SDSI Secure Infrastructure Design Practice Test 3 — 15 Questions

Question 1

When designing a secure management plane, why is it critical to use a dedicated Out-of-Band (OOB) network?

Accepted Answer

To prevent management plane saturation during a data plane DoS attack.. A dedicated Out-of-Band (OOB) management network physically or logically separates management traffic from production data traffic. When a data plane DoS attack saturates the production links, in-band management would become unreachable, preventing administrators from responding. OOB preserves management access so remediation can occur even under active attack.

Answer

To reduce the cost of cabling.

Answer

To increase the throughput of user traffic.

Answer

To allow for DHCP-based addressing of management interfaces.

Question 2

A network designer needs to implement a VPN that supports both remote access and site-to-site connectivity. Which protocol is recommended for modern Cisco hardware?

Accepted Answer

IKEv2.. IKEv2 is the recommended protocol for modern Cisco hardware because it supports both remote access and site-to-site VPNs, offers improved security, reliability, and mobility (e.g., MOBIKE), and is widely supported in Cisco IOS, ASA, and Firepower platforms. It is the successor to IKEv1 and is considered best practice.

Answer

SSL VPN.

Answer

IKEv1.

Answer

PPTP.

Question 3

A security architect is designing a remote-work solution. What is the benefit of using Split Tunneling in Cisco Secure Client?

Accepted Answer

It allows internal traffic to be routed over the VPN while local traffic bypasses it.. Split tunneling in Cisco Secure Client allows the VPN client to route only traffic destined for corporate internal networks through the encrypted VPN tunnel, while all other traffic (e.g., internet browsing, local LAN resources) is sent directly out the local network interface. This reduces bandwidth consumption on the VPN headend, lowers latency for cloud/SaaS apps, and avoids backhauling personal traffic. The correct option captures this exact behavior: internal traffic over VPN, local traffic bypasses it.

Answer

It provides dual authentication layers for the user.

Answer

It encrypts only the authentication phase of the VPN connection.

Answer

It enforces all traffic through the corporate firewall.

Question 4

In an SD-WAN architecture, how does the design ensure the security of traffic between branches?

Accepted Answer

Enabling automated IPsec tunnels with IKEv2.. In SD-WAN, security between branches is achieved by automatically establishing IPsec tunnels using IKEv2. This provides encryption, integrity, and authentication for all traffic traversing the overlay network, regardless of the underlying transport (MPLS, internet, LTE). The automation ensures consistent policy enforcement and scalability across thousands of sites without manual key management.

Answer

Configuring static VPN keys.

Answer

Using clear-text GRE tunnels.

Answer

Relying on MPLS provider security.

Question 5

You are designing an IoT network segment. Which technology allows you to verify device identity at the hardware level?

Accepted Answer

802.1X with EAP-TLS.. 802.1X with EAP-TLS is correct because it performs mutual certificate-based authentication at the network access layer, where the supplicant's identity is proven using a digital certificate stored in a hardware-protected module (TPM or secure element). This binds the device identity to cryptographic keys that cannot be easily spoofed, unlike MAC or IP addresses. The hardware-level verification comes from the certificate's private key being protected by the device's hardware root of trust, making it resistant to cloning.

Answer

MAC Authentication Bypass (MAB).

Answer

SNMPv3.

Answer

Static IP filtering.

Question 6

When designing a firewall architecture for a high-security zone, which inspection mode is required to identify malware within encrypted payloads?

Accepted Answer

SSL/TLS Decryption and Inspection.. SSL/TLS Decryption and Inspection is required because malware can be hidden inside encrypted traffic, and a firewall cannot inspect the payload without first decrypting it. This mode terminates the TLS session, examines the plaintext for threats, then re-encrypts the traffic. Without decryption, the firewall only sees encrypted bytes and cannot identify malicious content.

Answer

Passive logging mode.

Answer

Bypass inspection mode.

Answer

Layer 3 routing mode.

Question 7

You are designing the security for a SaaS application access scenario. What is the role of the Cloud Access Security Broker (CASB)?

Accepted Answer

To gain visibility into SaaS application usage and prevent data exfiltration.. A CASB sits between users and cloud/SaaS providers, providing visibility into sanctioned and unsanctioned SaaS usage, enforcing DLP policies, and preventing data exfiltration. It operates via API mode, forward proxy, or reverse proxy to inspect traffic and apply granular controls. This makes it the correct answer for gaining SaaS visibility and stopping exfiltration.

Answer

To manage local network switches.

Answer

To encrypt all internet-bound traffic at the gateway.

Answer

To provide physical security for data centers.

Question 8

For a zero-trust architecture, what is the primary function of Cisco ISE?

Accepted Answer

Acting as a Policy Decision Point (PDP) for access control.. Cisco ISE (Identity Services Engine) serves as the Policy Decision Point (PDP) in a zero-trust architecture. It evaluates identity, device posture, and contextual attributes (e.g., location, time, threat level) against configured policies to make dynamic access control decisions. These decisions are then enforced by Policy Enforcement Points (PEPs) like switches, wireless controllers, or firewalls. Thus, ISE's primary function is centralized policy decision-making for network access, not password management or packet filtering.

Answer

Managing user passwords.

Answer

Packet filtering at the edge.

Answer

Automating WAN path selection.

Question 9

Which Cisco platform provides a centralized view of security threats across the entire enterprise?

Accepted Answer

Cisco SecureX.. Cisco SecureX is a cloud-native security platform that integrates with Cisco's security portfolio (e.g., Secure Firewall, Umbrella, AMP) and third-party tools to provide a unified, centralized view of threats across the enterprise. It aggregates and correlates security events, enabling security teams to detect, investigate, and respond to threats from a single dashboard. SecureX is specifically designed for security operations, offering threat hunting, incident response, and automation capabilities.

Answer

Cisco Catalyst Center.

Answer

Cisco Webex Control Hub.

Answer

Cisco DNA Center.

Question 10

In a multi-cloud design, which protocol is preferred for secure inter-site communication to support micro-segmentation?

Accepted Answer

VXLAN with SGTs.. VXLAN with Security Group Tags (SGTs) is preferred for secure inter-site communication supporting micro-segmentation because it combines scalable Layer 2 overlay transport (VXLAN) with Cisco TrustSec's SGT-based policy enforcement. SGTs are carried in the VXLAN header (Group Policy ID field), allowing consistent security policy across sites and clouds without relying on IP-based rules.

Answer

Standard GRE.

Answer

VLAN tagging.

Answer

802.1Q.

Question 11

Which Cisco feature is designed to protect the control plane of a router from being overwhelmed by traffic?

Accepted Answer

Control Plane Policing (CoPP).. Control Plane Policing (CoPP) is a Cisco IOS feature that allows you to rate-limit traffic destined to the route processor (control plane) of a router. It uses a modular QoS CLI (MQC) policy to classify and police traffic, ensuring that excessive or malicious traffic does not overwhelm the control plane and cause a denial of service. CoPP is specifically designed to protect the control plane, unlike ACLs which filter data plane traffic, or traffic shaping which manages outbound data plane traffic.

Answer

Access Control Lists (ACLs).

Answer

Traffic Shaping.

Answer

NetFlow.

Question 12

When designing a firewall for a data center, what is the best practice for handling high-bandwidth traffic inspection?

Accepted Answer

Use hardware-accelerated inspection.. Hardware-accelerated inspection offloads computationally intensive tasks like deep packet inspection (DPI), SSL/TLS decryption, and signature matching to dedicated ASICs, FPGAs, or network processors. This preserves throughput and low latency even at multi-gigabit or terabit speeds, which software-only inspection cannot sustain without massive CPU overhead. In a data center, where traffic volumes are high and latency-sensitive, hardware acceleration is the only practical way to maintain both security and performance.

Answer

Use software-based inspection only.

Answer

Disable deep packet inspection.

Answer

Route all traffic through the management interface.

Question 13

What is the primary function of the 'AnyConnect' (Secure Client) profile?

Accepted Answer

To manage connection and security settings for the endpoint.. The AnyConnect (Secure Client) profile is an XML file that defines how the endpoint's VPN client behaves, including connection entries, authentication methods, split tunneling, and security settings. It is pushed from the headend (ASA or FTD) to the client, allowing centralized management of connection and security policies. This makes option A correct because the profile's primary function is to manage connection and security settings for the endpoint.

Answer

To act as an identity provider.

Answer

To store user credentials.

Answer

To monitor CPU usage on the host.

Question 14

In a hybrid work design, what is the advantage of using Cisco Umbrella's roaming client?

Accepted Answer

It provides consistent security coverage off-network.. Cisco Umbrella's roaming client extends DNS-layer security to devices even when they are off the corporate network. It ensures that security policies are consistently applied regardless of location, protecting users from malicious domains and enforcing acceptable use policies. This is a key advantage for hybrid work.

Answer

It replaces the need for a local firewall.

Answer

It only works on internal corporate Wi-Fi.

Answer

It forces all traffic through a local DC.

Question 15

What is the benefit of integrating Cisco Secure Email with Cisco Threat Intelligence (Talos)?

Accepted Answer

It provides real-time threat intelligence for filtering.. Integrating Cisco Secure Email with Cisco Talos provides real-time threat intelligence that feeds directly into the email filtering pipeline. Talos continuously analyzes global email traffic, malware campaigns, and phishing infrastructure, and pushes that intelligence to Secure Email so messages can be blocked or quarantined based on current threat data rather than static signatures. This dynamic, reputation-based filtering is the core security benefit of the integration.

Answer

It increases email storage capacity.

Answer

It creates automated email backups.

Answer

It allows for remote administration of the email server.