SDSI Secure Infrastructure Design Practice Test 2 — 15 Questions

Question 1

Which TWO design considerations are essential when implementing a Zero Trust architecture for IoT devices in a campus environment using Cisco ISE and TrustSec?

Accepted Answer

Utilizing Cisco ISE to profile and categorize IoT endpoints.. Option B is correct because Cisco ISE's profiling and endpoint categorization is foundational to Zero Trust for IoT: ISE uses probes (RADIUS, SNMP, DHCP, NMAP, etc.) and profiling policies to identify device types, which then drives authorization and policy decisions rather than trusting the device by default. Option C is correct because TrustSec Scalable Group Tags (SGTs) applied to IoT endpoints enable micro-segmentation via Security Group ACLs (SGACLs) enforced on network devices, so traffic between IoT groups and other segments is restricted based on group membership rather than IP addresses or VLANs. Static IP addressing (A) is not essential and actually complicates profiling and dynamic policy, since DHCP-based profiling and identity context are commonly leveraged. Placing all IoT devices in one VLAN (D) contradicts Zero Trust micro-segmentation by creating a flat, overly permissive broadcast domain. Disabling 802.1X for all non-PC devices (E) weakens identity-based access control and is not a Zero Trust design principle; IoT devices should be authenticated where possible (e.g., MAB, 802.1X with certificates) and then authorized through ISE.

Answer

Using static IP addresses for every IoT device to ensure consistency.

Answer

Ensuring all IoT devices are placed in the same VLAN for easier management.

Answer

Disabling 802.1X for all non-PC devices.

Question 2

In a Cisco SD-WAN environment, you need to ensure that branch office traffic destined for SaaS applications is optimized and secured. Which design approach is most appropriate?

Accepted Answer

Implementing Cisco Umbrella SIG integration on the SD-WAN edge devices for DIA.. In a Cisco SD-WAN environment, optimizing and securing branch traffic to SaaS applications is best achieved by integrating Cisco Umbrella SIG (Secure Internet Gateway) on the SD-WAN edge devices and using Direct Internet Access (DIA). This approach allows branch traffic to break out locally to the internet, where Umbrella enforces security policies (e.g., DNS-layer security, URL filtering, CASB) without backhauling to the corporate headend. This reduces latency and improves performance for SaaS apps while maintaining security. The other options either bypass security, add unnecessary hardware, or reintroduce backhauling.

Answer

Using static routing to bypass all security policies for trusted SaaS domains.

Answer

Deploying a dedicated physical firewall at every branch office.

Answer

Hair-pinning all SaaS traffic back to the corporate headend for inspection.

Question 3

A security architect is designing a Cisco Secure Firewall deployment for a multi-cloud environment. Which design strategy ensures consistent security policy enforcement across AWS and Azure instances?

Accepted Answer

Utilize a centralized FMC to manage virtual Secure Firewalls across all cloud environments.. A centralized FMC (Firepower Management Center) provides a single pane of glass for policy creation, deployment, and monitoring across all virtual Secure Firewall instances regardless of whether they run in AWS, Azure, or on-premises. This ensures that the same access control, IPS, and URL filtering policies are consistently enforced, eliminating policy drift between clouds. FMC supports multi-domain and hierarchical policy inheritance, which is essential for multi-cloud consistency.

Answer

Deploy separate FMC instances in each cloud provider for localized management.

Answer

Use individual Firewall Device Managers (FDM) for every instance.

Answer

Implement cloud-native security groups exclusively to bypass firewall bottlenecks.

Question 4

When designing a secure remote access solution for a hybrid workforce, which Cisco AnyConnect feature should be prioritized to reduce the attack surface by verifying the posture of the device before granting access?

Accepted Answer

AnyConnect Posture Module.. The AnyConnect Posture Module is the component that performs endpoint posture assessment (hostscan) before or during VPN session establishment, checking for antivirus, firewall, OS patches, and other compliance criteria. It is the mechanism that reduces attack surface by ensuring only compliant devices are granted access, feeding results into DAP for enforcement.

Answer

IKEv2 protocol support.

Answer

Split-tunneling.

Answer

Dynamic Access Policies (DAP).

Question 5

A security architect is designing a Cisco Secure Firewall deployment for a multi-cloud environment. Which design approach provides the most consistent security policy enforcement across AWS and Azure?

Accepted Answer

Utilize Cisco Defense Orchestrator for centralized policy management.. Cisco Defense Orchestrator (CDO) provides centralized, cloud-delivered management of Cisco Secure Firewall (FTD) policies across multiple environments, including AWS and Azure. By managing all firewalls from a single pane, CDO ensures consistent access control, intrusion prevention, and URL filtering policies regardless of which cloud the firewall instance runs in.

Answer

Deploy individual local managers for each cloud provider.

Answer

Rely on native cloud-native security groups only.

Answer

Implement separate FTD instances with unique local access control lists.

Question 6

For a high-availability firewall architecture, which design element is critical when utilizing a routed-mode configuration in a data center?

Accepted Answer

Utilizing a dedicated stateful failover link between firewalls.. In a routed-mode high-availability firewall pair, each firewall maintains its own routing table and forwards based on Layer 3, so the two units must synchronize connection state to survive a failover without dropping established sessions. A dedicated stateful failover link carries that state (session tables, NAT translations, VPN state) between the peers. Without it, traffic that was mid-session would be dropped when the standby takes over.

Answer

Configuring HSRP between firewall interfaces.

Answer

Implementing OSPF equal-cost multi-path (ECMP) for load balancing.

Answer

Using a virtual MAC address per interface.

Question 7

When selecting a security approach for email threats, which Cisco technology provides automated sandboxing to protect against zero-day phishing?

Accepted Answer

Cisco Secure Malware Analytics.. Cisco Secure Malware Analytics (formerly Threat Grid) is Cisco's automated malware analysis and sandboxing platform. It detonates suspicious files and URLs in an isolated environment, observes behavior, and produces threat scores and indicators, which is exactly the automated sandboxing needed to catch zero-day phishing payloads that signature-based filters miss. It integrates with email security (ESA) to submit attachments and links for analysis.

Answer

Cisco Duo MFA.

Answer

Cisco Umbrella DNS layer security.

Answer

Cisco Secure Endpoint protection.

Question 8

Which design principle is essential when configuring Cisco Secure Firewall for SaaS application visibility?

Accepted Answer

Enable Application Filtering policies using the cloud-delivered feed.. Cisco Secure Firewall achieves SaaS application visibility by leveraging Application Filtering policies that use cloud-delivered application signatures and metadata feeds. These feeds are continuously updated by Cisco Talos to identify SaaS applications even when they use dynamic IPs, CDNs, or encrypted traffic. Enabling Application Filtering allows the firewall to classify traffic based on application characteristics rather than static IPs or ports, which is essential for accurate visibility and control.

Answer

Disable SSL decryption for all SaaS traffic to improve performance.

Answer

Install local agents on every endpoint.

Answer

Configure static IP-based rules for every SaaS provider.

Question 9

A company requires a control plane security design for their campus network. Which feature prevents unauthorized devices from claiming to be the default gateway?

Accepted Answer

Dynamic ARP Inspection (DAI).. Dynamic ARP Inspection (DAI) is correct because it validates ARP packets on untrusted ports against a trusted binding table (built by DHCP snooping or static entries). If a rogue device tries to claim the default gateway's IP by sending gratuitous ARP or ARP replies, DAI drops those packets because the MAC-IP pair does not match the binding. This directly prevents ARP spoofing of the gateway, a common man-in-the-middle attack on campus networks.

Answer

Port Security.

Answer

IP Source Guard.

Answer

Control Plane Policing (CoPP).

Question 10

When designing a VPN solution for a hybrid workforce, which protocol provides the most robust support for DTLS to minimize latency for real-time traffic?

Accepted Answer

Cisco Secure Client with DTLS enabled.. Cisco Secure Client (formerly AnyConnect) with DTLS enabled provides the most robust support for DTLS in a VPN solution. DTLS (Datagram Transport Layer Security) runs over UDP and avoids TCP-over-TCP meltdown, minimizing latency for real-time traffic like voice and video. Cisco Secure Client natively supports DTLS and can fall back to TLS if UDP is blocked.

Answer

SSL VPN Clientless portal.

Answer

L2TP/IPsec.

Answer

IPsec IKEv1.

Question 11

You are designing an IoT security strategy for a manufacturing site. Which approach best isolates unmanaged IoT devices from the enterprise network?

Accepted Answer

Implement Cisco ISE with SGT-based micro-segmentation.. Cisco ISE with SGT-based micro-segmentation (TrustSec) provides granular isolation of IoT devices by assigning Security Group Tags and enforcing policies across the network, even within the same VLAN. This approach best isolates unmanaged IoT devices from the enterprise network because it enables dynamic segmentation and policy enforcement based on device identity and context, not just network topology.

Answer

Deploy a transparent firewall in bridge mode at the distribution layer.

Answer

Enable PortFast on all IoT switch ports.

Answer

Assign static VLANs to all IoT ports on access switches.

Question 12

In a multi-cloud design, which component is used to connect remote offices directly to the cloud provider while maintaining Cisco-level security?

Accepted Answer

Cisco SD-WAN Cloud OnRamp.. Cisco SD-WAN Cloud OnRamp automates the creation of secure, optimized connectivity from branch offices directly to cloud providers (AWS, Azure, GCP) while applying Cisco's security stack (e.g., Umbrella, SIG, or FTDv) at the branch or cloud edge. It maintains Cisco-level security by integrating with the SD-WAN fabric and policy, unlike a generic IPsec tunnel. This provides direct cloud access without backhauling through a data center.

Answer

Local NAT translation.

Answer

Cisco Secure Access Control Server (ACS).

Answer

Standard site-to-site IPsec tunnel.

Question 13

Which Cisco solution provides DNS-layer security to prevent users from connecting to malicious domains?

Accepted Answer

Cisco Umbrella.. Cisco Umbrella is a cloud-delivered security platform that enforces DNS-layer security by resolving DNS queries through its global network. It blocks requests to malicious domains before a connection is established, preventing users from reaching phishing, malware, or command-and-control sites. This proactive blocking at the DNS layer is Umbrella's core function, making it the correct answer.

Answer

Cisco Stealthwatch.

Answer

Cisco ASA Firewall.

Answer

Cisco Secure Endpoint.

Question 14

You are designing security for a multi-cloud environment. Which feature in Cisco Secure Firewall allows for automated policy deployment based on cloud tags?

Accepted Answer

Dynamic Object Groups.. Dynamic Object Groups in Cisco Secure Firewall (formerly Firepower) let policies reference cloud resource tags (AWS tags, Azure tags, GCP labels) instead of static IPs. As cloud instances are created, terminated, or re-tagged, the firewall automatically updates group membership and enforces policy accordingly, enabling automated policy deployment in multi-cloud environments. This is the mechanism designed specifically for tag-driven, dynamic policy.

Answer

Static IP-based Access Control Lists.

Answer

VLAN tagging.

Answer

Network Interface Virtualization.

Question 15

Which Cisco solution provides host-based visibility and protection against fileless malware?

Accepted Answer

Cisco Secure Endpoint.. Cisco Secure Endpoint (formerly AMP for Endpoints) is the host-based endpoint protection platform that uses behavioral analytics, exploit prevention, and continuous file monitoring to detect and block fileless malware that lives in memory and abuses legitimate system tools. It provides the endpoint-level visibility and protection required for fileless threats.

Answer

Cisco ISE.

Answer

Cisco Secure Firewall.

Answer

Cisco Prime Infrastructure.