SDSI Application Security Design Practice Test 6 — 15 Questions

Question 1

When designing for multi-cloud, why is an orchestration layer for security policy so important?

Accepted Answer

To ensure consistent policy enforcement across heterogeneous environments. An orchestration layer for security policy is crucial in multi-cloud because it abstracts the underlying cloud-native security controls (e.g., AWS Security Groups, Azure NSGs, GCP Firewall Rules) and provides a single point of policy definition and enforcement. This ensures that security policies are applied consistently across all clouds, regardless of the differences in native tools, APIs, and policy models. Without such a layer, organizations risk policy drift, misconfigurations, and gaps that attackers can exploit. Thus, it directly addresses the challenge of maintaining uniform security posture in heterogeneous environments.

Answer

To increase the performance of the cross-cloud traffic

Answer

To reduce the cost of the cloud service

Answer

To eliminate the need for cloud-native firewalls

Question 2

When designing a SaaS integration security plan, which THREE types of activities should be regularly reviewed in Cisco Cloudlock? (Choose THREE)

Accepted Answer

User login patterns and anomalies. Option A (User login patterns and anomalies) is correct because Cisco Cloudlock continuously monitors SaaS user behavior and applies User and Entity Behavior Analytics (UEBA) to detect anomalous logins such as impossible travel, brute-force attempts, or compromised credentials. Option C (External file sharing activities) is correct because Cloudlock's Data Loss Prevention (DLP) and sharing-exposure policies flag files shared publicly or with external domains via links, which is a core SaaS data-exfiltration risk that must be reviewed regularly. Option E (Third-party application integration permissions) is correct because Cloudlock's Cloud Security Assessment and app-governance features audit OAuth scopes granted to third-party apps, identifying over-permissioned or risky integrations that could access SaaS data. Option B (Physical building security logs) does not belong because Cloudlock is a cloud-access security broker (CASB) focused on SaaS API activity, not physical access control systems. Option D (Local printer configuration) does not belong because printer settings are endpoint/peripheral concerns outside Cloudlock's SaaS visibility and policy scope.

Answer

Physical building security logs

Answer

Local printer configuration

Question 3

Which design principle helps minimize the impact of a compromised API key?

Accepted Answer

Rotating keys frequently. Frequent key rotation limits the window of opportunity for an attacker who has stolen or leaked a key — the compromised credential becomes useless once rotated. It also forces teams to build automated rotation and revocation workflows, which reduces the blast radius of any single key exposure. This is a core principle of credential hygiene and least-privilege design.

Answer

Hard-coding keys in the source code

Answer

Using long-lived static API keys

Answer

Sharing a single key among all users

Question 4

What is the primary architectural benefit of deploying an API Gateway in a microservices environment?

Accepted Answer

It centralizes security and policy enforcement for all services. An API Gateway acts as a single entry point for all client requests, centralizing cross-cutting concerns such as authentication, authorization, rate limiting, and logging. This offloads these responsibilities from individual microservices, ensuring consistent policy enforcement and reducing duplication. By handling security at the edge, services can focus on business logic, and internal services remain protected behind the gateway.

Answer

It makes all internal services public-facing

Answer

It eliminates the need for service-to-service security

Answer

It provides data storage for the microservices

Question 5

When designing security for a cloud-native architecture, why is it better to use an identity-based model instead of a network-based model for microsegmentation?

Accepted Answer

Because identity is persistent while IP addresses are volatile. In cloud-native environments, workload IP addresses are ephemeral — containers and pods are constantly created, destroyed, and rescheduled, so IP-based policies quickly become stale and either over-permit or break legitimate traffic. Identity (service account, SPIFFE ID, labels, or workload identity) persists across IP changes and is therefore the stable anchor for microsegmentation policy. This is the foundational reason identity-based segmentation is preferred.

Answer

Because it is easier to implement IP-based rules

Answer

Because identity is always known to the network hardware

Answer

Because it doesn't require any policy configuration

Question 6

When designing a secure API environment, which THREE tasks should the API Gateway handle? (Choose THREE)

Accepted Answer

Authentication and authorization verification. Option B is correct because the API Gateway is the central entry point for all client requests, so it should verify authentication tokens (e.g., JWT, OAuth 2.0 access tokens) and enforce authorization policies before forwarding traffic to backend services. Option C is correct because the gateway's core function is to route incoming requests to the appropriate backend microservices based on path, host, headers, or other routing rules, acting as a reverse proxy. Option D is correct because the gateway should enforce request rate limiting (e.g., token bucket or leaky bucket algorithms) to protect backend services from abuse, DoS attacks, and traffic spikes. Option A is not correct because application data storage belongs to backend databases or storage services, not the API Gateway, which should remain stateless. Option E is not correct because hard-coding all business logic in the gateway creates a monolithic bottleneck and violates microservice separation of concerns; business logic belongs in the backend services.

Answer

Application data storage

Answer

Hard-coding all business logic

Question 7

You are designing a secure API gateway architecture using Cisco API Connectivity (part of the Cisco AppDynamics/Cisco Networking stack). To protect against OWASP Top 10 threats, which specific feature should be enabled on the API Gateway to validate request payloads?

Accepted Answer

Configure JSON/XML schema validation policies based on the imported OpenAPI specification.. JSON/XML schema validation policies derived from the imported OpenAPI specification allow the API gateway to reject requests whose payloads do not conform to the contract, which directly mitigates OWASP API threats such as injection, mass assignment, and malformed input. Because the schema is generated from the OpenAPI document, the gateway enforces the exact structure, types, and constraints the API expects, blocking malformed or malicious payloads before they reach the backend. This is the payload-level validation control specifically designed for API security.

Answer

Enable Basic Authentication for all API endpoints.

Answer

Deploy a WAF rule to block all traffic from unknown IP addresses.

Answer

null

Answer

Enable rate limiting on the gateway to prevent DoS attacks.

Question 8

When designing security for a multi-tenant cloud application, which principle is most effectively addressed by using Cisco Secure Workload to create distinct security domains?

Accepted Answer

Logical Tenant Isolation. Cisco Secure Workload (formerly Tetration) creates distinct security domains that enforce microsegmentation and policy boundaries between tenants, which directly implements logical tenant isolation in a multi-tenant cloud application. By defining separate security domains per tenant, the platform ensures that workloads from one tenant cannot communicate with another unless explicitly allowed, satisfying the isolation principle. This is the principle most effectively addressed by that design approach.

Answer

User Identity Provisioning

Answer

Data Backup and Recovery

Answer

null

Answer

Hardware Redundancy

Question 9

When designing an API security architecture to protect against unauthorized data access, which THREE mechanisms are considered best practices for securing API endpoints in a Cisco environment? (Choose THREE)

Accepted Answer

Enforcing fine-grained authorization policies using scopes or claims.. Option C is correct because enforcing fine-grained authorization with scopes or claims ensures that authenticated clients can only access the specific resources and actions their token permits, which directly prevents unauthorized data access. Option D is correct because OAuth 2.0 with OpenID Connect provides standards-based, token-based authentication and identity verification, avoiding credential exposure and enabling secure delegated access to APIs. Option E is correct because rate limiting and throttling on the API Gateway mitigate abuse, brute-force attempts, and denial-of-service conditions that could otherwise lead to unauthorized data exposure or service disruption. Option A is not appropriate because hardcoding API keys in client-side source code exposes secrets to anyone who inspects the application, enabling credential theft and unauthorized access. Option B is not appropriate because disabling TLS removes encryption and integrity protection, allowing eavesdropping, token theft, and man-in-the-middle attacks, which directly undermines API security.

Answer

Hardcoding API keys directly into the client-side source code.

Answer

Disabling TLS to improve API request processing performance.

Question 10

You are performing a security assessment of a containerized application architecture. Which TWO of the following configurations are critical for ensuring secure communication between pods in a Cisco ACI-managed Kubernetes environment? (Choose TWO)

Accepted Answer

Defining Contracts between EPGs to permit specific traffic types.. Option A is correct because in Cisco ACI, Contracts define the permitted protocols, ports, and directions of traffic between EPGs, so defining Contracts between EPGs enforces microsegmentation and only allows the specific traffic types required between pods. Option C is correct because pods must be mapped to the appropriate EPGs based on their function; the EPG is the policy enforcement boundary in ACI, so without correct pod-to-EPG assignment, Contracts cannot be applied to the right workloads. Option B is incorrect because disabling the ACI CNI plugin removes ACI's native integration with Kubernetes networking and policy enforcement, undermining rather than improving secure pod communication. Option D is incorrect because a single flat, non-segmented network eliminates the segmentation that ACI EPGs and Contracts rely on to isolate and control pod traffic. Option E is incorrect because physical cabling and VLAN separation are not the mechanism for securing pod-to-pod communication in an ACI-managed Kubernetes environment, where policy is enforced logically through EPGs and Contracts.

Answer

Disabling the ACI CNI plugin to allow native Kubernetes network policies.

Answer

Configuring all pods to reside in a single flat, non-segmented network.

Answer

Using physical cabling to separate traffic by VLAN.

Question 11

When designing security for SaaS applications using Cisco Cloudlock, which TWO capabilities are key to mitigating data exfiltration risks? (Choose TWO)

Accepted Answer

Monitoring for anomalous user behavior and account takeovers.. Option A is correct because Cisco Cloudlock's User and Entity Behavior Analytics (UEBA) continuously baselines normal SaaS activity and flags anomalies such as impossible travel, mass downloads, or compromised-account indicators, which are leading precursors to data exfiltration. Option B is correct because Cloudlock's Data Loss Prevention (DLP) engine applies consistent, API-based policies across sanctioned SaaS platforms (e.g., Microsoft 365, Google Workspace, Salesforce, Box), detecting and remediating sensitive data (PII, PCI, PHI) in files, posts, and sharing events before it leaves the organization. Option C is not part of Cloudlock's design, since it is a cloud-native CASB that secures SaaS rather than eliminating it. Option D is unrelated and impractical, as Cloudlock governs SaaS data flows via APIs, not by blocking all outbound Internet traffic. Option E is a security anti-pattern; hard-coding credentials into any dashboard violates least-privilege and credential-management principles and is not a Cloudlock capability.

Answer

Replacing all SaaS applications with on-premises alternatives.

Answer

Blocking all outbound Internet traffic from the office network.

Answer

Hard-coding user credentials into the Cloudlock dashboard.

Question 12

You are designing application security for a new customer-facing web application hosted on Cisco ACI with a Cisco Secure Firewall (formerly Firepower) cluster managed by Cisco Secure Firewall Management Center. The application uses a REST API that authenticates users via OAuth 2.0 bearer tokens. The security team wants to detect and block attacks that exploit business logic in the API, such as manipulating order quantities or bypassing approval steps, without breaking legitimate token-based traffic. Which design approach should you recommend?

Accepted Answer

Enable Cisco Secure Firewall's TLS decryption on the API server's traffic and apply a custom Snort 3 rule that inspects JSON payload fields for out-of-range quantity values.. Business logic attacks against APIs require visibility into the application payload, not just network metadata. TLS decryption on Cisco Secure Firewall enables inspection of the JSON body, and a custom Snort 3 rule can enforce semantic constraints such as allowed quantity ranges or approval sequences. This design targets the specific manipulation described while preserving legitimate OAuth 2.0 bearer token traffic, because the rule acts on payload fields rather than blocking encrypted sessions wholesale.

Answer

Configure Cisco Application Centric Infrastructure (ACI) microsegmentation contracts to allow only HTTP POST methods to the API endpoint, blocking all other methods.

Answer

Use Cisco Identity Services Engine (ISE) to profile API clients and assign a downloadable ACL that limits each client to a fixed number of API calls per minute.

Answer

Deploy Cisco Umbrella SIG and configure a custom block page for any API request that contains a quantity parameter greater than 100.

Question 13

You are designing an application security architecture for a web application that will be published to the internet through a Cisco Application Centric Infrastructure (ACI) fabric with a Cisco Secure Firewall cluster. The application uses a monolithic architecture and stores session state in a database. The security team wants to ensure that only valid HTTP methods and headers are accepted, and that malformed requests are dropped before reaching the application servers. Which design element should you include?

Accepted Answer

A Cisco ACI service graph that inserts a Cisco Secure Firewall between the web and application tiers with a custom Snort rule validating HTTP methods and headers.. To validate HTTP methods and headers before traffic reaches application servers, you need a Layer 7 inspection point. A Cisco ACI service graph can steer traffic through a Cisco Secure Firewall, where a custom Snort rule enforces the allowed methods and header formats. This design integrates network segmentation with deep packet inspection, ensuring malformed requests are dropped at the firewall rather than consuming application resources.

Answer

Cisco Identity Services Engine (ISE) posture assessment for all external users to verify their devices meet security policies.

Answer

A Cisco Secure Firewall access control policy with URL filtering to block requests to known malicious domains.

Answer

Cisco Umbrella DNS-layer security to block requests to the application's domain if the request contains a suspicious User-Agent header.

Question 14

You are designing a security architecture for a large e-commerce platform that uses a microservices architecture deployed on Cisco Container Platform (CCP). The security team wants to detect and prevent attacks that exploit vulnerabilities in the application code, such as SQL injection and cross-site scripting, without modifying the application code. Which Cisco solution should you design to meet this requirement?

Accepted Answer

Cisco AppDynamics with Security Guard and runtime application self-protection (RASP).. Cisco AppDynamics with Security Guard is designed to provide runtime application self-protection (RASP), which instruments the application runtime to detect and block application-layer attacks such as SQL injection and cross-site scripting. This approach does not require modifying application code and is effective for microservices deployed on Cisco Container Platform, meeting the security team's requirement.

Answer

Cisco Secure Workload with deep packet inspection and signature-based detection.

Answer

Cisco Tetration with application dependency mapping and policy enforcement.

Answer

Cisco Cloudlock with API-based scanning of container images for vulnerabilities.

Question 15

You are designing a secure API gateway architecture for a financial institution using Cisco API Security. The design must protect against OWASP API Security Top 10 threats, specifically Broken Object Level Authorization (BOLA) and Excessive Data Exposure. Which TWO design controls should you implement to mitigate these threats? (Choose two.)

Accepted Answer

Implement response filtering to remove sensitive data fields from API responses based on the user's role and the principle of least privilege.. Broken Object Level Authorization is mitigated by enforcing object-level authorization checks at the API gateway, ensuring users can only access resources they are permitted to. Excessive Data Exposure is mitigated by response filtering, which removes sensitive fields based on user role and least privilege. Together, these controls address the two specific OWASP API Security Top 10 threats mentioned.

Answer

Enable mutual TLS (mTLS) between the API client and the API gateway to ensure strong authentication.

Answer

Deploy a web application firewall (WAF) in front of the API gateway to block SQL injection and cross-site scripting attacks.

Answer

Use rate limiting to restrict the number of API requests per user per minute.