SDSI Hard Questions — 25 Difficult Questions

Question 1

You are automating the lifecycle of Cisco Secure Firewall policies. Which tool should be selected to integrate security policy as code (SaC) into a GitHub Actions pipeline?

Accepted Answer

HashiCorp Terraform. Terraform, specifically the 'cisco-fmc' provider, is the industry standard for managing Cisco security infrastructure as code.

Answer

Cisco DNA Center GUI

Answer

Python native sockets

Answer

Cisco Defense Orchestrator Portal

Question 2

Which THREE of the following are key AI/ML design considerations when selecting a security automation platform?

Accepted Answer

Explainability and transparency (XAI). Data quality, model transparency, and integration capabilities are critical for effective AI security.

Answer

Number of employees on the vendor's team

Answer

Local hardware GPU acceleration

Question 3

Which Cisco feature is specifically designed to prevent 'Credential Stuffing' in an automated application environment?

Accepted Answer

Adaptive Authentication. Cisco Secure Access (Duo) Adaptive Authentication uses risk-based policies to detect and block credential stuffing.

Answer

DNS Filtering

Answer

SSL Inspection

Answer

Intrusion Prevention System (IPS)

Question 4

Which TWO of the following are benefits of using 'Infrastructure as Code' (IaC) with Cisco Secure Firewall?

Accepted Answer

Improved auditability of changes. Consistency and auditability are the primary benefits of treating infrastructure as code.

Answer

Reduction of network bandwidth usage

Answer

Elimination of the need for firewall policies

Answer

Automatic hardware repair

Question 5

When designing a multi-cloud CI/CD security architecture, how should secrets (API keys for Cisco FMC) be managed to ensure compliance?

Accepted Answer

Use a dedicated Secret Management service. Secrets must be stored in a dedicated vault (like HashiCorp Vault or AWS Secrets Manager) and never in code repositories.

Answer

Embed as environment variables in the build runner

Answer

Encrypt with base64 and store in Git

Answer

Hardcode in the Terraform provider block

Question 6

When utilizing Cisco DevNet tools for security, which Python library is the standard for interacting with the Cisco FMC API efficiently?

Accepted Answer

fmcapi. The 'fmcapi' library (a community-supported wrapper) is the industry standard for interacting with FMC in Python scripts.

Answer

requests_cisco

Answer

cisco_py

Answer

fmc_sdk

Question 7

Which TWO of the following steps are required to integrate a security tool (like Cisco Secure Firewall) into a CI/CD pipeline?

Accepted Answer

Configure API authentication credentials. You need an authentication mechanism (API keys) and a deployment tool (Terraform/Ansible) to manage the infrastructure.

Answer

Replace the existing firewall hardware

Answer

Hardcode credentials in the pipeline build file

Answer

Disable all firewall rules for testing

Question 8

When designing an automated remediation workflow for Cisco Secure Firewall, what is the specific function of the 'Cisco Secure Firewall REST API' in the context of threat intelligence feeds?

Accepted Answer

Dynamic update of Network Objects. The API allows for dynamic injection of IP or Domain lists into 'Network Objects' which are used in policy rules.

Answer

Encryption key rotation

Answer

Automated firmware flashing

Answer

Traffic scrubbing

Question 9

You are designing an automated pipeline for Cisco Secure Firewall. If a deployment fails, which mechanism ensures the configuration is reverted to the last known good state?

Accepted Answer

Terraform state rollback. Using Terraform 'state' management or Ansible 'check mode' allows for rollback or verification before committing changes, preventing broken states.

Answer

Manual CLI restore

Answer

FMC Factory Reset

Answer

Automated snapshot deletion

Question 10

In a DevSecOps environment, you need to implement Cisco Secure Firewall Management Center (FMC) rule updates via Ansible. Which approach ensures the highest level of security and idempotency?

Accepted Answer

Utilizing the cisco.fmc Ansible collection. Using the 'cisco.fmc' Ansible collection with structured tasks ensures idempotency by checking the state before applying changes.

Answer

Manually updating via FMC UI then exporting JSON

Answer

Pushing configuration snapshots via SCP

Answer

Executing raw REST API calls via shell scripts

Question 11

Which THREE of the following are best practices for securing a CI/CD pipeline itself?

Accepted Answer

Scan the pipeline code for vulnerabilities. Securing the runner, managing secrets, and scanning code are fundamental best practices.

Answer

Allow root access to all developers

Answer

Use unencrypted communication channels

Question 12

Which component of Cisco XDR (formerly Cisco SecureX) is critical for normalizing data from different Cisco security products to enable automated orchestration?

Accepted Answer

Unified Data Model. The 'Cisco XDR Unified Data Model' normalizes disparate logs into a standard format for correlation and automation.

Answer

Cloud-native storage

Answer

Local management agent

Answer

Packet inspection engine

Question 13

Which THREE of the following are considered 'Threat Response' automation actions in a Cisco XDR environment?

Accepted Answer

Blocking a malicious file hash. Isolating an endpoint, blocking a file hash, and blocking a URL are common automated responses.

Answer

Sending a company-wide email

Answer

Rebooting the server hardware

Question 14

You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?

Accepted Answer

Cloudlock API-based CASB integration. Cloudlock uses API-based CASB integration to monitor activity and detect anomalies like abnormal file sharing patterns.

Answer

Cisco Umbrella roaming client

Answer

Cisco ISE Profiling

Answer

Cisco Secure Firewall NAT

Question 15

You are designing a secure API architecture where services are deployed in Kubernetes. You need to enforce authentication and rate limiting at the ingress. Which tool should be used for centralized policy enforcement?

Accepted Answer

An API Gateway integrated into the Ingress Controller. Cisco API Connectivity Manager (ACM) or an API Gateway integrated with the Ingress Controller handles centralized auth, rate limiting, and observability.

Answer

Using IP-based ACLs on the Kubernetes node

Answer

Hard-coding auth logic into every microservice

Answer

Cisco Secure Firewall running in transparent mode

Question 16

When automating security with Cisco XDR, which component allows for the execution of arbitrary scripts on third-party security tools?

Accepted Answer

Cisco XDR Workflow Engine. The 'Cisco XDR Workflow Engine' allows for custom python/javascript scripts to be executed during an orchestration sequence.

Answer

Cisco XDR Threat Intel module

Answer

Cisco XDR Telemetry API

Answer

Cisco XDR Dashboard

Question 17

When designing a secure multi-cloud strategy for applications, how does Cisco Secure Workload facilitate consistent policy management?

Accepted Answer

By providing a centralized policy plane that integrates with native cloud security controls. Secure Workload uses a common policy engine that translates intent-based policies into the native security rules (like Security Groups) of the respective cloud providers.

Answer

By forcing all traffic to transit a VPN tunnel

Answer

By moving all traffic through a centralized Cisco hardware firewall

Answer

By manually creating ACLs in each cloud provider console

Question 18

You are performing a security assessment of a containerized application architecture. Which TWO of the following configurations are critical for ensuring secure communication between pods in a Cisco ACI-managed Kubernetes environment? (Choose TWO)

Accepted Answer

Defining Contracts between EPGs to permit specific traffic types.. In ACI-managed Kubernetes (CNA), security is enforced through Endpoint Groups (EPGs) and contracts that define communication policies between different service tiers.

Answer

Disabling the ACI CNI plugin to allow native Kubernetes network policies.

Answer

Configuring all pods to reside in a single flat, non-segmented network.

Answer

Using physical cabling to separate traffic by VLAN.

Question 19

Which TWO of the following identify risks associated with using AI for security automation?

Accepted Answer

Adversarial machine learning / poisoning. Model drift and adversarial machine learning (data poisoning) are two major concerns.

Answer

Faster network throughput

Answer

Too many security updates

Answer

Increased hardware cost

Question 20

When designing a secure API environment, which THREE threat categories should be prioritized for detection by Cisco API Security? (Choose THREE)

Accepted Answer

Broken Object Level Authorization (BOLA). API security focuses on common threats like BOLA, excessive data exposure, and broken authentication.

Answer

Local fiber optic cable breaks

Answer

Standard server hardware failures