SDSI Risk Events And Requirements Practice Test 2 — 15 Questions

Question 1

A design requirement specifies that all remote access must be verified through device health checks. Which Cisco tool allows for this posture assessment?

Accepted Answer

Cisco AnyConnect Secure Client with Compliance Module.. Cisco AnyConnect (now Secure Client) performs device posture checks using the AnyConnect Compliance Module.

Answer

Cisco Identity Services Engine (ISE) pxGrid.

Answer

Cisco Umbrella roaming client.

Answer

Cisco Secure Firewall VPN portal.

Question 2

An organization is updating its SOC incident response toolset. Which Cisco technology provides the ability to perform 'retrospective security' by tracking files that have entered the network in the past?

Accepted Answer

Cisco Secure Endpoint (AMP).. Cisco Secure Endpoint (formerly AMP for Endpoints) performs retrospective analysis by continuously monitoring file activity over time.

Answer

Cisco Secure Network Analytics (Stealthwatch).

Answer

Cisco Firepower IPS.

Answer

Cisco Umbrella.

Question 3

Which TWO methods are used by Cisco Stealthwatch to detect anomalies in network traffic?

Accepted Answer

Behavioral baseline modeling of host and network patterns.. Stealthwatch uses behavioral modeling and flow data analysis to detect threats.

Answer

Signature-based matching for every packet.

Answer

Deep packet inspection of every payload byte.

Answer

Manual input of all known malicious IP addresses.

Question 4

A security architect is developing a requirements document for a SOC. Which Cisco capability allows the SOC to prioritize alerts by correlating threats across network, endpoint, and cloud?

Accepted Answer

Cisco SecureX cross-product correlation.. Cisco SecureX provides cross-product correlation to reduce alert fatigue and prioritize incidents.

Answer

Cisco Stealthwatch alert grouping.

Answer

Cisco Secure Firewall management center alert correlation.

Answer

Cisco Identity Services Engine monitoring.

Question 5

During a design review, it is determined that the current logging architecture is missing context for user identity. Which Cisco tool must be integrated with the firewall to map IP addresses to specific usernames in the logs?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco ISE provides the identity context (IP to user mapping) that can be sent to firewalls via pxGrid or SXP.

Answer

Cisco Defense Orchestrator.

Answer

Cisco Umbrella.

Answer

Cisco SecureX.

Question 6

A security design requires that all outbound traffic be inspected for malware. Which Cisco solution feature should be included to achieve this at the DNS layer?

Accepted Answer

Cisco Umbrella DNS-layer security.. Cisco Umbrella provides DNS-layer security by preventing connections to known malicious domains.

Answer

Cisco AnyConnect VPN tunnel.

Answer

Cisco Identity Services Engine.

Answer

Cisco Secure Firewall IPS.

Question 7

What is the primary purpose of conducting a risk assessment as part of the security design process?

Accepted Answer

To identify and prioritize security controls based on threat and vulnerability data.. Risk assessments identify vulnerabilities, threats, and asset values, allowing designers to prioritize security controls effectively.

Answer

To automate the patching of all network servers.

Answer

To ensure compliance with local labor laws.

Answer

To select the cheapest security hardware.

Question 8

A design requirement for risk mitigation in a data center requires micro-segmentation. Which Cisco technology is specifically designed to provide workload-level segmentation based on identity and policy?

Accepted Answer

Cisco Secure Workload.. Cisco Secure Workload (formerly Tetration) provides deep visibility and micro-segmentation for data center workloads.

Answer

Cisco Firepower NGFW.

Answer

Cisco AnyConnect.

Answer

Cisco TrustSec/SGTs.

Question 9

Which THREE criteria are used during the 'Requirements Gathering' phase of a secure architecture design?

Accepted Answer

Business objectives and compliance requirements.. Requirements gathering must account for performance, scalability, and security objectives.

Answer

The color of the hardware rack units.

Answer

The personal email addresses of the network engineering team.

Question 10

Following a successful breach, the design team needs to implement a 'Zero Trust' architecture. Which component is responsible for enforcing the policy decision made by the Policy Decision Point (PDP) in the Cisco Zero Trust framework?

Accepted Answer

Cisco Secure Firewall (as the PEP).. The Policy Enforcement Point (PEP) is the entity that blocks or permits traffic based on the decisions of the PDP.

Answer

Cisco Identity Services Engine (as the PEP).

Answer

Cisco SecureX (as the PEP).

Answer

Cisco Defense Orchestrator (as the PEP).

Question 11

A design needs to restrict network access based on the user's role and device type. Which Cisco product is the primary engine for this context-aware policy control?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco ISE (Identity Services Engine) is the industry-standard policy engine for context-aware access control.

Answer

Cisco SecureX.

Answer

Cisco Firepower Management Center.

Answer

Cisco Umbrella.

Question 12

A security architect is designing a DR strategy. Which feature of Cisco Secure Firewall ensures that configurations are synchronized between primary and backup units in a high-availability pair?

Accepted Answer

Cisco Secure Firewall Failover Link.. Stateful failover ensures configuration and session state synchronization.

Answer

Cisco Defense Orchestrator auto-sync.

Answer

Cisco Identity Services Engine RADIUS sync.

Answer

Cisco FMC policy deployment.

Question 13

A risk assessment reveals that internal servers are vulnerable to unauthorized access via SMB protocols. Which Cisco feature should be implemented on the internal switching infrastructure to mitigate this risk?

Accepted Answer

Cisco TrustSec (SGTs).. Cisco TrustSec/SGTs allow for segmentation that blocks lateral movement between servers, regardless of VLAN.

Answer

ACLs on the core switch.

Answer

Cisco Secure Endpoint scan.

Answer

Cisco Umbrella local policy.

Question 14

When designing an architecture to mitigate the risk of data exfiltration, which Cisco solution provides visibility into the data being sent out of the organization?

Accepted Answer

Cisco Secure Firewall with TLS Inspection.. Cisco Secure Firewall (NGFW) with TLS inspection provides visibility into encrypted outbound data.

Answer

Cisco Umbrella (DNS only).

Answer

Cisco ISE.

Answer

Cisco Stealthwatch.

Question 15

Which document is essential for the SOC to standardize how they handle identified security incidents?

Accepted Answer

Incident Response Plan (IRP).. An Incident Response Plan (IRP) is the required document for standardizing response procedures.

Answer

Vulnerability Assessment Report.

Answer

Vendor Product Data Sheets.

Answer

Network Topology Map.