SDSI Risk Events And Requirements Practice Test 3 — 15 Questions

Question 1

A requirement for an incident response toolset is the ability to automatically contain a workstation upon detecting a specific malware threat. Which Cisco tool provides this 'isolate' capability?

Accepted Answer

Cisco Secure Endpoint (AMP).. Cisco Secure Endpoint (formerly AMP for Endpoints) has a native 'Isolate' feature.

Answer

Cisco AnyConnect.

Answer

Cisco Umbrella roaming client.

Answer

Cisco Secure Firewall.

Question 2

A design architect is tasked with selecting a SOC tool for 'Threat Hunting'. Which feature in Cisco SecureX is specifically optimized for this task?

Accepted Answer

SecureX Threat Hunting.. The Threat Hunting feature in SecureX allows for broad searching across indicators (IPs, domains, hashes) in multiple integrated products.

Answer

Firepower Management Center dashboard.

Answer

Stealthwatch flow charts.

Answer

ISE Live Logs.

Question 3

Which THREE components are critical for an effective post-incident 'Architecture Adaptation'?

Accepted Answer

Updating security policies to address the identified gap.. Post-incident adaptation requires analyzing the root cause, updating policies, and hardening the infrastructure.

Answer

Increasing the number of helpdesk staff.

Answer

Renaming all user accounts in the domain.

Question 4

Which risk assessment technique involves evaluating the impact of an attack on the confidentiality, integrity, and availability of an asset?

Accepted Answer

CIA Triad Impact Assessment.. CIA Triad assessment is a standard risk evaluation methodology.

Answer

SWOT Analysis.

Answer

Network Penetration Testing.

Answer

Cost-Benefit Analysis.

Question 5

Which TWO Cisco products are part of the 'Secure Access' architecture that helps mitigate the risk of unauthorized remote access?

Accepted Answer

Cisco AnyConnect Secure Client.. Secure access relies on strong authentication (ISE) and encrypted transport (AnyConnect/Secure Client).

Answer

Cisco Umbrella.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Endpoint.

Question 6

A design requirement for a SOC environment is to have real-time visibility into who is on the network. Which Cisco tool is best for this?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco ISE (Identity Services Engine) tracks all authentication and device connectivity events in real-time.

Answer

Cisco SecureX.

Answer

Cisco Umbrella.

Answer

Cisco Firepower Management Center.

Question 7

A security architect is designing a solution to block malicious URLs across all branch offices. Which Cisco feature provides the most efficient, scalable way to manage this across 500+ locations?

Accepted Answer

Cisco Umbrella cloud-delivered DNS filtering.. Cisco Umbrella uses cloud-delivered DNS-based blocking, making it highly scalable compared to managing local firewall URL lists.

Answer

Cisco Stealthwatch.

Answer

Cisco Identity Services Engine (ISE).

Answer

Local URL filtering on each branch firewall.

Question 8

During a risk assessment, it is determined that a legacy application cannot be patched. Which Cisco security control should be prioritized to compensate for this vulnerability?

Accepted Answer

Virtual patching via Cisco Secure Firewall IPS.. Network-based IPS (Intrusion Prevention System) can provide virtual patching by blocking exploits targeting the vulnerability.

Answer

Cisco Stealthwatch behavioral alerts.

Answer

Cisco AnyConnect VPN.

Answer

Cisco Umbrella DNS blocking.

Question 9

Which Cisco product is used to manage the configuration and security policy of multiple Firepower firewalls from a single console?

Accepted Answer

Cisco Firepower Management Center (FMC).. Cisco Firepower Management Center (FMC) is the centralized management tool for Cisco Secure Firewalls.

Answer

Cisco Defense Orchestrator (CDO).

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco SecureX.

Question 10

A design requirements document specifies a need for 'Network Segmentation' to contain breaches. Which Cisco technology provides the best granular control using Scalable Group Tags (SGTs)?

Accepted Answer

Cisco TrustSec (SGTs).. Cisco TrustSec uses SGTs to enforce segmentation policies based on identity, independent of IP address.

Answer

Cisco Secure Firewall interface zones.

Answer

VLAN-based segmentation.

Answer

Cisco Umbrella local policy.

Question 11

An architect is reviewing post-incident logs in Cisco SecureX. Which feature allows the analyst to see the timeline of events from different integrated products in one view?

Accepted Answer

SecureX Incident/Event Timeline.. The 'Incident' or 'Timeline' view in SecureX aggregates all related events across the Cisco security stack.

Answer

Stealthwatch Alarms view.

Answer

FMC Event Viewer.

Answer

ISE Auth Reports.

Question 12

Which THREE items should be included in a 'Security Design Requirements' document?

Accepted Answer

List of all potential threat actors and their motivations.. Design requirements must cover performance, threat vectors, and compliance standards.

Answer

The preferred color scheme for the SOC monitors.

Answer

The salary information of the security team.

Question 13

Which TWO Cisco technologies should be used to protect a data center against lateral movement of threats?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch).. Lateral movement is best countered by micro-segmentation and behavioral flow monitoring.

Answer

Cisco Umbrella.

Answer

Cisco Secure Email.

Answer

Cisco AnyConnect.

Question 14

Which Cisco product is specifically designed to provide visibility into encrypted traffic without the need for manual decryption?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) provides this capability.

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco Stealthwatch.

Answer

Cisco Firepower IPS.

Question 15

A design architect is updating an incident response strategy. What is the role of the 'Post-Incident Architecture Adaptation' phase?

Accepted Answer

To identify and implement changes to prevent recurrence of the incident.. This phase ensures that identified gaps are closed and the infrastructure is hardened to prevent recurrence.

Answer

To document the costs of the incident.

Answer

To update the network documentation for the next annual audit.

Answer

To discipline employees who caused the incident.