SDSI Secure Infrastructure Design Practice Test 6 — 15 Questions

Question 1

When designing a VPN for a multi-tenant cloud environment, which technology allows for the separation of routing tables to ensure traffic isolation between tenants?

Accepted Answer

VRF-Lite. VRF-Lite (Virtual Routing and Forwarding Lite) allows multiple independent routing tables to coexist on a single router or Layer 3 switch, providing logical separation of traffic between tenants without requiring MPLS. In a multi-tenant cloud VPN design, VRF-Lite ensures each tenant's routes are isolated, preventing cross-tenant traffic leakage.

Answer

VLAN tagging

Answer

Access Control Lists

Answer

IPsec Tunnels

Question 2

You are designing an email security gateway deployment. What is the benefit of using Cisco Secure Email's 'Outbreak Filters'?

Accepted Answer

It provides predictive protection for zero-day threats. Cisco Secure Email's Outbreak Filters provide predictive protection for zero-day threats by using Cisco Talos threat intelligence and real-time reputation/behavioral analysis to catch malicious messages before signatures are available. They can hold suspicious messages for a short period while Talos analyzes them, then release or quarantine based on the verdict. This 'predictive' capability is what distinguishes Outbreak Filters from standard anti-spam or antivirus.

Answer

It blocks spam based on reputation

Answer

It archives email for compliance

Answer

It encrypts outgoing email

Question 3

Which protocol is recommended for secure network time synchronization across security devices?

Accepted Answer

NTP with Authentication. NTP with Authentication (such as NTPv4 with symmetric key authentication or Autokey) ensures that time synchronization messages are authenticated, preventing spoofing and man-in-the-middle attacks. Secure network time synchronization is critical for security devices because inaccurate time can break certificate validation, log correlation, and authentication protocols like Kerberos. Plain NTP is vulnerable to spoofing, so authentication is recommended.

Answer

SNMP

Answer

HTTP

Answer

DHCP

Question 4

A design team is integrating Cisco Secure Firewall with an existing SIEM. Which telemetry export format is best for comprehensive security analysis?

Accepted Answer

eStreamer. eStreamer is Cisco's dedicated telemetry export protocol for Cisco Secure Firewall (formerly Firepower) that streams detailed event data—including connection, intrusion, file, malware, and Security Intelligence events—directly to a SIEM or external analysis tool. Unlike flow-only protocols, eStreamer delivers rich, contextual security events needed for comprehensive threat analysis and correlation.

Answer

NetFlow

Answer

SNMP

Answer

ICMP

Question 5

You are designing the control plane security for a Cisco switch. Which feature limits the amount of traffic sent to the CPU, protecting it from DoS attacks?

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) is a Cisco IOS feature that limits the amount of traffic sent to the CPU by applying QoS policies to control-plane traffic, protecting the route processor from DoS attacks and CPU overload. It classifies traffic destined to the control plane and rate-limits or drops it according to configured policy.

Answer

Port Security

Answer

Storm Control

Answer

DHCP Snooping

Question 6

Which Cisco technology is used to ensure that only authorized users can connect to the network via guest portals?

Accepted Answer

Cisco ISE Guest Services. Cisco ISE Guest Services provides guest portal functionality that authenticates and authorizes guest users before granting network access. It supports sponsored guest access, self-registration, and policy enforcement, ensuring only authorized users connect via the guest portal.

Answer

Cisco Umbrella

Answer

Cisco Firepower

Answer

Cisco Secure Endpoint

Question 7

In a SaaS security design, what is the role of a Cloud Access Security Broker (CASB)?

Accepted Answer

To provide visibility and control over SaaS usage. A CASB's core role is to provide visibility and control over SaaS usage — discovering shadow IT, monitoring user activity, enforcing DLP policies, and controlling access based on context. It sits between users and cloud services (via API or inline proxy) to apply security policy consistently across sanctioned and unsanctioned apps. This visibility-and-control function is the defining characteristic of a CASB.

Answer

To manage identity for the cloud

Answer

To act as a firewall for SaaS traffic

Answer

To encrypt end-to-end traffic

Question 8

When designing a secure remote access solution, what is the 'Always-On' VPN feature in AnyConnect primarily used for?

Accepted Answer

To enforce security policy for off-network users. Always-On VPN in AnyConnect ensures the VPN tunnel is established automatically whenever the endpoint has network connectivity, even before the user logs in, so security policy (firewall, posture, split-tunneling rules) is enforced for off-network users at all times. This prevents users from bypassing corporate controls by simply not connecting.

Answer

To reduce authentication time

Answer

To improve performance

Answer

To enable seamless roaming

Question 9

When designing a network segmentation strategy using Cisco TrustSec, what is an SGT tag used for?

Accepted Answer

To enforce security policy based on identity. An SGT (Scalable Group Tag) is a metadata tag used in Cisco TrustSec to classify traffic based on identity, such as user role, device type, or location. It enables enforcement of security policies based on that identity, rather than IP addresses. SGTs are inserted into packets and used by network devices to apply SGACLs.

Answer

To map IP addresses to MAC addresses

Answer

To identify the VLAN ID

Answer

To configure port security

Question 10

Which THREE services does Cisco Umbrella provide to secure remote workers? (Select 3)

Accepted Answer

Cloud Access Security Broker (CASB). Cisco Umbrella delivers DNS-layer security (E), which blocks malicious domains and IPs before a connection is established by resolving DNS requests through Umbrella's global resolvers, protecting remote workers regardless of their location. It also provides Secure Web Gateway (SWG) (D) functionality, including URL filtering, SSL inspection, and file inspection to enforce acceptable-use and block risky web content. Additionally, Umbrella offers Cloud Access Security Broker (CASB) (C) capabilities to discover and control sanctioned and unsanctioned SaaS applications and protect cloud data. Host-based Antivirus (A) is not an Umbrella service, as endpoint antivirus is provided by products such as Cisco Secure Endpoint, not Umbrella. Local network DHCP service (B) is also not offered by Umbrella; DHCP is a network infrastructure function handled by routers, switches, or dedicated DHCP servers, not a cloud security service.

Answer

Host-based Antivirus

Answer

Local network DHCP service

Question 11

Which THREE factors should be considered when designing a security approach for a hybrid work model? (Select 3)

Accepted Answer

Multi-factor authentication (MFA). Option B (Multi-factor authentication, MFA) is correct because in a hybrid work model users authenticate from untrusted home networks and public locations, so adding a second factor beyond passwords mitigates credential theft, phishing, and replay attacks. Option D (Direct internet access security) is correct because remote workers typically bypass the corporate perimeter and connect straight to SaaS and cloud services, so secure web gateways, DNS filtering, CASB, and TLS inspection must protect that direct path. Option E (Endpoint posture assessment) is correct because devices operating outside the managed network must be checked for patch level, disk encryption, EDR health, and compliance before being granted access, often enforced via conditional access or NAC. Option A is not among the selected answers because physical security of a home office, while useful, is not a core technical control for hybrid-work security design, and Option C is not selected because VLAN mapping on home routers is impractical to standardize and is not a recognized enterprise security design factor.

Answer

Physical security of the home office

Answer

VLAN mapping for home routers

Question 12

Which TWO design considerations are critical for a secure management plane for Cisco networking devices? (Select 2)

Accepted Answer

Implementing ACLs on VTY lines. Option B is correct because implementing ACLs on VTY lines restricts which source IP addresses can establish remote management sessions to the device, blocking unauthorized hosts from attempting to reach the management plane over Telnet or SSH. Option E is correct because SSH encrypts management traffic and provides authenticated, integrity-protected sessions, whereas Telnet sends credentials and commands in cleartext, making it unsuitable for a secure management plane. The remaining options do not belong: enabling HTTP for the Web GUI (A) exposes management access without encryption, disabling the console port (C) is not a standard secure-management requirement and can hinder out-of-band recovery, and using SNMPv1 (D) is insecure because it relies on cleartext community strings and lacks strong authentication and encryption.

Answer

Enabling HTTP for the Web GUI

Answer

Disabling the console port

Answer

Using SNMPv1

Question 13

Which THREE components are part of the Cisco Secure Firewall architecture? (Select 3)

Accepted Answer

Firepower Appliance. The Cisco Secure Firewall architecture is built around three core components: the Firepower Appliance (A), which is the physical or virtual hardware platform that runs the firewall software; the Firepower Management Center (FMC) (C), which provides centralized configuration, policy management, event analysis, and reporting across managed devices; and Firepower Threat Defense (FTD) (D), which is the unified software image combining firewall, IPS, AMP, and URL filtering capabilities on the appliance. These three together form the appliance, the management plane, and the software threat-defense layer of the architecture. Cisco ISE (B) is a separate identity and access-control (NAC/AAA) product, and Cisco Stealthwatch (E) is a separate network traffic analysis and flow-monitoring solution; neither is a component of the Secure Firewall architecture itself.

Answer

Cisco ISE

Answer

Cisco Stealthwatch

Question 14

Which TWO design principles should be followed when selecting a firewall architecture for a multi-cloud environment? (Select 2)

Accepted Answer

Centralized management of policies. Option B is correct because centralized management of policies is essential in a multi-cloud environment, where security teams must define, audit, and enforce consistent rules across AWS Security Groups, Azure NSGs, GCP firewall rules, and on-premises devices from a single pane of glass rather than managing each cloud console separately. Option D is correct because maintaining a consistent feature set across physical and virtual firewalls ensures that the same inspection, logging, NAT, and policy capabilities apply everywhere, so security posture does not degrade when workloads move between on-premises data centers and different cloud providers. Option A is wrong because physical firewalls cannot be inserted into most cloud segments; cloud traffic is handled by virtual or cloud-native constructs, and physical appliances are impractical for east-west traffic inside a VPC/VNet. Option C is wrong because relying exclusively on cloud-native firewalls creates provider lock-in, inconsistent policy models, and gaps for hybrid or on-premises traffic that still needs protection. Option E is wrong because deploying firewalls in a single region leaves workloads in other regions unprotected and adds unnecessary latency and failure risk, violating high-availability and defense-in-depth design goals.

Answer

Physical firewalls for all cloud segments

Answer

Using cloud-native firewalls only

Answer

Deploying firewalls in a single region

Question 15

Which THREE features of Cisco Secure Email help in mitigating email-based threats? (Select 3)

Accepted Answer

Cisco Threat Grid sandboxing. Cisco Threat Grid sandboxing (C) is correct because it detonates suspicious attachments and URLs in an isolated environment to observe malicious behavior and derive verdicts, which is a core defense against weaponized email content. Outbreak filters (D) are correct because they use real-time threat intelligence to quarantine or delay suspicious messages during the early hours of a new outbreak, before traditional signature-based antivirus can catch them. SenderBase reputation service (E) is correct because it evaluates the reputation of sending IP addresses and domains to block or throttle mail from known spam and malware sources at the connection level. DHCP snooping (A) and VLAN isolation (B) are Layer 2 network access controls for switches and are not email security features, so they do not belong in this scenario.

Answer

DHCP snooping

Answer

VLAN isolation