SDSI Hard Difficulty Questions

Explanation: Cisco Secure Firewall (IPS) is correct because its intrusion prevention system continuously inspects traffic inline and can detect and block malicious activity such as exploits, malware, and policy violations in the network environment. Cisco Secure Network Analytics (Stealthwatch) is correct because it uses NetFlow and telemetry from network devices to detect anomalous behavior, lateral movement, and threats across the network. Cisco AnyConnect is a VPN/remote-access client, not a threat monitoring or detection product. Cisco Secure Email protects email traffic against phishing and malware, but it is not a general network threat monitoring/detection platform. Cisco ISE is an identity and access control (NAC/RADIUS/TACACS+) solution, not a threat detection tool.

Explanation: Cisco Cloudlock integrates with Google Workspace through its API-based CASB connection, using OAuth to read Drive, Gmail, and audit logs. That API access gives Cloudlock visibility into file sharing settings, external collaborators, and user activity, and its behavioral analytics baseline normal user behavior to flag anomalies such as mass external sharing or unusual download volumes. Remediation is then performed through the same APIs.

Explanation: SGT-based micro-segmentation using Cisco TrustSec assigns Security Group Tags to workloads and enforces policy based on those tags rather than IP addresses. This allows the firewall to apply granular east-west controls that prevent lateral movement between compromised and target systems, while keeping policy scalable and operationally efficient. It directly addresses lateral movement risk without the performance penalty of inspecting every signature.

Explanation: Option B (Explainability and transparency, XAI) is correct because security automation platforms increasingly rely on AI/ML models to triage alerts and make risk decisions, so analysts and auditors must be able to understand why a model produced a given verdict to trust, validate, and defend it. Option C (API integration and extensibility) is correct because a security automation platform must interoperate with SIEM, SOAR, EDR, ticketing, and threat-intel systems via REST APIs, webhooks, and plugins, so its ability to integrate and be extended determines how well the AI/ML capabilities fit existing workflows. Option E (Data quality and labeling) is correct because ML model accuracy in security use cases depends directly on well-curated, correctly labeled, and representative training data (e.g., labeled true/false positives), and poor data quality leads to high false-positive rates and unreliable automation. Option A is not a key AI/ML design consideration because vendor team headcount does not determine model explainability, integration capability, or data quality. Option D is not a key AI/ML design consideration for platform selection because local GPU acceleration is an infrastructure/deployment detail, not a core AI/ML design factor, and many platforms deliver inference via cloud or vendor-managed services.

Explanation: Option A is correct because strict schema validation on all incoming API requests enforces expected data types, formats, and required fields, which directly mitigates OWASP API threats such as mass assignment, injection, and improper input handling by rejecting malformed or unexpected payloads before they reach backend logic. Option D is correct because continuous monitoring of API traffic for anomalies that indicate data exfiltration helps detect and respond to threats like excessive data exposure and data harvesting, which are core concerns in the OWASP API Top 10. Option E is correct because deploying Cisco API Security to detect Broken Object Level Authorization (BOLA) addresses the top-ranked OWASP API risk, where attackers manipulate object identifiers to access resources belonging to other users; API security tooling can baseline and flag such unauthorized object access patterns. Option B is incorrect because bypassing authentication for performance eliminates access control entirely and would worsen, not mitigate, OWASP API threats such as broken authentication and BOLA. Option C is incorrect because disabling logging of API request headers removes critical audit and forensic visibility needed to detect and investigate attacks, undermining rather than strengthening API security.