SDSI Risk Events And Requirements — 40 Questions

Question 1

An organization is conducting a risk assessment and identifies a requirement for high-availability secure access. In a Cisco ASA-based design, which feature ensures stateful failover occurs without disrupting active connections?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Active/Active failover with state synchronization configured.. In a Cisco ASA high-availability design, Active/Active failover with state synchronization ensures that both units actively process traffic and that connection state (NAT, TCP state, AAA) is replicated between them. When a failover occurs, existing connections continue without re-establishment because the standby unit already has the state table. This directly satisfies the requirement for stateful failover without disrupting active connections.

Answer

Configuring OSPF adjacency timers for sub-second convergence.

Answer

HSRP (Hot Standby Router Protocol) on the interfaces.

Answer

Cisco Adaptive Security Device Manager (ASDM) Cluster monitoring.

Question 2

Which TWO of the following are primary components of a Cisco SecureX threat response workflow designed to mitigate a ransomware event?

Accepted Answer

Threat intelligence enrichment from Cisco Talos.. SecureX uses enrichment via threat intelligence and remediation via integrated product APIs.

Answer

Upgrading firmware on all network access devices.

Answer

Manual manual configuration of VLANs on the core switch.

Answer

Redeploying the entire network infrastructure from backups.

Question 3

Following a successful breach, the design team needs to implement a 'Zero Trust' architecture. Which component is responsible for enforcing the policy decision made by the Policy Decision Point (PDP) in the Cisco Zero Trust framework?

Accepted Answer

Cisco Secure Firewall (as the PEP).. In the Cisco Zero Trust framework, the Policy Enforcement Point (PEP) enforces the access decisions made by the Policy Decision Point (PDP). Cisco Secure Firewall acts as a PEP by inspecting and allowing or denying traffic based on policy, making it the correct component for enforcing PDP decisions at the network enforcement layer.

Answer

Cisco Identity Services Engine (as the PEP).

Answer

Cisco SecureX (as the PEP).

Answer

Cisco Defense Orchestrator (as the PEP).

Question 4

A design architect is tasked with selecting a SOC tool for 'Threat Hunting'. Which feature in Cisco SecureX is specifically optimized for this task?

Accepted Answer

SecureX Threat Hunting.. SecureX Threat Hunting is the specific capability within Cisco SecureX designed for proactive threat hunting, allowing analysts to query telemetry across multiple Cisco security products (Firepower, Umbrella, Secure Endpoint, Email Security) using a unified, natural-language-style search. It aggregates and correlates events from these sources so hunters can pivot on indicators and uncover threats that automated detections may have missed. The other options are monitoring/visibility tools, not purpose-built hunting consoles.

Answer

Firepower Management Center dashboard.

Answer

Stealthwatch flow charts.

Answer

ISE Live Logs.

Question 5

Which TWO Cisco products are part of the 'Secure Access' architecture that helps mitigate the risk of unauthorized remote access?

Accepted Answer

Cisco AnyConnect Secure Client.. Cisco AnyConnect Secure Client (B) is correct because it is the VPN/ZTNA client that establishes encrypted remote-access tunnels and enforces endpoint posture, directly preventing unauthorized remote access. Cisco Identity Services Engine (ISE) (E) is correct because it provides AAA, 802.1X, and policy-based identity and posture enforcement, ensuring only authenticated and compliant users/devices gain access. Cisco Umbrella (A) is a DNS-layer security and secure web gateway service, not the remote-access client or access-control policy engine. Cisco Stealthwatch (C) is network traffic analytics and threat detection, and Cisco Secure Endpoint (D) is endpoint protection (AMP), neither of which is the Secure Access remote-access component.

Answer

Cisco Umbrella.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Endpoint.

Question 6

Which Cisco product is used to manage the configuration and security policy of multiple Firepower firewalls from a single console?

Accepted Answer

Cisco Firepower Management Center (FMC).. Cisco Firepower Management Center (FMC) is the centralized management console purpose-built to configure, monitor, and manage policy across multiple Firepower Threat Defense (FTD) and classic Firepower appliances. It provides a single pane of glass for access control, IPS, malware, and URL filtering policies across the fleet. CDO is multi-vendor and cloud-managed but is not the primary on-prem FMC replacement for Firepower-specific policy management; ISE is identity/NAC; SecureX is an integration/automation platform, not a firewall policy manager.

Answer

Cisco Defense Orchestrator (CDO).

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco SecureX.

Question 7

When assessing the risk of 'Data Loss' via USB devices, which Cisco product provides the best control for endpoint-based DLP?

Accepted Answer

Cisco Secure Endpoint (with device control/DLP integration).. Cisco Secure Endpoint provides endpoint protection, but Cisco often integrates third-party DLP agents or uses Cisco Secure Firewall for network-level DLP.

Answer

Cisco Stealthwatch.

Answer

Cisco ISE.

Answer

Cisco Umbrella.

Question 8

Which THREE items are included in a SOC 'Incident Response Tool' evaluation?

Accepted Answer

Cost of the software subscription.. Option A (Cost of the software subscription) is correct because total cost of ownership, including licensing/subscription fees, is a standard evaluation criterion when selecting an incident response tool for a SOC budget. Option B (Automation and orchestration capabilities) is correct because SOAR-style automation (playbooks, automated enrichment, orchestrated response actions) directly determines how quickly and consistently a SOC can contain and remediate incidents. Option D (Capability to integrate with existing security stack) is correct because an IR tool must interoperate with the SOC's SIEM, EDR, ticketing, and threat-intel platforms via APIs, syslog, or connectors to be operationally effective. Option C (The vendor's headquarters location) is not a functional evaluation criterion for incident response capability, and Option E (The number of employees in the vendor's marketing department) is irrelevant to the tool's technical or operational performance.

Answer

The vendor's headquarters location.

Answer

The number of employees in the vendor's marketing department.

Question 9

Which TWO Cisco products provide integrated threat intelligence (Talos) to enhance incident response?

Accepted Answer

Cisco Secure Endpoint.. Cisco Secure Endpoint (A) is correct because it integrates Cisco Talos threat intelligence directly into its endpoint protection console, enabling analysts to see file reputation, threat scores, and indicators of compromise to accelerate incident response. Cisco Secure Firewall (B) is also correct because Firepower appliances and the Secure Firewall Management Center consume Talos feeds (via URL filtering, IPS signatures, and Security Intelligence lists) to block malicious IPs, domains, and URLs and to enrich event data during investigations. Cisco AnyConnect (C) is only a VPN/remote-access client and does not itself deliver Talos threat intelligence for incident response. Cisco Stealthwatch (D) provides network flow analytics and behavioral detection but relies on its own telemetry rather than being a Talos intelligence delivery product. Cisco ISE (E) is a network access control and identity policy platform, not a threat-intelligence-driven incident response tool.

Answer

Cisco AnyConnect.

Answer

Cisco Stealthwatch.

Answer

Cisco ISE.

Question 10

A design architect is updating an incident response strategy. What is the role of the 'Post-Incident Architecture Adaptation' phase?

Accepted Answer

To identify and implement changes to prevent recurrence of the incident.. The 'Post-Incident Architecture Adaptation' phase is specifically about learning from the incident and making architectural changes to prevent it from happening again. This includes identifying gaps in the security architecture, updating designs, and implementing controls to mitigate the root cause. Therefore, option B correctly describes its role.

Answer

To document the costs of the incident.

Answer

To discipline employees who caused the incident.

Answer

To update the network documentation for the next audit.

Question 11

Which design principle should be followed when implementing micro-segmentation in a data center?

Accepted Answer

Implement identity-based segmentation at the workload level.. Micro-segmentation in a data center should be identity-based at the workload level, using workload attributes (labels, tags, application identity, or security group tags) rather than static network constructs. This allows granular east-west policy that follows the workload regardless of IP address changes, VM migration, or container rescheduling, which is the core promise of micro-segmentation.

Answer

Segment based only on IP addresses.

Answer

Disable all firewalls for maximum performance.

Answer

Keep all servers in the same VLAN for simplicity.

Question 12

Which TWO Cisco products are used to monitor and detect threats in a network environment?

Accepted Answer

Cisco Secure Firewall (IPS).. Cisco Secure Firewall (IPS) is correct because its intrusion prevention system continuously inspects traffic inline and can detect and block malicious activity such as exploits, malware, and policy violations in the network environment. Cisco Secure Network Analytics (Stealthwatch) is correct because it uses NetFlow and telemetry from network devices to detect anomalous behavior, lateral movement, and threats across the network. Cisco AnyConnect is a VPN/remote-access client, not a threat monitoring or detection product. Cisco Secure Email protects email traffic against phishing and malware, but it is not a general network threat monitoring/detection platform. Cisco ISE is an identity and access control (NAC/RADIUS/TACACS+) solution, not a threat detection tool.

Answer

Cisco AnyConnect.

Answer

Cisco Secure Email.

Answer

Cisco ISE.

Question 13

A design requirement for a SOC environment is to have real-time visibility into who is on the network. Which Cisco tool is best for this?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco Identity Services Engine (ISE) is the correct answer because it provides real-time visibility into who and what is on the network by continuously profiling endpoints, authenticating users and devices via 802.1X, MAB, and RADIUS, and enforcing identity-based policies. ISE's contextual data (identity, posture, location, device type) is exactly what a SOC needs for real-time network visibility.

Answer

Cisco Umbrella.

Answer

Cisco Firepower Management Center.

Answer

Cisco SecureX.

Question 14

Which THREE criteria are used during the 'Requirements Gathering' phase of a secure architecture design?

Accepted Answer

Existing network topology and traffic flow patterns.. Option A is correct because understanding the existing network topology and traffic flow patterns is essential during Requirements Gathering to establish a baseline, identify trust boundaries, and determine where security controls such as firewalls, IDS/IPS, and segmentation must be placed. Option B is correct because throughput and latency requirements for critical applications directly influence architecture decisions, including link sizing, QoS policies, and the selection of security appliances that must inspect traffic without introducing unacceptable delay. Option D is correct because business objectives and compliance requirements (for example, PCI DSS, HIPAA, or GDPR) define the security, availability, and data-handling goals that the architecture must satisfy, making them foundational inputs to the design. Option C does not belong because personal email addresses of network staff are irrelevant personal data with no bearing on architectural requirements. Option E does not belong because the color of hardware rack units is a cosmetic detail unrelated to security or functional design criteria.

Answer

The personal email addresses of the network staff.

Answer

The color of the hardware rack units.

Question 15

A financial institution is performing a risk assessment on its cloud-to-on-premises connection. The assessment methodology indicates a high risk of man-in-the-middle attacks. Which design modification is required to align with Cisco security design best practices?

Accepted Answer

Implement mTLS and certificate-based authentication. Implementing mutual TLS (mTLS) with certificate-based authentication is the correct design modification because it ensures both endpoints authenticate each other using digital certificates, preventing man-in-the-middle attacks by verifying identities and encrypting the tunnel. This aligns with Cisco security best practices for cloud-to-on-premises connections, which recommend strong mutual authentication and encryption.

Answer

Reduce key size to 1024-bit for compatibility

Answer

Disable IKEv2 and force IKEv1

Answer

Enable split-tunneling

Question 16

When designing a SOC, the team identifies a need for centralized management of threat intelligence feeds. Which Cisco product is the primary repository for this function?

Accepted Answer

Cisco Secure Firewall Management Center. Cisco Secure Firewall Management Center (FMC) is the centralized management platform for Cisco Secure Firewall (FTD) devices and serves as the primary repository and distribution point for threat intelligence feeds, including Cisco Talos feeds, custom block lists, and Security Intelligence objects. It aggregates and applies threat intelligence across managed firewalls. This makes it the standard choice for centralized threat intelligence management in a SOC.

Answer

Cisco Adaptive Security Appliance

Answer

Cisco AnyConnect

Answer

Cisco Defense Orchestrator

Question 17

A security architect is designing a solution to detect data exfiltration over DNS tunnels. The design requires that DNS queries be inspected for anomalous patterns and that high-risk queries be blocked. Which Cisco security control should be integrated into the design to meet this requirement?

Accepted Answer

Cisco Umbrella DNS-layer security. The design requires inspection and blocking of anomalous DNS queries to prevent data exfiltration. Cisco Umbrella DNS-layer security operates at the DNS resolution level, enabling detection and blocking of malicious or tunneling domains before a connection is established. This control is specifically built for DNS security and provides the necessary visibility and enforcement.

Answer

Cisco Secure Network Analytics

Answer

Cisco Secure Email Gateway

Answer

Cisco Secure Firewall with DNS inspection

Question 18

A security architect is creating a risk register for a new Cisco SD-WAN deployment. The register must include potential risk events and their mitigation strategies. Which two risk events should be included in the register? (Choose two.)

Accepted Answer

Data exfiltration through unauthorized use of split tunneling. The SD-WAN controller compromise and split tunneling data exfiltration are both security-specific risks unique to SD-WAN architecture. They require specific design mitigations such as certificate-based authentication, role-based access control, and secure internet gateway integration. These events directly impact the confidentiality, integrity, and availability of the SD-WAN overlay.

Answer

Denial of service on the underlay network from a DDoS attack

Answer

Physical theft of a WAN edge router from a branch office

Answer

Failure of the SD-WAN orchestrator to apply policy due to version mismatch

Question 19

During a post-incident review, an architect identifies that Cisco Stealthwatch (Secure Network Analytics) failed to alert on lateral movement due to lack of visibility. Which design modification is required to ensure visibility into internal east-west traffic?

Accepted Answer

Enable NetFlow export from core and distribution layer switches to the Stealthwatch Flow Collector.. Stealthwatch (Cisco Secure Network Analytics) relies on flow telemetry—primarily NetFlow/IPFIX—to build its behavioral baselines and detect anomalies such as lateral movement. Without flow export from internal Layer 3 boundaries (core and distribution switches), the Flow Collector only sees perimeter traffic and cannot observe east-west conversations between internal hosts. Enabling NetFlow export from those switches feeds the Flow Collector the internal flow records needed to detect anomalous host-to-host behavior.

Answer

Update the Cisco Secure Endpoint policy to scan memory more frequently on all endpoints.

Answer

Increase the logging interval on the perimeter Cisco Firepower Management Center.

Answer

Integrate the Cisco ISE platform via pxGrid to force all internal hosts to re-authenticate.

Question 20

When assessing risk for a remote office branch, the architect decides to use Cisco Umbrella. Which requirement is addressed by implementing the Umbrella roaming client for branch endpoints?

Accepted Answer

Enforcing security policies on endpoints even when they are off the corporate network.. The Umbrella roaming client is lightweight software installed on endpoints (laptops, desktops) that redirects DNS queries to Cisco Umbrella's global network regardless of where the endpoint is — on-premises, at home, or on public Wi-Fi. This ensures DNS-layer security policy enforcement (blocking malicious domains, C2 callbacks, phishing) follows the user off the corporate network, which is the core value proposition of the roaming client. It does not perform DPI, manage router firewalls, or encrypt site-to-site VPN traffic.

Answer

Providing deep packet inspection for local branch-to-branch file transfers.

Answer

Managing local firewall rules on the branch router.

Answer

Providing local site-to-site VPN encryption for branch traffic.