SDSI Secure Infrastructure Design Practice Test 5 — 15 Questions

Question 1

Which THREE technologies are used in Cisco's architecture for micro-segmentation?

Accepted Answer

Cisco ISE as the policy engine.. Cisco's micro-segmentation architecture, implemented through technologies like Cisco TrustSec and Secure Workload, relies on Cisco ISE (Identity Services Engine) as the centralized policy engine that defines and distributes segmentation policies based on identity and context, making option A correct. Scalable Group Tags (SGTs) are the core tagging mechanism in TrustSec that embed group-based classification directly into the packet, enabling scalable segmentation without relying on IP-based rules, which validates option B. Policy Enforcement Points (PEPs) such as Cisco switches and firewalls enforce the SGT-based policies inline as traffic traverses the network, confirming option C as a required architectural component. Option D is incorrect because standard unmanaged switches lack the capability to read SGT tags or enforce security group policies. Option E is incorrect because static IP ACLs on every port represent a traditional, manually maintained segmentation approach that does not scale and is not the technology behind Cisco's micro-segmentation architecture.

Answer

Standard unmanaged switches.

Answer

Static IP ACLs on every port.

Question 2

Which TWO factors are vital for an effective firewall policy design?

Accepted Answer

Logical organization and rule documentation.. Option A (Logical organization and rule documentation) is correct because an effective firewall policy must be structured in a readable, top-down order (most specific rules first) and documented so that each rule's purpose, owner, and review date are known, which prevents rule sprawl and makes troubleshooting and audits feasible. Option C (Least privilege principle) is correct because firewall rules should permit only the specific traffic required for a business function—defined by source/destination, port, and protocol—and deny everything else, minimizing the attack surface. The unmarked options do not belong: disabling all logging (B) removes the audit trail needed to detect and investigate denied or permitted traffic, using only IP addresses (D) ignores ports, protocols, and applications and is insufficient for granular control, and permitting all traffic by default (E) is an implicit allow-any rule that defeats the purpose of a firewall.

Answer

Disabling all logging.

Answer

Using only IP addresses.

Answer

Permit all traffic by default.

Question 3

Which TWO methods provide identification for IoT devices in an enterprise network?

Accepted Answer

802.1X (EAP-TLS).. Option A, 802.1X with EAP-TLS, is correct because it provides strong, certificate-based mutual authentication that uniquely identifies IoT devices on the enterprise network before granting access. Option D, device profiling with Cisco ISE, is correct because ISE identifies IoT devices by collecting attributes such as MAC OUI, DHCP fingerprints, and HTTP user-agent data to classify and authorize them. Option B, ignoring the device type, is wrong because it provides no identification and defeats access control. Option C, using public Wi-Fi access, is wrong because it is an untrusted network path that does not identify devices to the enterprise. Option E, MAC address spoofing, is wrong because spoofed MAC addresses are easily forged and cannot reliably identify a device.

Answer

Ignoring the device type.

Answer

Using public Wi-Fi access.

Answer

MAC address spoofing.

Question 4

A design team is implementing Cisco ISE for a hybrid work environment. Which Cisco ISE architectural component is responsible for processing RADIUS and TACACS+ requests while offloading policy decision logic from the Administration node?

Accepted Answer

Policy Service Node (PSN). The Policy Service Node (PSN) is the Cisco ISE persona that receives and processes RADIUS and TACACS+ authentication, authorization, and accounting requests from network devices. PSNs run the policy engine locally, evaluating identity and posture against policy sets, so the PAN does not have to handle every live authentication. This offloads policy decision logic and provides horizontal scalability and redundancy for access requests.

Answer

Primary Administration Node (PAN)

Answer

Monitoring Node (MnT)

Answer

Policy Information Point (PIP)

Question 5

A manufacturing firm wants to secure IoT devices using Cisco TrustSec. Which mechanism ensures that traffic from IoT sensors is isolated from corporate traffic without relying on complex VLAN/ACL management?

Accepted Answer

Scalable Group Tags (SGTs). Cisco TrustSec uses Scalable Group Tags (SGTs) embedded in the packet (via Cisco Metadata or inline tagging) to enforce group-based policy. IoT sensors are assigned an SGT, and a Security Group ACL (SGACL) on the enforcement device permits or denies traffic based on source/destination tag pairs — no VLANs or IP-based ACLs required. This scales cleanly because policy follows the tag, not the topology.

Answer

Dynamic ARP Inspection

Answer

Private VLANs (PVLANs)

Answer

VLAN Trunking Protocol

Question 6

When designing a remote access VPN solution using Cisco AnyConnect, which protocol is preferred to optimize performance for latency-sensitive applications like VoIP?

Accepted Answer

DTLS. DTLS (Datagram Transport Layer Security) is preferred for Cisco AnyConnect remote access VPN because it operates over UDP, avoiding TCP's head-of-line blocking and retransmission delays that degrade latency-sensitive traffic like VoIP. AnyConnect uses DTLS as the data transport while TLS handles the control channel, providing lower latency and jitter for real-time applications. This makes DTLS the optimal choice for optimizing performance of VoIP over AnyConnect.

Answer

TLS

Answer

IPsec IKEv2

Answer

SSTP

Question 7

A design architect is deploying a Cisco Secure Firewall in a High Availability (HA) pair. Which configuration is required to ensure stateful failover across firewalls?

Accepted Answer

Stateful failover link. Stateful failover in a Cisco Secure Firewall HA pair requires a dedicated stateful failover link (also called the failover interface) that synchronizes connection state, translation tables, and other runtime data between the active and standby units. Without this link, failover is stateless and existing connections are dropped, breaking user sessions. The stateful failover link is the configuration element that enables seamless session continuity.

Answer

HSRP on the interfaces

Answer

Control plane sync via FMC

Answer

VSS for Firewall

Question 8

To protect a SaaS application accessed by remote users, which Cisco solution provides a unified cloud-native security stack including DNS-layer security and SWG?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the cloud-native Secure Internet Gateway (SIG) that combines DNS-layer security, Secure Web Gateway (SWG), cloud-delivered firewall, and CASB into a single unified stack delivered from the cloud. It is specifically designed to protect users accessing SaaS and internet resources from any location without backhauling traffic to a data center. The other options are point products that do not deliver this unified cloud-native DNS+SWG capability.

Answer

Cisco Duo

Answer

Cisco Firepower Threat Defense

Answer

Cisco Secure Endpoint

Question 9

Which Cisco feature is used to prevent unauthorized devices from connecting to the wired network by enforcing identity-based access control at the access switch port?

Accepted Answer

802.1X. 802.1X is an IEEE standard for port-based network access control (PNAC) that authenticates devices/users before granting access to the wired or wireless LAN. It uses EAP over LAN (EAPOL) between the supplicant and the authenticator (switch), with RADIUS to the authentication server (e.g., Cisco ISE), enforcing identity-based access at the switch port. This directly matches the requirement of preventing unauthorized devices via identity-based control.

Answer

MAC Authentication Bypass

Answer

Port Security

Answer

DHCP Snooping

Question 10

A network security designer is evaluating email security solutions. Which feature in Cisco Secure Email (ESA) is most effective against sophisticated Business Email Compromise (BEC) attacks?

Accepted Answer

Advanced Phishing Protection. Advanced Phishing Protection in Cisco Secure Email (ESA) is specifically designed to detect and block sophisticated Business Email Compromise (BEC) attacks that evade traditional signature-based defenses. It uses machine learning and behavioral analysis to identify anomalous sender behavior, such as display name spoofing, lookalike domains, and compromised accounts, which are hallmarks of BEC. Unlike URL filtering or spam quarantine, it focuses on the social engineering tactics and context of the email rather than just malicious links or bulk spam characteristics.

Answer

URL Filtering

Answer

Spam Quarantine

Answer

DKIM Signing

Question 11

You are designing a management plane security strategy for Cisco networking devices. Which protocol is recommended to replace Telnet to ensure encrypted administrative sessions?

Accepted Answer

SSH. SSH (Secure Shell) is the standard replacement for Telnet because it provides encrypted, authenticated administrative sessions. Telnet transmits credentials and commands in cleartext, while SSH uses strong encryption (AES, ChaCha20) and integrity checking to protect the management plane.

Answer

Netconf

Answer

SNMPv2c

Answer

HTTPS

Question 12

When designing an endpoint security strategy, which Cisco tool provides visibility into fileless malware by monitoring system process behavior?

Accepted Answer

Cisco Secure Endpoint. Cisco Secure Endpoint (formerly AMP for Endpoints) uses behavioral analysis and process monitoring to detect fileless malware, which executes in memory and leaves no file on disk. Its endpoint agent observes process lineage, script execution, and memory activity, making it the correct tool for this visibility requirement.

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch

Answer

Cisco Duo

Question 13

A security designer is choosing a firewall architecture for a high-throughput data center core. Which Cisco Firewall platform is purpose-built for this requirement?

Accepted Answer

Cisco Firepower 4100/9300 Series. The Cisco Firepower 4100 and 9300 Series are purpose-built high-throughput data center firewall appliances, designed for the core with multi-hundred-Gbps throughput, high connection rates, and clustering/HA capabilities. They run FTD (Firepower Threat Defense) and integrate with FMC for centralized management, making them the correct choice for a high-throughput data center core.

Answer

Cisco Meraki MX

Answer

Cisco Firepower 1010

Answer

Cisco ASA 5506-X

Question 14

In a design for a Zero Trust architecture, what is the primary function of the Policy Decision Point (PDP)?

Accepted Answer

To evaluate access requests based on policy. In Zero Trust architecture, the Policy Decision Point (PDP) evaluates access requests against policy, identity, device posture, and context to decide whether to grant, deny, or limit access. It is the brain that makes the authorization decision, which is then enforced by the Policy Enforcement Point (PEP).

Answer

To audit session traffic

Answer

To provide identity management

Answer

To enforce the policy on the endpoint

Question 15

Which component of the Cisco Secure architecture is used to provide centralized visibility and threat analysis across the entire network based on NetFlow data?

Accepted Answer

Cisco Secure Network Analytics. Cisco Secure Network Analytics (formerly Stealthwatch) is the component of the Cisco Secure architecture that provides centralized visibility and threat analysis using NetFlow data. It collects flow telemetry from network devices, applies behavioral analytics and machine learning to detect anomalies, and presents a centralized dashboard for threat hunting and incident response.

Answer

Cisco ISE

Answer

Cisco Secure Endpoint

Answer

Cisco Firepower Management Center