SDSI Secure Infrastructure Design — Timed 40 Questions

Question 1

Which TWO factors must be considered when designing a Secure Remote Access VPN architecture for a hybrid workforce using Cisco AnyConnect?

Accepted Answer

Integration with Duo Security for multi-factor authentication.. Option A is correct because integrating Duo Security provides multi-factor authentication for AnyConnect remote users, which is a critical design factor for securing access in a hybrid workforce where credentials alone are insufficient. Option E is correct because the maximum supported concurrent user sessions on the ASA or FTD headend directly determines scalability and whether the platform can handle the expected number of simultaneous VPN connections. Option B is not a relevant factor since physical port density concerns wired interface capacity, not remote-access VPN design. Option C, while DTLS can benefit latency-sensitive traffic, is not a mandatory design factor for the architecture itself. Option D is incorrect because split-tunneling configuration involves routing and tunnel policies, not simply configuring internal DNS servers as a design consideration.

Answer

Physical port density on the headend device.

Answer

The use of DTLS for latency-sensitive traffic.

Answer

Configuring internal DNS servers for split-tunneling.

Question 2

Which Cisco tool is best suited for designing and documenting network security architectures?

Accepted Answer

Cisco Modeling Labs (CML).. Cisco Modeling Labs (CML) is a virtual lab platform that lets engineers build, visualize, and validate network topologies — including security architectures — before deploying to production. It supports importing and simulating Cisco IOS, IOS-XE, NX-OS, and ASA/Firepower images, so you can document and test designs such as segmentation, VPN termination, and firewall placement in a safe environment. This makes it the correct tool for designing and documenting security architectures.

Answer

Cisco Meraki Dashboard.

Answer

Cisco Webex.

Answer

Cisco Jabber.

Question 3

Which Cisco feature is used to prevent the unauthorized use of dynamic IP addresses on a network?

Accepted Answer

IP Source Guard.. IP Source Guard (IPSG) is a Layer 2 security feature that prevents IP address spoofing by filtering traffic based on the source IP address and MAC address binding learned via DHCP snooping. It ensures that only hosts using the IP address assigned by DHCP (or statically configured in the IPSG binding table) can send traffic on the port, thus preventing unauthorized use of dynamic IP addresses. The other options address different threats: Port Security limits MAC addresses, DAI validates ARP packets, and DHCP Snooping builds the binding database but does not enforce IP source filtering.

Answer

Port Security.

Answer

Dynamic ARP Inspection (DAI).

Answer

DHCP Snooping.

Question 4

Which feature enables Cisco switches to limit the amount of broadcast traffic received on a port?

Accepted Answer

Storm Control.. Storm Control is the Cisco feature specifically designed to monitor and suppress excessive broadcast, multicast, and unknown unicast traffic on a switch port by defining a threshold (in pps, bps, or percentage of bandwidth). When the threshold is exceeded, the port can drop traffic, send an SNMP trap, or shut down, protecting the LAN from broadcast storms. It is configured with the 'storm-control broadcast level' interface command.

Answer

Port Security.

Answer

Rate Limiting (QoS).

Answer

Broadcast suppression.

Question 5

Which THREE design elements are required for a high-availability firewall pair?

Accepted Answer

Heartbeat mechanisms.. High availability requires connectivity, state synchronization, and failure detection.

Answer

Shared MAC addresses across interfaces.

Question 6

Which THREE components of the Cisco Secure stack provide visibility into encrypted traffic?

Accepted Answer

Cisco Umbrella.. Visibility requires decryption and analysis tools that can handle SSL/TLS traffic.

Answer

DHCP snooping.

Answer

Standard Layer 3 routing.

Question 7

You are designing a security architecture for a multi-cloud environment using Cisco Secure Firewall. Which feature should be enabled to enforce consistent security policies across AWS and Azure instances using FMC?

Accepted Answer

Unified Security Policy Object Management. The Cisco Secure Firewall Management Center (FMC) allows for object-based grouping and policy application across multi-cloud environments, ensuring consistency.

Answer

Cloud-Native Policy Mapping

Answer

Virtual Private Cloud Bridging

Answer

Multi-Cloud Dynamic Routing

Question 8

Which Cisco technology allows an organization to enforce security policies based on the user's location and device posture, even when the user is off-network?

Accepted Answer

Cisco Duo. Cisco Duo is a Zero Trust security platform that enforces access policies based on user identity, device health (posture), and contextual signals like location — regardless of whether the user is on or off the corporate network. Its cloud-delivered architecture means policy enforcement follows the user everywhere, which is exactly what off-network posture and location-based control requires. AnyConnect is a VPN client, ASA is a firewall, and ISE is primarily an on-premises NAC/identity policy engine, none of which natively deliver cloud-based off-network posture enforcement the way Duo does.

Answer

Cisco AnyConnect

Answer

Cisco ASA

Answer

Cisco ISE

Question 9

When designing a site-to-site VPN, which IKEv2 feature allows the tunnel to be established without requiring a static IP address on one side?

Accepted Answer

IKEv2 ID-based authentication. IKEv2 ID-based authentication is the correct feature because it allows the VPN peers to authenticate using identities (such as FQDNs, user FQDNs, or distinguished names) instead of IP addresses. This enables tunnel establishment even when one side has a dynamic IP address, as the peer is identified by its ID rather than its IP.

Answer

IKEv2 Virtual Tunnel Interfaces

Answer

AnyConnect Mobility

Answer

Dead Peer Detection

Question 10

Which TWO Cisco technologies are critical for implementing a Zero Trust architecture for the workforce? (Select 2)

Accepted Answer

Cisco Duo. Duo ensures the identity is trusted, and Secure Endpoint/AnyConnect ensures the device is trusted.

Answer

Cisco ACI

Answer

Cisco Webex

Answer

Cisco Catalyst 9000

Question 11

A security architect is designing a Cisco SD-WAN security solution for a multinational enterprise. The design must ensure that traffic from branch offices to the data center is inspected by a firewall, while direct internet traffic from branches is secured with cloud-delivered security. The solution should also provide segmentation between guest and corporate traffic. Which two design elements should be included to meet these requirements? (Choose two.)

Accepted Answer

Deploy Cisco Umbrella SIG for direct internet access from branches.. To secure direct internet traffic with cloud-delivered security, Cisco Umbrella SIG is the appropriate solution. For firewall inspection of branch-to-data center traffic, service insertion redirects traffic to a Cisco Firepower firewall. These two elements together meet the stated requirements for securing both traffic flows.

Answer

Deploy Cisco Identity Services Engine for endpoint posture assessment at branches.

Answer

Use Cisco SD-WAN VPN segmentation to separate guest and corporate traffic.

Answer

Enable Cisco SD-WAN Application-Aware Routing to prioritize business-critical applications.

Question 12

A security designer is selecting a Cisco firewall for a branch office that requires stateful inspection, application visibility, and the ability to enforce policies based on user identity without deploying a separate identity server at the branch. The branch has a single WAN link and no local management staff. Which Cisco solution should be recommended?

Accepted Answer

Cisco Meraki MX security appliance with Meraki cloud management. The branch requires stateful inspection, application visibility, identity-based policy enforcement, and cloud management with no local staff. Cisco Meraki MX delivers these through its cloud dashboard and integrated identity services, without needing a separate on-premises identity server. The other options either require external identity integration or on-premises management, which conflicts with the branch constraints.

Answer

Cisco Secure Firewall Threat Defense managed by Cisco Defense Orchestrator

Answer

Cisco Secure Firewall ASA with Cisco Identity Services Engine integration

Answer

Cisco Secure Firewall Threat Defense with Cisco Firepower Management Center

Question 13

A security designer is planning a Cisco SD-WAN deployment with a focus on control plane security. The design must ensure that only authorized vEdge or cEdge devices can join the overlay and that control plane communications are encrypted and authenticated. Which Cisco SD-WAN component is responsible for authenticating devices and distributing cryptographic keys for the control plane?

Accepted Answer

Cisco vSmart controller. In Cisco SD-WAN, the vSmart controller manages the control plane. It authenticates devices using certificates and distributes the cryptographic keys used to secure control plane communications between controllers and edge devices. vManage handles management, vBond handles orchestration and initial authentication, and vAnalytics provides reporting. Only vSmart fulfills the described security responsibilities.

Answer

Cisco vBond orchestrator

Answer

Cisco vManage

Answer

Cisco vAnalytics

Question 14

You are designing a security architecture for a hybrid cloud environment using Cisco Secure Firewall. Which design pattern effectively mitigates the risk of lateral movement between VPCs in AWS while maintaining centralized policy enforcement?

Accepted Answer

Utilizing a Transit Gateway with a centralized inspection VPC and VPC attachments.. A Transit Gateway with a centralized inspection VPC and VPC attachments allows all inter-VPC traffic to be routed through a single inspection point where Cisco Secure Firewall can enforce policy. This design centralizes security policy, avoids the complexity of managing firewalls in every VPC, and effectively mitigates lateral movement by forcing east-west traffic through inspection before it reaches another VPC.

Answer

Relying solely on AWS Security Groups for inter-VPC traffic.

Answer

Implementing an Overlay Network using Cisco ACI Remote Leaf.

Answer

Deploying individual firewall appliances in each VPC.

Question 15

A company is migrating to a SASE architecture using Cisco+ Secure Connect. Which component is responsible for the unified identity-based access control for remote users?

Accepted Answer

Cisco Duo integration within the Secure Connect platform.. In Cisco+ Secure Connect (Cisco's SASE offering), unified identity-based access control for remote users is provided by the integration with Cisco Duo. Duo provides multi-factor authentication (MFA) and device trust, which are essential for zero-trust access. The Secure Connect platform leverages Duo to enforce identity-based policies before granting access to applications. The other options are either legacy components (AnyConnect standalone VPN) or on-premises solutions (ISE) that are not the primary identity control in the SASE architecture.

Answer

AnyConnect standalone VPN gateway.

Answer

Firepower Management Center cloud connector.

Answer

On-premises ISE cluster.

Question 16

Which TWO design considerations are essential when implementing a Zero Trust architecture for IoT devices in a campus environment using Cisco ISE and TrustSec?

Accepted Answer

Utilizing Cisco ISE to profile and categorize IoT endpoints.. Option B is correct because Cisco ISE's profiling and endpoint categorization is foundational to Zero Trust for IoT: ISE uses probes (RADIUS, SNMP, DHCP, NMAP, etc.) and profiling policies to identify device types, which then drives authorization and policy decisions rather than trusting the device by default. Option C is correct because TrustSec Scalable Group Tags (SGTs) applied to IoT endpoints enable micro-segmentation via Security Group ACLs (SGACLs) enforced on network devices, so traffic between IoT groups and other segments is restricted based on group membership rather than IP addresses or VLANs. Static IP addressing (A) is not essential and actually complicates profiling and dynamic policy, since DHCP-based profiling and identity context are commonly leveraged. Placing all IoT devices in one VLAN (D) contradicts Zero Trust micro-segmentation by creating a flat, overly permissive broadcast domain. Disabling 802.1X for all non-PC devices (E) weakens identity-based access control and is not a Zero Trust design principle; IoT devices should be authenticated where possible (e.g., MAB, 802.1X with certificates) and then authorized through ISE.

Answer

Using static IP addresses for every IoT device to ensure consistency.

Answer

Ensuring all IoT devices are placed in the same VLAN for easier management.

Answer

Disabling 802.1X for all non-PC devices.

Question 17

In a Cisco SD-WAN environment, you need to ensure that branch office traffic destined for SaaS applications is optimized and secured. Which design approach is most appropriate?

Accepted Answer

Implementing Cisco Umbrella SIG integration on the SD-WAN edge devices for DIA.. In a Cisco SD-WAN environment, optimizing and securing branch traffic to SaaS applications is best achieved by integrating Cisco Umbrella SIG (Secure Internet Gateway) on the SD-WAN edge devices and using Direct Internet Access (DIA). This approach allows branch traffic to break out locally to the internet, where Umbrella enforces security policies (e.g., DNS-layer security, URL filtering, CASB) without backhauling to the corporate headend. This reduces latency and improves performance for SaaS apps while maintaining security. The other options either bypass security, add unnecessary hardware, or reintroduce backhauling.

Answer

Using static routing to bypass all security policies for trusted SaaS domains.

Answer

Deploying a dedicated physical firewall at every branch office.

Answer

Hair-pinning all SaaS traffic back to the corporate headend for inspection.

Question 18

A security architect is designing a Cisco Secure Firewall deployment for a multi-cloud environment. Which design strategy ensures consistent security policy enforcement across AWS and Azure instances?

Accepted Answer

Utilize a centralized FMC to manage virtual Secure Firewalls across all cloud environments.. A centralized FMC (Firepower Management Center) provides a single pane of glass for policy creation, deployment, and monitoring across all virtual Secure Firewall instances regardless of whether they run in AWS, Azure, or on-premises. This ensures that the same access control, IPS, and URL filtering policies are consistently enforced, eliminating policy drift between clouds. FMC supports multi-domain and hierarchical policy inheritance, which is essential for multi-cloud consistency.

Answer

Deploy separate FMC instances in each cloud provider for localized management.

Answer

Use individual Firewall Device Managers (FDM) for every instance.

Answer

Implement cloud-native security groups exclusively to bypass firewall bottlenecks.

Question 19

When designing a secure remote access solution for a hybrid workforce, which Cisco AnyConnect feature should be prioritized to reduce the attack surface by verifying the posture of the device before granting access?

Accepted Answer

AnyConnect Posture Module.. The AnyConnect Posture Module is the component that performs endpoint posture assessment (hostscan) before or during VPN session establishment, checking for antivirus, firewall, OS patches, and other compliance criteria. It is the mechanism that reduces attack surface by ensuring only compliant devices are granted access, feeding results into DAP for enforcement.

Answer

IKEv2 protocol support.

Answer

Split-tunneling.

Answer

Dynamic Access Policies (DAP).

Question 20

A security architect is designing a Cisco Secure Firewall deployment for a multi-cloud environment. Which design approach provides the most consistent security policy enforcement across AWS and Azure?

Accepted Answer

Utilize Cisco Defense Orchestrator for centralized policy management.. Cisco Defense Orchestrator (CDO) provides centralized, cloud-delivered management of Cisco Secure Firewall (FTD) policies across multiple environments, including AWS and Azure. By managing all firewalls from a single pane, CDO ensures consistent access control, intrusion prevention, and URL filtering policies regardless of which cloud the firewall instance runs in.

Answer

Deploy individual local managers for each cloud provider.

Answer

Rely on native cloud-native security groups only.

Answer

Implement separate FTD instances with unique local access control lists.