SDSI Timed Practice Test 3 — 10 Questions

Question 1

You are implementing automated policy enforcement for Cisco Secure Access by Duo. Which API allows you to programmatically manage users and authentication settings?

Accepted Answer

Duo Admin API. The Duo Admin API is the RESTful interface designed for programmatic management of users, groups, phones, and authentication settings within Duo. It allows administrators to automate onboarding, policy assignment, and configuration changes, which is exactly what an automated policy enforcement pipeline requires.

Answer

Duo Web SDK

Answer

Duo Auth API

Answer

Duo Telemetry API

Question 2

When designing a VPN solution for a hybrid workforce, which protocol provides the most robust support for DTLS to minimize latency for real-time traffic?

Accepted Answer

Cisco Secure Client with DTLS enabled.. Cisco Secure Client (formerly AnyConnect) with DTLS enabled provides the most robust support for DTLS in a VPN solution. DTLS (Datagram Transport Layer Security) runs over UDP and avoids TCP-over-TCP meltdown, minimizing latency for real-time traffic like voice and video. Cisco Secure Client natively supports DTLS and can fall back to TLS if UDP is blocked.

Answer

SSL VPN Clientless portal.

Answer

L2TP/IPsec.

Answer

IPsec IKEv1.

Question 3

Which THREE of the following are essential components of a robust DevSecOps security architecture for Cisco infrastructure?

Accepted Answer

Infrastructure as Code (IaC). Infrastructure as Code (IaC) (A) is essential because it lets Cisco device configurations, policies, and cloud/network resources be defined declaratively in version-controlled templates, enabling repeatable, auditable, and peer-reviewed deployments instead of error-prone manual CLI changes. Continuous Monitoring (C) is required to detect drift, unauthorized configuration changes, and threats in real time across Cisco infrastructure, feeding telemetry into SIEM/SOAR and compliance dashboards so issues are caught and remediated quickly. Automated Testing (D) is essential to validate IaC templates and security controls in CI/CD pipelines (e.g., unit, integration, and policy-as-code checks) before changes reach production, preventing misconfigurations from being deployed. Manual Review Committees (B) are not a core DevSecOps component because they introduce slow, human-gated approvals that contradict the automation and continuous-delivery principles of DevSecOps, even if some review may still occur. Isolated air-gapped networks (E) are not essential to a DevSecOps architecture; while useful in specific high-security environments, they prevent the continuous integration, delivery, and monitoring that DevSecOps depends on.

Answer

Manual Review Committees

Answer

Isolated air-gapped networks

Question 4

Which risk assessment technique involves evaluating the impact of an attack on the confidentiality, integrity, and availability of an asset?

Accepted Answer

CIA Triad Impact Assessment.. The CIA Triad Impact Assessment evaluates how an attack would degrade Confidentiality, Integrity, and Availability of a specific asset, which is the standard qualitative/quantitative risk technique for scoring asset-level impact. It directly maps threat events to business impact on the three core security pillars, producing the impact half of a risk calculation (Risk = Likelihood × Impact).

Answer

SWOT Analysis.

Answer

Network Penetration Testing.

Answer

Cost-Benefit Analysis.

Question 5

Which of the following is a key requirement for implementing successful DevSecOps in a large organization?

Accepted Answer

Cultural alignment between teams. Cultural alignment between developers and security teams is the foundational requirement for successful DevSecOps.

Answer

Manual approval for every commit

Answer

Removing all open-source code

Answer

Restricting code access to security only

Question 6

What is the primary architectural benefit of deploying an API Gateway in a microservices environment?

Accepted Answer

It centralizes security and policy enforcement for all services. An API Gateway acts as a single entry point for all client requests, centralizing cross-cutting concerns such as authentication, authorization, rate limiting, and logging. This offloads these responsibilities from individual microservices, ensuring consistent policy enforcement and reducing duplication. By handling security at the edge, services can focus on business logic, and internal services remain protected behind the gateway.

Answer

It makes all internal services public-facing

Answer

It eliminates the need for service-to-service security

Answer

It provides data storage for the microservices

Question 7

When conducting a risk assessment, what is the best way to determine the value of an asset to the organization?

Accepted Answer

Perform a Business Impact Analysis (BIA).. A Business Impact Analysis (BIA) is the formal process for determining the criticality and value of assets by assessing the operational, financial, legal, and reputational impact of their loss or disruption. It identifies critical business functions, dependencies, and recovery objectives (RTO/RPO), which directly translate into asset value for risk assessment. Manufacturer price, IT opinion, and hardware replacement cost reflect only acquisition cost, not business value.

Answer

Check the manufacturer's list price.

Answer

Ask the IT department for their opinion.

Answer

Check the hardware replacement cost.

Question 8

Which TWO methods provide identification for IoT devices in an enterprise network?

Accepted Answer

802.1X (EAP-TLS).. Option A, 802.1X with EAP-TLS, is correct because it provides strong, certificate-based mutual authentication that uniquely identifies IoT devices on the enterprise network before granting access. Option D, device profiling with Cisco ISE, is correct because ISE identifies IoT devices by collecting attributes such as MAC OUI, DHCP fingerprints, and HTTP user-agent data to classify and authorize them. Option B, ignoring the device type, is wrong because it provides no identification and defeats access control. Option C, using public Wi-Fi access, is wrong because it is an untrusted network path that does not identify devices to the enterprise. Option E, MAC address spoofing, is wrong because spoofed MAC addresses are easily forged and cannot reliably identify a device.

Answer

Ignoring the device type.

Answer

Using public Wi-Fi access.

Answer

MAC address spoofing.

Question 9

A design team is integrating Cisco Secure Firewall with an existing SIEM. Which telemetry export format is best for comprehensive security analysis?

Accepted Answer

eStreamer. eStreamer is Cisco's dedicated telemetry export protocol for Cisco Secure Firewall (formerly Firepower) that streams detailed event data—including connection, intrusion, file, malware, and Security Intelligence events—directly to a SIEM or external analysis tool. Unlike flow-only protocols, eStreamer delivers rich, contextual security events needed for comprehensive threat analysis and correlation.

Answer

NetFlow

Answer

SNMP

Answer

ICMP

Question 10

Which Cisco product is best for enforcing security policy based on the user's AD group membership?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco Identity Services Engine (ISE) is the product designed to enforce security policy based on user identity and AD group membership. ISE integrates with Active Directory to retrieve group memberships and uses that information in authorization policies, which can then be enforced on network devices via RADIUS, TrustSec, or pxGrid. This makes ISE the correct choice for identity-based policy enforcement tied to AD groups.

Answer

Cisco Umbrella.

Answer

Cisco Secure Firewall.

Answer

Cisco Stealthwatch.