload uses workload identity (labels, tags, process attributes) rather than IP addresses to define policy. Because policies are anchored to identity, they remain valid even when workloads move, scale, or change IPs — providing stable, portable policy across dynamic environments. This is the key benefit over IP-based rules.

Answer

It requires less initial configuration

Answer

It relies on hard-coded firewall rules

Answer

It is only compatible with physical servers

Question 12

When designing an API gateway strategy, why is it important to implement 'Rate Limiting' at the gateway level?

Accepted Answer

To protect backend services from being overwhelmed. Rate limiting at the API gateway caps the number of requests a client can make in a given time window, preventing a single client or botnet from overwhelming backend services. This protects availability, enforces fair usage, and mitigates brute-force and DDoS-style abuse before requests reach the backend.

Answer

To ensure that all users have the same experience

Answer

To increase the speed of the backend services

Answer

To simplify the authentication process

Question 13

When designing a secure API environment, which THREE threat categories should be prioritized for detection by Cisco API Security? (Choose THREE)

Accepted Answer

Broken Object Level Authorization (BOLA). Cisco API Security prioritizes the OWASP API Security Top 10 threats, which include Broken Object Level Authorization (BOLA) (A), Excessive Data Exposure (B), and Broken Authentication (C). BOLA is critical because attackers manipulate object identifiers in API calls to access resources belonging to other users, making it the most prevalent API vulnerability. Excessive Data Exposure is prioritized because APIs often return full data objects and rely on the client to filter sensitive fields, leaking PII or confidential data. Broken Authentication is a core API threat since weak token handling, credential stuffing, or flawed JWT validation lets attackers impersonate legitimate users. Options D and E are incorrect because local fiber optic cable breaks and standard server hardware failures are physical infrastructure availability issues handled by redundancy and disaster recovery, not API-layer threat detection.

Answer

Local fiber optic cable breaks

Answer

Standard server hardware failures

Question 14

Which Cisco product provides visibility into traffic within the cloud, helping to identify potential microsegmentation policies?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload (formerly Tetration) provides deep visibility into workload-to-workload traffic in data centers and cloud environments, using flow telemetry to map dependencies and recommend microsegmentation policies. It is the Cisco product explicitly designed to discover traffic patterns and then generate and enforce microsegmentation policy. This matches the question's requirement for cloud traffic visibility to inform microsegmentation.

Answer

Cisco DNA Center

Answer

Cisco Meraki

Answer

Cisco Umbrella

Question 15

Why is 'Behavioral Analysis' a critical component of Cisco API Security?

Accepted Answer

To detect anomalous and signature-less threats. Behavioral analysis is critical in Cisco API Security because it establishes a baseline of normal API call patterns (frequency, payload size, sequence, source, timing) and then flags deviations that indicate attacks. Signature-based detection fails against novel or polymorphic API attacks, so behavioral analysis is what catches zero-day and signature-less threats such as credential stuffing, data scraping, and business-logic abuse. This is the core value proposition of the capability.

Answer

To speed up the API processing

Answer

To reduce API storage requirements

Answer

To replace the need for API documentation