SDSI Secure Infrastructure Design Practice Test 4 — 15 Questions

Question 1

You are designing a secure infrastructure for a SaaS-heavy office. What strategy best minimizes the impact on user experience while maintaining security?

Accepted Answer

Implementing DIA with localized SASE security.. Direct Internet Access (DIA) with localized SASE security allows users to connect directly to SaaS applications from the nearest point of presence, reducing latency and improving performance. Security is enforced in the cloud through SASE, which applies consistent policies without backhauling traffic. This approach balances user experience with robust security, as it avoids unnecessary traffic detours while still inspecting and protecting all sessions.

Answer

Backhauling all traffic to the data center.

Answer

Using a client-based proxy for everything.

Answer

Bypassing all security for trusted SaaS apps.

Question 2

Which protocol is used for the control plane communication between Cisco SD-WAN controllers?

Accepted Answer

OMP.. Cisco SD-WAN uses the Overlay Management Protocol (OMP) for control plane communication between SD-WAN controllers (vManage, vBond, vSmart) and between controllers and WAN edge devices. OMP carries routing information, policy, and TLOC (transport locator) attributes, forming the overlay control plane that enables SD-WAN's dynamic path selection.

Answer

EIGRP.

Answer

BGP.

Answer

OSPF.

Question 3

When configuring a Cisco ASA/Firepower firewall, what is the 'inside' interface typically used for?

Accepted Answer

To connect to the trusted internal network.. On a Cisco ASA/Firepower firewall, the 'inside' interface is the trusted network, typically the internal LAN where protected resources reside. It has a higher security level (default 100) than the 'outside' interface (default 0), allowing traffic to flow from inside to outside by default. This is the standard configuration for perimeter firewalls.

Answer

To connect to the untrusted internet.

Answer

To connect to the DMZ.

Answer

To connect to the management network.

Question 4

In a Cisco Secure Firewall architecture, what is the purpose of the 'Intrusion Policy'?

Accepted Answer

To identify and block malicious traffic based on pattern matching.. An Intrusion Policy in Cisco Secure Firewall defines the set of intrusion detection/prevention rules (Snort rules) that inspect traffic for malicious patterns and, when configured in prevention mode, block matching traffic. It is the mechanism that identifies and blocks malicious traffic based on signature/pattern matching. It does not handle routing, VPN authentication, or NAT.

Answer

To optimize routing paths.

Answer

To handle VPN authentication.

Answer

To manage firewall NAT rules.

Question 5

Which design component is necessary for implementing Cisco TrustSec across a multi-switch campus?

Accepted Answer

SXP (SGT Exchange Protocol).. SXP (SGT Exchange Protocol) is the protocol used to propagate Security Group Tags (SGTs) and the IP-to-SGT bindings from a TrustSec-capable device to devices that cannot natively tag traffic, such as older switches or non-TrustSec network elements. In a multi-switch campus where not every device supports inline tagging, SXP is the necessary design component to carry SGT information across the topology. Without SXP, SGTs cannot be shared with legacy or non-capable devices.

Answer

VLAN Trunking Protocol (VTP).

Answer

LLDP.

Answer

802.1Q.

Question 6

Which TWO design considerations are critical for a secure SD-WAN edge deployment?

Accepted Answer

Centralized security policy enforcement via vManage.. Option C is correct because Cisco SD-WAN's vManage controller provides centralized policy management, allowing consistent security and application-aware policies to be pushed to all edge devices, which is essential for maintaining a uniform security posture across a distributed SD-WAN fabric. Option D is correct because automated IPsec tunnel encryption secures the data plane by encrypting traffic between WAN edge devices, protecting data in transit across untrusted transports such as the internet. Option A is incorrect because local breakout without inspection bypasses security controls and exposes traffic to threats, undermining a secure edge design. Option B is incorrect because deploying devices with default passwords creates a serious vulnerability that attackers can easily exploit. Option E is incorrect because disabling the control plane firewall removes protection for the SD-WAN control plane, leaving it exposed to unauthorized access and attacks.

Answer

Using local breakout for all internet traffic without inspection.

Answer

Deploying devices with default passwords.

Answer

Disabling the control plane firewall.

Question 7

Which THREE technologies enable network segmentation in a modern Cisco campus design?

Accepted Answer

VRF-Lite.. VRF-Lite (B) is correct because it creates multiple virtual routing and forwarding instances on the same physical device, each with its own separate routing table, thereby logically segmenting Layer 3 traffic on a shared campus infrastructure. Cisco TrustSec with Security Group Tags (C) is correct because it provides identity- and role-based segmentation by tagging packets with SGTs and enforcing group-based policies, independent of IP addresses or VLANs. VLANs (E) are correct because they are the foundational Layer 2 segmentation mechanism in a campus design, isolating broadcast domains and separating traffic between different user or device groups. Standard routing protocols without filters (A) do not segment traffic—they advertise reachability between networks and would actually defeat isolation. Port forwarding (D) is a NAT/port-mapping technique for exposing internal services, not a segmentation technology, so it does not belong.

Answer

Standard routing protocols without filters.

Answer

Port forwarding.

Question 8

Which TWO features are essential for securing the management plane of a Cisco network device?

Accepted Answer

Access Control Lists (ACLs) applied to VTY lines.. Option B is correct because applying Access Control Lists (ACLs) to VTY lines restricts which source IP addresses can establish remote management sessions (Telnet/SSH) to the device, directly protecting the management plane from unauthorized access. Option E is correct because SSH provides encrypted, authenticated remote management, replacing insecure cleartext protocols like Telnet and protecting credentials and configuration data in transit. Options A, C, and D are not essential management-plane protections: public IP addresses on management interfaces increase exposure rather than secure them, disabling all physical console ports is impractical and unnecessary for management-plane hardening (console access is typically protected by physical controls and authentication), and enabling Telnet is insecure because it transmits credentials and data in cleartext.

Answer

Using public IP addresses for management interfaces.

Answer

Disabling all physical console ports.

Answer

Enabling Telnet for remote management.

Question 9

Which TWO methods are effective for securing email infrastructure against phishing?

Accepted Answer

DMARC/SPF/DKIM implementation.. Option B is correct because implementing SPF, DKIM, and DMARC together authenticates the sending domain: SPF authorizes sending IPs via DNS TXT records, DKIM cryptographically signs messages with a public key published in DNS, and DMARC tells receivers how to handle messages that fail SPF/DKIM alignment, which directly blocks spoofed sender addresses used in phishing. Option D is correct because Cisco Secure Email sandboxing detonates suspicious attachments and URLs in an isolated environment to detect zero-day malware and credential-harvesting links that signature-based filters miss, adding a behavioral layer of phishing defense. Option A is wrong because using only local SMTP relays does not authenticate senders or filter malicious content and can even worsen spoofing exposure. Option C is wrong because disabling all attachments is overly broad, breaks legitimate business mail, and does not stop phishing links or social-engineering text. Option E is wrong because allowing all inbound mail traffic removes any filtering or policy enforcement, directly enabling phishing delivery.

Answer

Using only local SMTP relays.

Answer

Disabling all attachments in emails.

Answer

Allowing all inbound mail traffic.

Question 10

Which THREE components are part of a robust Cisco Zero Trust for the Workplace architecture?

Accepted Answer

Cisco Secure Endpoint for device posture.. Cisco Secure Endpoint is correct (A) because it provides endpoint detection and response plus device posture signals that Zero Trust needs to continuously assess device trust before granting access. Cisco Duo is correct (B) because it delivers strong multi-factor user authentication and device trust verification, which are foundational to verifying identity in a Zero Trust for the Workplace architecture. Cisco ISE is correct (E) because it acts as the policy decision and enforcement point, using identity, posture, and context to dynamically authorize and segment network access. DHCP (C) only assigns IP addresses and provides no identity, posture, or policy enforcement capability, so it is not a Zero Trust component. Standard static IP filtering (D) is a legacy, location-based control that cannot verify user or device trust and therefore does not belong in a Zero Trust architecture.

Answer

DHCP for network address assignment.

Answer

Standard static IP filtering.

Question 11

Which TWO factors are critical for selecting a firewall architecture?

Accepted Answer

Integration with current management ecosystem (e.g., FMC).. Option C is correct because selecting a firewall architecture must account for how the device integrates with the existing management ecosystem, such as Cisco Firepower Management Center (FMC), since centralized policy deployment, event correlation, and compliance reporting depend on that integration. Option E is correct because required throughput and inspection depth directly determine hardware sizing and architecture choices—deep inspection features like TLS decryption, IPS, and application visibility consume substantial CPU/ASIC resources, so the platform must be rated for the expected traffic load with those services enabled. Options A, B, and D are not critical architectural factors: restricting to legacy IPsec gateways is an outdated and overly narrow constraint, local coffee availability is irrelevant to firewall design, and chassis color has no bearing on security, performance, or manageability.

Answer

Using only legacy IPsec gateways.

Answer

Availability of local coffee in the DC.

Answer

The color of the firewall chassis.

Question 12

Which TWO features assist in protecting the network control plane against DoS attacks?

Accepted Answer

Control Plane Policing (CoPP).. Control Plane Policing (CoPP), option D, is correct because it applies a QoS policy to the control plane to rate-limit and filter traffic destined to the router's CPU, protecting routing protocols and management services from DoS floods. Control Plane Protection (CPPr), option E, is correct because it extends CoPP by dividing the control plane into host, transit, and CEF-exception subinterfaces, allowing granular policing of specific traffic types such as ICMP or routing protocol packets. Static routing only (A) does not defend against DoS; it merely removes dynamic routing updates and can even reduce resilience. Increasing interface speed (B) increases bandwidth but does nothing to stop CPU-targeted floods. Disabling all physical interfaces (C) would halt all traffic, including legitimate traffic, so it is not a viable protection mechanism.

Answer

Configuring static routing only.

Answer

Increasing interface speed.

Answer

Disabling all physical interfaces.

Question 13

Which THREE design principles are key for a multi-cloud security strategy?

Accepted Answer

Consistent security policies across environments.. Option B is correct because a multi-cloud security strategy requires consistent security policies across environments, so that the same access control, inspection, and segmentation rules are enforced uniformly in AWS, Azure, GCP, and on-premises rather than drifting per provider. Option D is correct because unified threat visibility aggregates logs, events, and telemetry from all clouds into a single view, enabling correlation and detection of threats that span multiple providers instead of relying on fragmented per-cloud consoles. Option E is correct because a centralized management plane such as Cisco Firepower Management Center (FMC) lets administrators define policy once and push it to firewalls and sensors across clouds, which is the practical mechanism for achieving the consistency and visibility described above. Option A is not correct because using different, uncoordinated security tools per cloud creates policy gaps and operational complexity, which is the opposite of a sound multi-cloud design. Option C is not correct because allowing all cross-cloud traffic violates least-privilege and zero-trust principles; cross-cloud flows should be explicitly permitted, inspected, and segmented.

Answer

Using different security tools for each cloud.

Answer

Allowing all cross-cloud traffic.

Question 14

Which THREE Cisco solutions support the 'Secure Work from Anywhere' concept?

Accepted Answer

Cisco Secure Client (AnyConnect).. Cisco Secure Client (AnyConnect) is correct because it provides the endpoint VPN and security agent that lets remote users establish encrypted connectivity to corporate resources from any location. Cisco Duo is correct because its zero-trust, multi-factor authentication and device-trust capabilities verify user and device identity before granting access to applications, which is central to securing a distributed workforce. Cisco Umbrella is correct because its DNS-layer security and secure web gateway protect off-network users from malicious domains and enforce acceptable-use policies regardless of where they connect. Physical desk phone only does not belong because it is a location-bound device that cannot enable secure remote work. Manual VPN configuration files also do not belong because they are a static, error-prone configuration method rather than a managed Cisco solution supporting secure work from anywhere.

Answer

Physical desk phone only.

Answer

Manual VPN configuration files.

Question 15

Which TWO strategies are recommended for securing a cloud-native SaaS environment?

Accepted Answer

Duo MFA integration.. Duo MFA integration (A) is correct because enforcing multi-factor authentication via Duo adds a strong identity-verification layer that protects SaaS accounts even if passwords are compromised, directly reducing credential-based attacks in a cloud-native environment. CASB implementation (B) is correct because a Cloud Access Security Broker provides visibility and control over SaaS usage, enforcing data loss prevention, encryption, and compliance policies across sanctioned and unsanctioned cloud apps. Opening all firewall ports (C) is wrong because it exposes services to unnecessary network access, vastly expanding the attack surface. Storing passwords in clear text (D) is wrong because it makes credentials trivially readable and violates basic security and compliance requirements. Disabling all logging (E) is wrong because it eliminates audit trails and detection capability, preventing incident response and forensic analysis.

Answer

Opening all firewall ports.

Answer

Storing passwords in clear text.

Answer

Disabling all logging.