SDSI Risk Events And Requirements Practice Test 6 — 15 Questions

Question 1

Which Cisco product allows administrators to manage security policies across a multi-vendor firewall environment?

Accepted Answer

Cisco Defense Orchestrator (CDO).. Cisco Defense Orchestrator (CDO) is a cloud-based management platform designed to orchestrate security policy across multi-vendor firewalls (Cisco ASA, FTD, Meraki, and third-party devices). It provides a single console for policy consistency, object management, and device onboarding across heterogeneous environments. FMC is Firepower-only, ISE is identity/NAC, and SecureX is an integration/automation fabric, not a multi-vendor firewall policy manager.

Answer

Cisco SecureX.

Answer

Cisco ISE.

Answer

Cisco Firepower Management Center (FMC).

Question 2

Which TWO Cisco products are used to monitor and detect threats in a network environment?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch).. Cisco Secure Network Analytics (Stealthwatch) (A) is correct because it uses NetFlow and flow telemetry with behavioral analytics and machine learning to continuously monitor network traffic and detect anomalies, insider threats, and malware command-and-control activity. Cisco Secure Firewall (IPS) (E) is correct because its Intrusion Prevention System inspects traffic inline against signatures and behavioral policies to detect and block exploits, malicious payloads, and known attack patterns. Cisco Secure Email (B) is not a network monitoring/detection product in this context; it focuses on securing email communications (spam, phishing, malware filtering) rather than monitoring network traffic for threats. Cisco ISE (C) is a policy and identity/access-control platform (802.1X, profiling, posture, guest access), not a threat monitoring/detection tool. Cisco AnyConnect (D) is a VPN/remote-access client providing secure connectivity, not network threat monitoring or detection.

Answer

Cisco Secure Email.

Answer

Cisco ISE.

Answer

Cisco AnyConnect.

Question 3

What is the primary role of Cisco Secure Firewall in a network design?

Accepted Answer

To provide traffic inspection, filtering, and access control.. Cisco Secure Firewall (formerly Firepower) is a next-generation firewall whose primary role is to inspect traffic, enforce access control policies, and filter based on L3/L4/L7 attributes, application identity, and threat intelligence. It provides stateful inspection, IPS, URL filtering, and application control, making it the enforcement point for network security policy.

Answer

To act as a core network switch.

Answer

To manage user credentials.

Answer

To provide internet access for all users.

Question 4

A security design architect needs to ensure that all endpoints have the latest malware signatures. Which tool provides continuous, automated updates?

Accepted Answer

Cisco Secure Endpoint.. Cisco Secure Endpoint (formerly AMP for Endpoints) is the endpoint detection and response (EDR) agent that continuously updates malware signatures and cloud-based threat intelligence on managed endpoints. Its cloud reputation engine and signature sets are pushed automatically without administrator intervention, satisfying the requirement for continuous, automated updates.

Answer

Cisco Secure Firewall.

Answer

Cisco ISE.

Answer

Cisco Umbrella.

Question 5

Which tool provides visibility into encrypted traffic without full decryption in a Cisco network design?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) is designed to identify malware and threats in encrypted traffic without full decryption by using flow metadata, sequence of packet lengths and times (SPLT), and machine learning. It leverages Cisco's Talos threat intelligence and can run on Catalyst switches and ISR/ASR routers. Firepower IPS, ISE, and Stealthwatch do not provide ETA's decryption-free encrypted traffic analysis.

Answer

Cisco Firepower IPS.

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco Stealthwatch.

Question 6

When assessing the risk of 'Data Loss' via USB devices, which Cisco product provides the best control for endpoint-based DLP?

Accepted Answer

Cisco Secure Endpoint.. Cisco Secure Endpoint (formerly AMP for Endpoints) is the endpoint agent that provides device-level control, including USB device blocking and data loss prevention policies on endpoints. It is the only option that operates at the endpoint layer where USB devices are physically attached, making it the correct choice for endpoint-based DLP against USB data loss.

Answer

Cisco Stealthwatch.

Answer

Cisco ISE.

Answer

Cisco Umbrella.

Question 7

An organization is performing a risk assessment for a new remote access design. They identify that the SOC currently lacks visibility into anomalous VPN session behavior. Which Cisco solution should the design incorporate to provide behavioral analytics for incident response tool selection?

Accepted Answer

Cisco Secure Network Analytics. Cisco Secure Network Analytics (formerly Stealthwatch) uses NetFlow and telemetry to build behavioural baselines and detect anomalies such as unusual VPN session patterns, data transfers, or connection volumes. It is purpose-built for network behavioural analytics and feeds incident response tooling with actionable detections. This directly addresses the SOC's lack of visibility into anomalous VPN behaviour.

Answer

Cisco Identity Services Engine

Answer

Cisco Umbrella

Answer

Cisco Secure Firewall Management Center

Question 8

Following a major data exfiltration incident, the design team needs to adapt the architecture to prevent lateral movement. Which Cisco Secure Firewall design modification is most effective for mitigating this risk while maintaining operational performance?

Accepted Answer

Implement SGT-based micro-segmentation. SGT-based micro-segmentation using Cisco TrustSec assigns Security Group Tags to workloads and enforces policy based on those tags rather than IP addresses. This allows the firewall to apply granular east-west controls that prevent lateral movement between compromised and target systems, while keeping policy scalable and operationally efficient. It directly addresses lateral movement risk without the performance penalty of inspecting every signature.

Answer

Enable all IPS signatures in blocking mode

Answer

Transition to transparent mode

Answer

Increase firewall inspection timeouts

Question 9

During a post-incident review, an architect discovers that the SOC could not correlate logs across the Cisco Secure Email and Cisco Secure Endpoint platforms. Which integration should the design specify to improve future incident response?

Accepted Answer

Cisco Security Cloud Control (SecureX). Cisco Security Cloud Control (formerly SecureX) is the platform that aggregates telemetry from Cisco Secure Email, Secure Endpoint, Secure Firewall, and other products into a unified incident view. It enables cross-platform correlation, threat hunting, and automated response workflows, directly solving the SOC's inability to correlate logs across email and endpoint.

Answer

Cisco Webex Control Hub

Answer

Cisco DNA Center

Answer

Cisco ThousandEyes

Question 10

When gathering requirements for a security design, a customer specifies they need to automate the containment of infected endpoints discovered by Cisco Secure Endpoint. Which API integration should the architect document?

Accepted Answer

Cisco Secure Endpoint API. The Cisco Secure Endpoint API (formerly AMP for Endpoints) provides programmatic access to endpoint detection and response (EDR) capabilities, including the ability to isolate (contain) an infected endpoint. Since the requirement is to automate containment of endpoints discovered by Cisco Secure Endpoint, the architect must document the Cisco Secure Endpoint API. This API allows security teams to integrate with SIEM/SOAR platforms to trigger isolation actions automatically.

Answer

Cisco Umbrella Investigate API

Answer

Cisco Secure Firewall API

Answer

Cisco ISE REST API

Question 11

An organization is modifying their architecture to meet new compliance requirements for logging. The design requires offloading logs from multiple Cisco Firepower sensors. What is the recommended destination for long-term audit storage?

Accepted Answer

Security Information and Event Management (SIEM). For long-term audit storage of logs from multiple Cisco Firepower sensors, a Security Information and Event Management (SIEM) system is the recommended destination. SIEMs are designed to aggregate, correlate, and retain logs from diverse sources for compliance and forensic analysis. They provide centralized storage, search, and reporting capabilities that meet audit requirements.

Answer

Cisco ISE Node

Answer

Cisco Catalyst Center

Answer

Local flash memory on the sensor

Question 12

A security architect is designing an incident response workflow. Which action in the Cisco Secure Endpoint console would be most appropriate to perform if a 'Host Isolation' request fails during an active threat containment?

Accepted Answer

Quarantine the host via Cisco ISE. When Host Isolation in Cisco Secure Endpoint fails, the endpoint remains on the network and the threat is still active, so the architect needs an alternative enforcement point. Cisco ISE can apply a quarantine or remediation authorization profile via 802.1X, MACsec, or TrustSec to restrict the endpoint's network access at the switch or wireless controller. This provides a network-layer containment fallback that does not depend on the endpoint agent's isolation capability.

Answer

Clear the event logs in FMC

Answer

Reboot the Cisco Secure Endpoint server

Answer

Deploy a new firewall policy

Question 13

Which risk assessment methodology component focuses on identifying the 'crown jewels' of the organization's network architecture?

Accepted Answer

Asset Identification. Asset Identification is the component of risk assessment that focuses on discovering and cataloging all assets, especially the 'crown jewels'—the most critical and valuable data, systems, and applications. This step is foundational because you cannot protect what you haven't identified, and risk cannot be accurately assessed without knowing which assets are most business-critical. By identifying crown jewels first, organizations can prioritize subsequent risk analysis and controls where they matter most.

Answer

Control Implementation

Answer

Vulnerability Scanning

Answer

Threat Vector Analysis

Question 14

A security designer is tasked with improving the SOC's incident response time. Which TWO Cisco platform capabilities should be integrated to enable automated threat hunting and containment? (Choose two)

Accepted Answer

Cisco Secure Endpoint. Cisco Secure Endpoint (A) is correct because it provides endpoint detection and response (EDR) telemetry and can automatically isolate a compromised host, which directly supports automated threat hunting and containment at the endpoint layer. Cisco Secure Firewall (D) is correct because its management center (FMC) supports automated threat hunting via correlation/incident policies and can enforce containment by blocking malicious traffic through access control and intrusion policies. Together these platforms feed and act on threat intelligence to shorten SOC response time. Cisco Webex (B) is a collaboration suite, Cisco UCS Manager (C) manages compute hardware, and Cisco Prime Infrastructure (E) is a network management tool; none of these provide the automated threat hunting and containment capabilities required here.

Answer

Cisco Webex

Answer

Cisco UCS Manager

Answer

Cisco Prime Infrastructure

Question 15

During a risk assessment, which THREE factors are considered critical for determining the design requirements of a secure infrastructure? (Choose three)

Accepted Answer

Regulatory and compliance requirements. Option A (Regulatory and compliance requirements) is correct because laws and standards such as GDPR, HIPAA, PCI DSS, or ISO 27001 impose mandatory controls (encryption, access logging, retention) that directly shape the architecture and security baselines of the infrastructure. Option C (Current threat intelligence and landscape) is correct because knowing the active threat actors, TTPs, and emerging vulnerabilities (e.g., from MITRE ATT&CK or CVE feeds) determines which defensive controls, segmentation, and monitoring capabilities must be designed in. Option E (Criticality of business data and assets) is correct because classifying data and assets by business impact drives the required protection level, such as tiered controls, redundancy, and recovery objectives (RTO/RPO) for the most critical systems. Option B is not a security design driver, since office location and square footage are facilities-planning details rather than risk factors affecting control selection. Option D is also not relevant, as headcount and department budget are organizational and financial inputs, not determinants of the technical security requirements themselves.

Answer

Office physical location and square footage

Answer

Employee headcount and department budget