SDSI Risk Events And Requirements — 10 Questions

Question 1

An organization is conducting a risk assessment and identifies a requirement for high-availability secure access. In a Cisco ASA-based design, which feature ensures stateful failover occurs without disrupting active connections?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Active/Active failover with state synchronization configured.. In a Cisco ASA high-availability design, Active/Active failover with state synchronization ensures that both units actively process traffic and that connection state (NAT, TCP state, AAA) is replicated between them. When a failover occurs, existing connections continue without re-establishment because the standby unit already has the state table. This directly satisfies the requirement for stateful failover without disrupting active connections.

Answer

Configuring OSPF adjacency timers for sub-second convergence.

Answer

HSRP (Hot Standby Router Protocol) on the interfaces.

Answer

Cisco Adaptive Security Device Manager (ASDM) Cluster monitoring.

Question 2

Which TWO of the following are primary components of a Cisco SecureX threat response workflow designed to mitigate a ransomware event?

Accepted Answer

Threat intelligence enrichment from Cisco Talos.. SecureX uses enrichment via threat intelligence and remediation via integrated product APIs.

Answer

Upgrading firmware on all network access devices.

Answer

Manual manual configuration of VLANs on the core switch.

Answer

Redeploying the entire network infrastructure from backups.

Question 3

Following a successful breach, the design team needs to implement a 'Zero Trust' architecture. Which component is responsible for enforcing the policy decision made by the Policy Decision Point (PDP) in the Cisco Zero Trust framework?

Accepted Answer

Cisco Secure Firewall (as the PEP).. In the Cisco Zero Trust framework, the Policy Enforcement Point (PEP) enforces the access decisions made by the Policy Decision Point (PDP). Cisco Secure Firewall acts as a PEP by inspecting and allowing or denying traffic based on policy, making it the correct component for enforcing PDP decisions at the network enforcement layer.

Answer

Cisco Identity Services Engine (as the PEP).

Answer

Cisco SecureX (as the PEP).

Answer

Cisco Defense Orchestrator (as the PEP).

Question 4

A design architect is tasked with selecting a SOC tool for 'Threat Hunting'. Which feature in Cisco SecureX is specifically optimized for this task?

Accepted Answer

SecureX Threat Hunting.. SecureX Threat Hunting is the specific capability within Cisco SecureX designed for proactive threat hunting, allowing analysts to query telemetry across multiple Cisco security products (Firepower, Umbrella, Secure Endpoint, Email Security) using a unified, natural-language-style search. It aggregates and correlates events from these sources so hunters can pivot on indicators and uncover threats that automated detections may have missed. The other options are monitoring/visibility tools, not purpose-built hunting consoles.

Answer

Firepower Management Center dashboard.

Answer

Stealthwatch flow charts.

Answer

ISE Live Logs.

Question 5

Which TWO Cisco products are part of the 'Secure Access' architecture that helps mitigate the risk of unauthorized remote access?

Accepted Answer

Cisco AnyConnect Secure Client.. Cisco AnyConnect Secure Client (B) is correct because it is the VPN/ZTNA client that establishes encrypted remote-access tunnels and enforces endpoint posture, directly preventing unauthorized remote access. Cisco Identity Services Engine (ISE) (E) is correct because it provides AAA, 802.1X, and policy-based identity and posture enforcement, ensuring only authenticated and compliant users/devices gain access. Cisco Umbrella (A) is a DNS-layer security and secure web gateway service, not the remote-access client or access-control policy engine. Cisco Stealthwatch (C) is network traffic analytics and threat detection, and Cisco Secure Endpoint (D) is endpoint protection (AMP), neither of which is the Secure Access remote-access component.

Answer

Cisco Umbrella.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Endpoint.

Question 6

Which Cisco product is used to manage the configuration and security policy of multiple Firepower firewalls from a single console?

Accepted Answer

Cisco Firepower Management Center (FMC).. Cisco Firepower Management Center (FMC) is the centralized management console purpose-built to configure, monitor, and manage policy across multiple Firepower Threat Defense (FTD) and classic Firepower appliances. It provides a single pane of glass for access control, IPS, malware, and URL filtering policies across the fleet. CDO is multi-vendor and cloud-managed but is not the primary on-prem FMC replacement for Firepower-specific policy management; ISE is identity/NAC; SecureX is an integration/automation platform, not a firewall policy manager.

Answer

Cisco Defense Orchestrator (CDO).

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco SecureX.

Question 7

When assessing the risk of 'Data Loss' via USB devices, which Cisco product provides the best control for endpoint-based DLP?

Accepted Answer

Cisco Secure Endpoint (with device control/DLP integration).. Cisco Secure Endpoint provides endpoint protection, but Cisco often integrates third-party DLP agents or uses Cisco Secure Firewall for network-level DLP.

Answer

Cisco Stealthwatch.

Answer

Cisco ISE.

Answer

Cisco Umbrella.

Question 8

Which THREE items are included in a SOC 'Incident Response Tool' evaluation?

Accepted Answer

Cost of the software subscription.. Option A (Cost of the software subscription) is correct because total cost of ownership, including licensing/subscription fees, is a standard evaluation criterion when selecting an incident response tool for a SOC budget. Option B (Automation and orchestration capabilities) is correct because SOAR-style automation (playbooks, automated enrichment, orchestrated response actions) directly determines how quickly and consistently a SOC can contain and remediate incidents. Option D (Capability to integrate with existing security stack) is correct because an IR tool must interoperate with the SOC's SIEM, EDR, ticketing, and threat-intel platforms via APIs, syslog, or connectors to be operationally effective. Option C (The vendor's headquarters location) is not a functional evaluation criterion for incident response capability, and Option E (The number of employees in the vendor's marketing department) is irrelevant to the tool's technical or operational performance.

Answer

The vendor's headquarters location.

Answer

The number of employees in the vendor's marketing department.

Question 9

Which TWO Cisco products provide integrated threat intelligence (Talos) to enhance incident response?

Accepted Answer

Cisco Secure Endpoint.. Cisco Secure Endpoint (A) is correct because it integrates Cisco Talos threat intelligence directly into its endpoint protection console, enabling analysts to see file reputation, threat scores, and indicators of compromise to accelerate incident response. Cisco Secure Firewall (B) is also correct because Firepower appliances and the Secure Firewall Management Center consume Talos feeds (via URL filtering, IPS signatures, and Security Intelligence lists) to block malicious IPs, domains, and URLs and to enrich event data during investigations. Cisco AnyConnect (C) is only a VPN/remote-access client and does not itself deliver Talos threat intelligence for incident response. Cisco Stealthwatch (D) provides network flow analytics and behavioral detection but relies on its own telemetry rather than being a Talos intelligence delivery product. Cisco ISE (E) is a network access control and identity policy platform, not a threat-intelligence-driven incident response tool.

Answer

Cisco AnyConnect.

Answer

Cisco Stealthwatch.

Answer

Cisco ISE.

Question 10

A design architect is updating an incident response strategy. What is the role of the 'Post-Incident Architecture Adaptation' phase?

Accepted Answer

To identify and implement changes to prevent recurrence of the incident.. The 'Post-Incident Architecture Adaptation' phase is specifically about learning from the incident and making architectural changes to prevent it from happening again. This includes identifying gaps in the security architecture, updating designs, and implementing controls to mitigate the root cause. Therefore, option B correctly describes its role.

Answer

To document the costs of the incident.

Answer

To discipline employees who caused the incident.

Answer

To update the network documentation for the next audit.