SDSI Risk Events And Requirements Practice Test 2 — 15 Questions

Question 1

When designing a SOC, the team identifies a need for centralized management of threat intelligence feeds. Which Cisco product is the primary repository for this function?

Accepted Answer

Cisco Secure Firewall Management Center. Cisco Secure Firewall Management Center (FMC) is the centralized management platform for Cisco Secure Firewall (FTD) devices and serves as the primary repository and distribution point for threat intelligence feeds, including Cisco Talos feeds, custom block lists, and Security Intelligence objects. It aggregates and applies threat intelligence across managed firewalls. This makes it the standard choice for centralized threat intelligence management in a SOC.

Answer

Cisco Adaptive Security Appliance

Answer

Cisco AnyConnect

Answer

Cisco Defense Orchestrator

Question 2

A security architect is designing a solution to detect data exfiltration over DNS tunnels. The design requires that DNS queries be inspected for anomalous patterns and that high-risk queries be blocked. Which Cisco security control should be integrated into the design to meet this requirement?

Accepted Answer

Cisco Umbrella DNS-layer security. The design requires inspection and blocking of anomalous DNS queries to prevent data exfiltration. Cisco Umbrella DNS-layer security operates at the DNS resolution level, enabling detection and blocking of malicious or tunneling domains before a connection is established. This control is specifically built for DNS security and provides the necessary visibility and enforcement.

Answer

Cisco Secure Network Analytics

Answer

Cisco Secure Email Gateway

Answer

Cisco Secure Firewall with DNS inspection

Question 3

A security architect is creating a risk register for a new Cisco SD-WAN deployment. The register must include potential risk events and their mitigation strategies. Which two risk events should be included in the register? (Choose two.)

Accepted Answer

Data exfiltration through unauthorized use of split tunneling. The SD-WAN controller compromise and split tunneling data exfiltration are both security-specific risks unique to SD-WAN architecture. They require specific design mitigations such as certificate-based authentication, role-based access control, and secure internet gateway integration. These events directly impact the confidentiality, integrity, and availability of the SD-WAN overlay.

Answer

Denial of service on the underlay network from a DDoS attack

Answer

Physical theft of a WAN edge router from a branch office

Answer

Failure of the SD-WAN orchestrator to apply policy due to version mismatch

Question 4

During a post-incident review, an architect identifies that Cisco Stealthwatch (Secure Network Analytics) failed to alert on lateral movement due to lack of visibility. Which design modification is required to ensure visibility into internal east-west traffic?

Accepted Answer

Enable NetFlow export from core and distribution layer switches to the Stealthwatch Flow Collector.. Stealthwatch (Cisco Secure Network Analytics) relies on flow telemetry—primarily NetFlow/IPFIX—to build its behavioral baselines and detect anomalies such as lateral movement. Without flow export from internal Layer 3 boundaries (core and distribution switches), the Flow Collector only sees perimeter traffic and cannot observe east-west conversations between internal hosts. Enabling NetFlow export from those switches feeds the Flow Collector the internal flow records needed to detect anomalous host-to-host behavior.

Answer

Update the Cisco Secure Endpoint policy to scan memory more frequently on all endpoints.

Answer

Increase the logging interval on the perimeter Cisco Firepower Management Center.

Answer

Integrate the Cisco ISE platform via pxGrid to force all internal hosts to re-authenticate.

Question 5

When assessing risk for a remote office branch, the architect decides to use Cisco Umbrella. Which requirement is addressed by implementing the Umbrella roaming client for branch endpoints?

Accepted Answer

Enforcing security policies on endpoints even when they are off the corporate network.. The Umbrella roaming client is lightweight software installed on endpoints (laptops, desktops) that redirects DNS queries to Cisco Umbrella's global network regardless of where the endpoint is — on-premises, at home, or on public Wi-Fi. This ensures DNS-layer security policy enforcement (blocking malicious domains, C2 callbacks, phishing) follows the user off the corporate network, which is the core value proposition of the roaming client. It does not perform DPI, manage router firewalls, or encrypt site-to-site VPN traffic.

Answer

Providing deep packet inspection for local branch-to-branch file transfers.

Answer

Managing local firewall rules on the branch router.

Answer

Providing local site-to-site VPN encryption for branch traffic.

Question 6

A security architect is designing a SOC response workflow using Cisco SecureX Orchestration. Which mechanism is most effective for automated remediation of an endpoint identified as compromised via Cisco Secure Endpoint?

Accepted Answer

Triggering a workflow that executes the isolate endpoint action in Cisco Secure Endpoint via API.. Cisco SecureX Orchestration is designed to automate security workflows across Cisco and third-party products. The most direct and effective remediation for a compromised endpoint identified by Cisco Secure Endpoint is to isolate the endpoint using its native API. The isolate endpoint action in Secure Endpoint cuts off all network communication except for the management connection to the Secure Endpoint cloud, preventing lateral movement and data exfiltration while allowing further investigation. This is a built-in, automated response that can be triggered via SecureX Orchestration, making it the correct choice.

Answer

Deploying an umbrella policy change to redirect the host traffic to a sinkhole.

Answer

Configuring a local script on the Cisco ASA to block the host IP address.

Answer

Using Cisco Defense Orchestrator to push a new access control policy to the endpoint.

Question 7

A security architect is adapting a design post-incident after a credential theft event. Which Cisco ISE feature should be integrated into the architecture to mitigate the risk of compromised static credentials?

Accepted Answer

Enabling MFA integration with Cisco Duo via RADIUS.. Credential theft of static passwords is best mitigated by adding a second authentication factor that cannot be replayed or stolen alongside the password. Integrating Cisco Duo MFA with ISE via RADIUS enforces a second factor (push, TOTP, biometric) at authentication time, so a stolen password alone is insufficient to gain access. This directly addresses the post-incident risk described.

Answer

Deploying Cisco pxGrid to share user identity info with the firewall.

Answer

Configuring Cisco TrustSec to segment user traffic based on IP address.

Answer

Implementing Cisco AnyConnect Device Posture assessment.

Question 8

Following a ransomware incident, an architect must modify the network segmentation strategy. What is the most effective approach to mitigate lateral movement using Cisco TrustSec?

Accepted Answer

Implement SGT-based micro-segmentation at the access layer to enforce policies based on identity rather than IP.. Implementing SGT-based micro-segmentation at the access layer with Cisco TrustSec enforces policies based on identity (security group tags) rather than IP addresses, which effectively mitigates lateral movement by restricting communication between groups even within the same VLAN. This approach is dynamic and scalable, allowing granular control that follows the workload or user, not the IP.

Answer

Deploy extended ACLs on every core switch port to block peer-to-peer traffic.

Answer

Configure static port-security across the entire enterprise to prevent unauthorized devices.

Answer

Transition all physical cabling to private VLANs without leveraging SGTs.

Question 9

A design requirement for a new SOC environment mandates that incident data must be centralized. Which Cisco tool is best suited to act as the single pane of glass for integrating disparate security logs and telemetry?

Accepted Answer

Cisco SecureX. Cisco SecureX is the platform designed to act as a single pane of glass, integrating disparate security products and telemetry into a unified console with threat response, case management, and orchestration. It aggregates data from Cisco and third-party tools, making it the best fit for centralizing incident data across a SOC.

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Defense Orchestrator (CDO)

Question 10

A security architect is designing a SIEM integration for a distributed enterprise. Which tool selection criteria best aligns with the requirement to support real-time correlation across disparate cloud and on-premises environments?

Accepted Answer

Prioritize tools that support native Common Event Format (CEF) ingestion and bidirectional API integrations.. Native Common Event Format (CEF) ingestion and bidirectional API integrations are the criteria that best support real-time correlation across disparate cloud and on-premises sources. CEF is a standardized log format that normalizes events from heterogeneous vendors, and bidirectional APIs allow the SIEM to both ingest telemetry and push response actions back to sources, which is essential for a distributed enterprise.

Answer

Choose tools that utilize a monolithic database structure to ensure data consistency.

Answer

Focus on tools that strictly utilize hardware-based packet capture for all telemetry.

Answer

Select tools based solely on the number of pre-built connectors available in the marketplace.

Question 11

When designing a post-incident security architecture, which THREE factors are critical for determining the placement of Cisco Secure Firewall sensors?

Accepted Answer

Physical segmentation of the network (VLANs/VRFs).. Option C is correct because the physical and logical segmentation of the network (VLANs and VRFs) dictates where a sensor can be inserted and which traffic flows it can observe, since a firewall sensor must sit at a boundary between segments to inspect inter-segment traffic. Option D is correct because placing a sensor requires either a SPAN/mirror port on a switch or a network TAP to copy traffic for inspection; without such a monitoring point, the sensor cannot passively receive the packets it needs to analyze. Option E is correct because the firewall hardware's traffic throughput capacity must match or exceed the volume of traffic at the proposed placement, otherwise the sensor will drop packets or become a bottleneck, undermining both security and availability. Option A does not belong because the count of Wi-Fi users is a rough scale indicator, not a determinant of sensor placement, which depends on traffic paths and segmentation rather than user population. Option B does not belong because server room temperature is a facilities/environmental concern and has no bearing on where a network security sensor is logically or physically positioned.

Answer

The number of users connected to the local office Wi-Fi.

Answer

Local temperature of the server room.

Question 12

A design requirements gathering phase identifies that users frequently access untrusted SaaS applications. Which Cisco solution should be included to mitigate data exfiltration risks?

Accepted Answer

Cisco Umbrella with CASB capability enabled.. Cisco Umbrella with CASB capability enabled provides visibility and control over SaaS application usage, including the ability to detect and block unsanctioned apps, enforce DLP policies, and mitigate data exfiltration risks. It is specifically designed to secure cloud access and protect data in SaaS environments.

Answer

Cisco Secure Firewall with IPS enabled.

Answer

Cisco AnyConnect VPN.

Answer

Cisco Identity Services Engine (ISE).

Question 13

An organization experiences a surge in successful phishing attacks. The post-incident architecture adaptation requires automated email analysis. Which Cisco product provides the necessary API for integrating email sandboxing data into a SOAR platform?

Accepted Answer

Cisco Secure Email API.. Cisco Secure Email (formerly Email Security Appliance) provides a dedicated API that exposes email sandboxing verdicts and threat intelligence, enabling SOAR platforms to automate response actions like quarantining malicious messages. The API specifically supports retrieving detailed analysis from Cisco Advanced Malware Protection (AMP) and Threat Grid sandboxing, which is exactly what's needed for post-incident phishing analysis. Other Cisco APIs focus on different security domains (network, policy orchestration, identity) and lack native email sandboxing data.

Answer

Cisco Firepower Management Center REST API.

Answer

Cisco Defense Orchestrator API.

Answer

Cisco Identity Services Engine ERS API.

Question 14

A SOC analyst requires a tool to gain visibility into encrypted traffic without full decryption. Which Cisco product feature should be included in the design to meet this requirement?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) uses machine learning and network telemetry (NetFlow, TLS metadata such as handshake fields and packet-length sequences) to detect malware in encrypted traffic without decrypting it. It is purpose-built for visibility into encrypted flows while preserving privacy and performance, exactly matching the SOC analyst's requirement.

Answer

Cisco Firepower SSL decryption policies.

Answer

Cisco AnyConnect Network Visibility Module (NVM).

Answer

Cisco Identity Services Engine (ISE) Profiling.

Question 15

Which risk assessment methodology is best suited to guide a design modification for a cloud-native architecture relying on Cisco Secure Cloud Analytics?

Accepted Answer

NIST SP 800-30 for conducting the assessment.. NIST SP 800-30 is a risk assessment methodology specifically designed to guide the assessment process, including identifying threats, vulnerabilities, likelihood, and impact. For a cloud-native architecture using Cisco Secure Cloud Analytics, it provides a structured approach to evaluate risks and inform design modifications. It is vendor-neutral and applicable to cloud environments.

Answer

ISO 27002 implementation guide.

Answer

OWASP Top 10 for all infrastructure components.

Answer

PCI-DSS compliance checklist.