Knowledge + Practice

Cisco Designing Cisco Security Infrastructure (SDSI, 300-745, CCNP Security, design-focused) (SDSI) (SDSI) — Questions 1–75

284 questions total · 4 pages · All types, answers revealed

Take a mock exam Exam hub

Page 1 of 4

1

Multi-Selecthard

A multinational enterprise is designing a DevSecOps pipeline that integrates Cisco XDR to automate incident response across its security infrastructure. The security architects must ensure that the pipeline can automatically trigger remediation actions in third-party tools. Which two Cisco XDR capabilities are essential for this design? (Choose two.)

Select 2 answers

A.Cisco XDR Integration Modules for third-party security tools

B.Cisco XDR Threat Intelligence feeds from Cisco Talos

C.Cisco XDR APIs for ingesting and querying incident data

D.Cisco XDR Automation with pre-built and custom playbooks

E.Cisco XDR Case Management with manual approval workflows

AnswersA, D

Cisco XDR provides integration modules that allow it to communicate with third-party security tools. These modules define the actions that can be taken, such as blocking a hash or quarantining an email. They are essential because they provide the pre-built connectors that enable the automation playbooks to execute remediation tasks in external systems.

Why this answer

To automatically trigger remediation actions in third-party tools, Cisco XDR must have both an automation engine to execute workflows and integration modules to communicate with those tools. The automation capability provides the playbook execution, while the integration modules supply the connectors and actions. Together, they enable the pipeline to orchestrate responses across the security infrastructure without human intervention.

Exam trap

The trap here is assuming that APIs or threat intelligence alone can trigger remediation, when actually the automation engine and integration modules are the components that execute actions.

Full explanation →

2

MCQmedium

When designing for high availability, what is the role of the 'Heartbeat' mechanism in a Cisco firewall pair?

A.To authenticate users.

B.To sync firewall configurations.

C.To detect the failure of the peer unit.

D.To balance traffic load.

AnswerC

The heartbeat continuously exchanges liveness signals between the active and standby units, so a missed threshold triggers failover. This directly satisfies the high-availability requirement by detecting peer failure, enabling the standby firewall to assume the active role and maintain traffic flow without manual intervention.

Why this answer

The heartbeat mechanism in a Cisco firewall HA pair sends periodic hello messages between peer units so each can detect whether the other is still alive. If heartbeats stop arriving within the hold time, the standby unit assumes the active unit has failed and takes over. It is purely a health/failure-detection mechanism, not a configuration sync or load-balancing function.

Exam trap

The trap is confusing heartbeat (liveness detection) with configuration synchronization; both use the failover link, but only the heartbeat detects peer failure, and candidates often pick 'sync configurations' as the heartbeat's role.

How to eliminate wrong answers

Option A is wrong because user authentication is handled by identity services (e.g., ISE, RADIUS, LDAP), not by HA heartbeats. Option B is wrong because configuration synchronization is performed over the failover link's config-sync channel, not by the heartbeat itself (the heartbeat is the liveness check). Option D is wrong because traffic load balancing is a separate function (e.g., ECMP, load balancers, or active/active clustering), not the role of the heartbeat.

Full explanation →

3

MCQhard

A security architect is configuring a design for an enterprise with high-speed (100G) traffic. Which Cisco firewall solution is most appropriate?

A.Cisco Umbrella virtual appliance.

B.Cisco Firepower 1000 series.

C.Cisco AnyConnect.

D.Cisco Firepower 9300 series.

AnswerD

The Firepower 9300's chassis-based architecture delivers the throughput the 100G requirement demands, scaling to roughly 1.2 Tbps with multiple security modules. Its clustered configuration sustains high-speed inspection without becoming a bottleneck, satisfying the enterprise's performance constraint where fixed-appliance alternatives would fall short.

Why this answer

Cisco Firepower 9300 series is a high-end, carrier-class firewall designed for high-speed, high-throughput environments, including 100G interfaces. It supports modular security services and clustering for scalability and redundancy. This makes it the most appropriate choice for an enterprise with 100G traffic.

Exam trap

SDSI often tests the scalability limits of different firewall models; candidates may incorrectly choose the 1000 series for high-speed environments due to familiarity or cost considerations.

How to eliminate wrong answers

Option A is wrong because Cisco Umbrella virtual appliance is a DNS-layer security solution, not a high-speed firewall. Option B is wrong because Cisco Firepower 1000 series is for small to medium businesses with lower throughput (up to 1 Gbps). Option C is wrong because Cisco AnyConnect is a VPN client, not a firewall.

Full explanation →

4

MCQhard

A security architect is designing a solution to block malicious URLs across all branch offices. Which Cisco feature provides the most efficient, scalable way to manage this across 500+ locations?

A.Cisco Umbrella cloud-delivered DNS filtering.

B.Cisco Stealthwatch.

C.Cisco Identity Services Engine (ISE).

D.Local URL filtering on each branch firewall.

AnswerA

Cisco Umbrella enforces DNS filtering from a single cloud policy console, so one URL-blocking rule propagates to all 500+ branch offices without per-site appliance configuration. This satisfies the stem's scalability and efficiency constraint across distributed locations.

Why this answer

Cisco Umbrella provides cloud-delivered DNS-layer security, so a single policy change in the Umbrella dashboard instantly applies to all 500+ branch offices without touching each site's firewall. DNS filtering blocks malicious domains before a connection is even established, making it both efficient and scalable for distributed environments.

Exam trap

The trap is choosing a detection tool (Stealthwatch) or an identity tool (ISE) for an enforcement task — candidates match 'security' to the wrong Cisco product category instead of recognizing DNS-layer blocking as Umbrella's specialty.

How to eliminate wrong answers

Option B is wrong because Stealthwatch is a network traffic analytics and anomaly-detection platform, not a URL-blocking enforcement point — it detects threats but does not block URLs at the DNS layer. Option C is wrong because ISE handles identity, access control, and network admission (802.1X, posture), not URL filtering. Option D is wrong because local URL filtering on each branch firewall requires per-site configuration and management, which does not scale to 500+ locations and creates policy drift.

Full explanation →

5

MCQeasy

A design requirement for a new SOC environment mandates that incident data must be centralized. Which Cisco tool is best suited to act as the single pane of glass for integrating disparate security logs and telemetry?

A.Cisco SecureX

B.Cisco Firepower Management Center (FMC)

C.Cisco Identity Services Engine (ISE)

D.Cisco Defense Orchestrator (CDO)

AnswerA

Cisco SecureX aggregates telemetry from multiple Cisco and third-party security products into a unified console, correlating alerts and enabling consistent response workflows. This centralisation satisfies the mandate for a single pane of glass integrating disparate logs across the SOC environment.

Why this answer

Cisco SecureX is the platform designed to act as a single pane of glass, integrating disparate security products and telemetry into a unified console with threat response, case management, and orchestration. It aggregates data from Cisco and third-party tools, making it the best fit for centralizing incident data across a SOC.

Exam trap

The trap is confusing device-management consoles (FMC, CDO) or identity platforms (ISE) with an integration/aggregation platform; candidates who equate 'centralized management' with 'single pane of glass' will pick FMC or CDO.

How to eliminate wrong answers

Option B is wrong because Cisco Firepower Management Center (FMC) manages Firepower/FTD devices and their events, but it is not a cross-vendor integration platform for disparate security logs. Option C is wrong because Cisco Identity Services Engine (ISE) is a policy and identity control plane for network access, not a log aggregation or incident centralization tool. Option D is wrong because Cisco Defense Orchestrator (CDO) is a cloud-based management platform for firewall policy across multiple devices, not a SOC-wide telemetry aggregation and incident console.

Full explanation →

6

MCQmedium

What is the primary function of the 'AnyConnect' (Secure Client) profile?

A.To manage connection and security settings for the endpoint.

B.To act as an identity provider.

C.To store user credentials.

D.To monitor CPU usage on the host.

AnswerA

The AnyConnect (Secure Client) profile delivers endpoint-side configuration, pushing VPN connection entries, security settings and posture requirements to the client. This satisfies the stem's focus on the profile's primary function: governing how the endpoint connects and which protective settings apply, rather than server-side policy or identity management in Microsoft Entra ID.

Why this answer

The AnyConnect (Secure Client) profile is an XML file that defines how the endpoint's VPN client behaves, including connection entries, authentication methods, split tunneling, and security settings. It is pushed from the headend (ASA or FTD) to the client, allowing centralized management of connection and security policies. This makes option A correct because the profile's primary function is to manage connection and security settings for the endpoint.

Exam trap

SDSI often tests the misconception that the AnyConnect profile stores user credentials or acts as an identity provider, when in fact it only manages connection and security settings.

How to eliminate wrong answers

Option B is wrong because an identity provider (IdP) is a separate entity (e.g., SAML IdP like Okta or Azure AD) that authenticates users; the AnyConnect profile does not provide identity services. Option C is wrong because user credentials are stored in the client's credential store (e.g., Windows Credential Manager) or provided by the user, not in the profile; the profile may reference authentication but does not store credentials. Option D is wrong because monitoring CPU usage is not a function of the AnyConnect profile; that would be handled by system monitoring tools or endpoint posture assessment, not the VPN profile.

Full explanation →

7

MCQmedium

A security architect is designing a SIEM integration for a distributed enterprise. Which tool selection criteria best aligns with the requirement to support real-time correlation across disparate cloud and on-premises environments?

A.Choose tools that utilize a monolithic database structure to ensure data consistency.

B.Focus on tools that strictly utilize hardware-based packet capture for all telemetry.

C.Select tools based solely on the number of pre-built connectors available in the marketplace.

D.Prioritize tools that support native Common Event Format (CEF) ingestion and bidirectional API integrations.

AnswerD

CEF normalises event data from heterogeneous sources into a common schema, while bidirectional APIs let the SIEM both ingest telemetry and push enforcement actions back. This pairing directly satisfies the stem's real-time correlation requirement across disparate cloud and on-premises environments.

Why this answer

Native Common Event Format (CEF) ingestion and bidirectional API integrations are the criteria that best support real-time correlation across disparate cloud and on-premises sources. CEF is a standardized log format that normalizes events from heterogeneous vendors, and bidirectional APIs allow the SIEM to both ingest telemetry and push response actions back to sources, which is essential for a distributed enterprise.

Exam trap

The trap is choosing an answer based on superficial scalability or connector-count claims; the exam tests whether you recognize that standardized ingestion (CEF) plus bidirectional integration is what enables real-time cross-environment correlation.

How to eliminate wrong answers

Option A is wrong because a monolithic database structure creates a scalability bottleneck and cannot efficiently handle the volume and variety of distributed cloud and on-premises telemetry; modern SIEMs use distributed or columnar stores. Option B is wrong because hardware-based packet capture is impractical for cloud environments and does not scale to a distributed enterprise; it also misses log-based telemetry entirely. Option C is wrong because selecting tools solely on the number of pre-built connectors ignores whether those connectors support real-time normalization, correlation, and bidirectional response — quantity of connectors is a vanity metric, not a capability metric.

Full explanation →

8

Multi-Selecthard

Which TWO methods are used to provide secure remote access for a mobile workforce? (Select 2)

Select 2 answers

A.FTP

B.Duo Access Gateway

C.Cleartext HTTP

D.AnyConnect VPN

E.Telnet

AnswersB, D

Duo Access Gateway acts as an on-premises identity proxy, enforcing Duo's adaptive multi-factor authentication before granting access to cloud and internal applications. It satisfies the mobile workforce requirement by verifying user identity at the perimeter regardless of device or location.

Why this answer

Duo Access Gateway (B) is correct because it provides secure remote access by enforcing multi-factor authentication and single sign-on for users connecting to internal applications from outside the network, protecting against credential theft. AnyConnect VPN (D) is correct because it establishes an encrypted IPsec/IKEv2 or TLS tunnel between the remote device and the corporate network, ensuring confidentiality and integrity of the mobile workforce's traffic. FTP (A) is not acceptable because it transmits credentials and data in cleartext without encryption.

Cleartext HTTP (C) is not acceptable because it sends web traffic unencrypted, exposing sensitive data to interception. Telnet (E) is not acceptable because it sends all session data, including passwords, in plaintext and lacks modern cryptographic protections.

Exam trap

SDSI often tests whether candidates can spot insecure legacy protocols (FTP, Telnet, cleartext HTTP) presented alongside legitimate secure remote access solutions, catching those who select based on familiarity rather than security posture.

Full explanation →

9

MCQeasy

A security engineer is designing an automated threat response workflow that uses Cisco XDR to enrich alerts from Cisco Secure Firewall and then trigger a remediation action in a third-party endpoint detection and response (EDR) tool. Which Cisco XDR component should be used to execute the remediation action in the third-party EDR?

A.Cisco XDR Analytics with behavioral baselining

B.Cisco XDR Automation with a custom response action

C.Cisco XDR Incident Manager with manual playbooks

D.Cisco XDR Device Insights with asset tagging

AnswerB

Cisco XDR Automation allows security teams to create custom response actions that can integrate with third-party tools via APIs. It provides a low-code or script-based environment to define workflows that enrich alerts and execute remediation, such as isolating an endpoint in a third-party EDR. This is the intended component for orchestrating cross-vendor actions within Cisco XDR.

Why this answer

Cisco XDR Automation with a custom response action is the correct component because it provides the orchestration and execution capabilities needed to trigger remediation in a third-party EDR. It can enrich alerts from Cisco Secure Firewall and then call the EDR's API to isolate an endpoint. Other components are for incident management, analytics, or asset context, and do not execute automated actions.

Exam trap

The trap here is confusing data enrichment or incident management features with the automation engine that actually executes response actions in third-party tools.

Full explanation →

10

MCQeasy

What is the primary benefit of 'Visibility' in the Cisco API Security architecture?

A.Automatic translation of API code

B.Reduction of API storage costs

C.Increased performance of the API calls

D.Identification of all APIs and shadow endpoints

AnswerD

Visibility discovers every API and shadow endpoint across the estate, including undocumented and unmanaged services. This satisfies the architecture's requirement by producing a complete inventory, which is the prerequisite for applying any subsequent security policy to previously unknown interfaces.

Why this answer

Visibility in Cisco API Security means discovering and inventorying every API — including undocumented 'shadow' endpoints that teams spun up outside formal governance. Without this inventory, no other security control (auth, rate limiting, schema validation) can be applied to the right surface.

Exam trap

SDSI often tests whether candidates confuse visibility (discovery/inventory) with enforcement (blocking, rate limiting), so picking a performance or code-translation answer misses the core purpose of API discovery.

How to eliminate wrong answers

Option A is wrong because automatic translation of API code is a developer productivity feature, not a security benefit of visibility. Option B is wrong because API storage cost reduction is unrelated to the security visibility function. Option C is wrong because increased API call performance is a runtime optimization, not the purpose of visibility — in fact, discovery and inspection can add minor overhead.

Full explanation →

11

Multi-Selecthard

Which TWO design principles should be followed when selecting a firewall architecture for a multi-cloud environment? (Select 2)

Select 2 answers

A.Physical firewalls for all cloud segments

B.Centralized management of policies

C.Using cloud-native firewalls only

D.Consistent feature set across physical and virtual

E.Deploying firewalls in a single region

AnswersB, D

Centralised policy management lets one console define and push consistent rules across all cloud regions and platforms, avoiding per-cloud drift and duplicated administration. This satisfies the multi-cloud design constraint of maintaining uniform enforcement despite heterogeneous environments.

Why this answer

Option B is correct because centralized management of policies is essential in a multi-cloud environment, where security teams must define, audit, and enforce consistent rules across AWS Security Groups, Azure NSGs, GCP firewall rules, and on-premises devices from a single pane of glass rather than managing each cloud console separately. Option D is correct because maintaining a consistent feature set across physical and virtual firewalls ensures that the same inspection, logging, NAT, and policy capabilities apply everywhere, so security posture does not degrade when workloads move between on-premises data centers and different cloud providers. Option A is wrong because physical firewalls cannot be inserted into most cloud segments; cloud traffic is handled by virtual or cloud-native constructs, and physical appliances are impractical for east-west traffic inside a VPC/VNet.

Option C is wrong because relying exclusively on cloud-native firewalls creates provider lock-in, inconsistent policy models, and gaps for hybrid or on-premises traffic that still needs protection. Option E is wrong because deploying firewalls in a single region leaves workloads in other regions unprotected and adds unnecessary latency and failure risk, violating high-availability and defense-in-depth design goals.

Exam trap

The trap is assuming 'cloud-native only' or 'physical only' is the right answer — the exam tests whether you recognize that multi-cloud design requires centralized management and feature consistency across mixed form factors, not a single-technology mandate.

Full explanation →

12

MCQeasy

Which aspect of AI-driven security automation helps in 'Reducing Mean Time to Respond (MTTR)'?

A.Updating hardware firmware

B.Automated data correlation

C.Reducing network latency

D.Increasing developer training

AnswerB

Automated data correlation merges telemetry from multiple detection sources into a single enriched alert, removing manual triage steps. This satisfies the requirement to reduce Mean Time to Respond by shortening the interval between detection and analyst action.

Why this answer

Automated data correlation aggregates and analyzes telemetry from multiple sources (endpoints, network devices, identity systems, threat intelligence feeds) to rapidly identify and prioritize security incidents. By correlating disparate events automatically, security teams can detect and respond to threats much faster, directly reducing Mean Time to Respond (MTTR). This is a core value proposition of AI-driven security automation.

Exam trap

SDSI often tests the specific mechanism by which AI reduces MTTR, and candidates incorrectly attribute it to infrastructure improvements like firmware updates or network latency reduction.

How to eliminate wrong answers

Option A is wrong because updating hardware firmware is a patch management task unrelated to incident response speed or MTTR. Option C is wrong because reducing network latency improves performance but does not directly affect how quickly security incidents are detected and remediated. Option D is wrong because increasing developer training is a long-term workforce improvement, not an automated security capability that reduces MTTR.

Full explanation →

13

MCQeasy

Which Cisco solution provides host-based visibility and protection against fileless malware?

A.Cisco Secure Endpoint.

B.Cisco ISE.

C.Cisco Secure Firewall.

D.Cisco Prime Infrastructure.

AnswerA

Cisco Secure Endpoint is the endpoint agent (EDR/EPP) that monitors process behaviour, memory and script execution on the host, detecting fileless malware that never writes a file to disk. This host-based visibility satisfies the stem's requirement, unlike network-only or email-focused controls.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) is the host-based endpoint protection platform that uses behavioral analytics, exploit prevention, and continuous file monitoring to detect and block fileless malware that lives in memory and abuses legitimate system tools. It provides the endpoint-level visibility and protection required for fileless threats.

Exam trap

SDSI often tests the difference between host-based and network-based security controls, tempting candidates toward Cisco Secure Firewall or ISE when the question specifically asks for host-based fileless malware protection.

How to eliminate wrong answers

Option B is wrong because Cisco ISE is a network access control and identity policy platform, not a host-based endpoint protection solution, and it does not inspect endpoint memory for fileless malware. Option C is wrong because Cisco Secure Firewall is a network security appliance that inspects traffic at the perimeter or between segments, not host memory or process behavior. Option D is wrong because Cisco Prime Infrastructure is a network management tool for wired/wireless infrastructure, not an endpoint security product.

Full explanation →

14

MCQmedium

You are implementing automated policy enforcement for Cisco Secure Access by Duo. Which API allows you to programmatically manage users and authentication settings?

A.Duo Web SDK

B.Duo Admin API

C.Duo Auth API

D.Duo Telemetry API

AnswerB

The Duo Admin API exposes programmatic endpoints for creating, updating and removing users, plus configuring authentication policies and MFA settings, satisfying the requirement for automated policy enforcement rather than manual administration through the Duo Admin Panel interface.

Why this answer

The Duo Admin API is the RESTful interface designed for programmatic management of users, groups, phones, and authentication settings within Duo. It allows administrators to automate onboarding, policy assignment, and configuration changes, which is exactly what an automated policy enforcement pipeline requires.

Exam trap

SDSI often tests whether candidates can differentiate Duo's Admin API (for user and settings management) from the Auth API (for authentication transactions) and the Web SDK (for embedding MFA in apps), since all three sound plausibly administrative.

How to eliminate wrong answers

Option A is wrong because the Duo Web SDK is a client-side JavaScript library used to embed Duo's two-factor prompt into a web application's login flow, not to manage users or settings. Option C is wrong because the Duo Auth API is used for performing authentication transactions (e.g., verifying a passcode or push) from custom applications, not for administrative user management. Option D is wrong because there is no 'Duo Telemetry API' in the Duo product line — this is a fabricated distractor.

Full explanation →

15

MCQhard

In a hybrid work design, what is the advantage of using Cisco Umbrella's roaming client?

A.It replaces the need for a local firewall.

B.It provides consistent security coverage off-network.

C.It only works on internal corporate Wi-Fi.

D.It forces all traffic through a local DC.

AnswerB

The Umbrella roaming client forwards DNS requests from endpoints to Umbrella's cloud resolvers regardless of location, enforcing the same DNS-layer security and content policies off-network as on it. This satisfies the hybrid work requirement for consistent protection.

Why this answer

Cisco Umbrella's roaming client extends DNS-layer security to devices even when they are off the corporate network. It ensures that security policies are consistently applied regardless of location, protecting users from malicious domains and enforcing acceptable use policies. This is a key advantage for hybrid work.

Exam trap

SDSI often tests the difference between DNS security and full firewall/VPN solutions, and candidates may overestimate the roaming client's capabilities or misunderstand its off-network functionality.

How to eliminate wrong answers

Option A is wrong because the roaming client does not replace a local firewall; it provides DNS security, not full firewall functionality. Option C is wrong because the roaming client specifically works off-network, not only on internal corporate Wi-Fi. Option D is wrong because the roaming client does not force all traffic through a local data center; it uses the Umbrella cloud for DNS resolution and policy enforcement, avoiding backhauling.

Full explanation →

16

MCQhard

Which security design decision is most critical when migrating an application to the cloud, specifically regarding API security?

A.Relying on the cloud provider's firewall

B.Maintaining a VPN tunnel to the on-premise data center

C.Disabling all API endpoints that are not internal

D.Implementing API security and identity-based access at the application layer

AnswerD

Placing API security and identity-based access at the application layer ties every API call to an authenticated identity and authorisation policy, satisfying the cloud migration constraint where perimeter controls no longer bound the workload and APIs are directly exposed.

Why this answer

Migrating to cloud shifts the trust boundary: the cloud provider secures the infrastructure, but the application owner must secure the API layer. Implementing API security and identity-based access at the application layer (D) ensures authentication, authorization, and threat detection travel with the workload regardless of which cloud or region it runs in.

Exam trap

SDSI often tests whether candidates default to network-centric controls (firewalls, VPNs) when the question asks about cloud API security — the trap is picking the familiar perimeter defense instead of the identity- and application-layer control that actually addresses API threats.

How to eliminate wrong answers

Option A is wrong because cloud provider firewalls operate at L3/L4 and cannot inspect API payloads, enforce object-level authorization, or detect BOLA — they are necessary but insufficient. Option B is wrong because a VPN tunnel to on-premises extends the old perimeter model and does not secure API calls between cloud-native services or external consumers. Option C is wrong because disabling external endpoints breaks legitimate business functionality and is a availability-destroying overcorrection, not a security design decision.

Full explanation →

17

MCQeasy

Which Cisco technology is used to ensure that only authorized users can connect to the network via guest portals?

A.Cisco Umbrella

B.Cisco ISE Guest Services

C.Cisco Firepower

D.Cisco Secure Endpoint

AnswerB

Cisco ISE Guest Services enforces sponsor approval and credential checks before granting guest access, satisfying the requirement that only authorised users connect through guest portals. It authenticates guests against configured identity stores and applies authorisation policies, unlike portal-only solutions that merely present a login page without backend enforcement.

Why this answer

Cisco ISE Guest Services provides guest portal functionality that authenticates and authorizes guest users before granting network access. It supports sponsored guest access, self-registration, and policy enforcement, ensuring only authorized users connect via the guest portal.

Exam trap

SDSI often tests whether candidates confuse guest portal authentication (ISE Guest Services) with other Cisco security products like Umbrella, Firepower, or Secure Endpoint that do not provide guest onboarding.

How to eliminate wrong answers

Option A is wrong because Cisco Umbrella is a cloud-delivered DNS-layer security and secure web gateway, not a guest portal authentication solution. Option C is wrong because Cisco Firepower is a next-generation firewall/IPS platform focused on threat defense, not guest user authentication. Option D is wrong because Cisco Secure Endpoint (formerly AMP for Endpoints) is an endpoint detection and response product, not a guest network access control system.

Full explanation →

18

MCQhard

A company is migrating to a SASE architecture using Cisco+ Secure Connect. Which component is responsible for the unified identity-based access control for remote users?

A.AnyConnect standalone VPN gateway.

B.Firepower Management Center cloud connector.

C.On-premises ISE cluster.

D.Cisco Duo integration within the Secure Connect platform.

AnswerD

Duo supplies the identity layer inside Cisco+ Secure Connect, enforcing user authentication and device trust before granting access to private applications and internet destinations. This satisfies the stem's requirement for unified identity-based access control for remote users across the SASE fabric.

Why this answer

In Cisco+ Secure Connect (Cisco's SASE offering), unified identity-based access control for remote users is provided by the integration with Cisco Duo. Duo provides multi-factor authentication (MFA) and device trust, which are essential for zero-trust access. The Secure Connect platform leverages Duo to enforce identity-based policies before granting access to applications.

The other options are either legacy components (AnyConnect standalone VPN) or on-premises solutions (ISE) that are not the primary identity control in the SASE architecture.

Exam trap

SDSI often tests the misconception that on-premises ISE or standalone VPN provides unified identity-based access in a SASE architecture, when the correct answer is the cloud-based Duo integration.

How to eliminate wrong answers

Option A is wrong because an AnyConnect standalone VPN gateway provides remote access but does not offer unified identity-based access control across cloud and on-premises resources; it is a point solution. Option B is wrong because Firepower Management Center cloud connector is for managing Firepower devices, not for identity-based access control. Option C is wrong because an on-premises ISE cluster is not part of the Cisco+ Secure Connect SASE architecture; Secure Connect uses cloud-based identity integration, primarily Duo.

Full explanation →

19

MCQmedium

An organization is modifying their architecture to meet new compliance requirements for logging. The design requires offloading logs from multiple Cisco Firepower sensors. What is the recommended destination for long-term audit storage?

A.Security Information and Event Management (SIEM)

B.Cisco ISE Node

C.Cisco Catalyst Center

D.Local flash memory on the sensor

AnswerA

A SIEM aggregates and correlates event data from multiple Firepower sensors, providing the centralised, tamper-resistant retention required for long-term audit storage. It satisfies the compliance constraint by enabling historical log querying and reporting beyond each sensor's local storage capacity.

Why this answer

For long-term audit storage of logs from multiple Cisco Firepower sensors, a Security Information and Event Management (SIEM) system is the recommended destination. SIEMs are designed to aggregate, correlate, and retain logs from diverse sources for compliance and forensic analysis. They provide centralized storage, search, and reporting capabilities that meet audit requirements.

Exam trap

SDSI often tests the appropriate use of SIEM for centralized log retention versus using management platforms (FMC, ISE, Catalyst Center) that have limited or different purposes. Candidates may incorrectly choose a Cisco management tool for long-term storage.

How to eliminate wrong answers

Option B is wrong because a Cisco ISE node is primarily for identity and access control, not for long-term storage of Firepower logs; it may generate its own logs but is not a log repository. Option C is wrong because Cisco Catalyst Center (formerly DNA Center) is a network management and automation platform, not a SIEM or log storage solution. Option D is wrong because local flash memory on the sensor is limited, not centralized, and not suitable for long-term audit storage; it may be used for buffering but not for compliance retention.

Full explanation →

20

Multi-Selecthard

Which THREE technologies enable network segmentation in a modern Cisco campus design?

Select 3 answers

A.Standard routing protocols without filters.

B.VRF-Lite.

C.Cisco TrustSec (SGTs).

D.Port forwarding.

E.VLANs.

AnswersB, C, E

VRF-Lite creates multiple independent routing and forwarding tables on the same device, each with its own RIB and FIB, keeping traffic from different segments isolated at Layer 3 without MPLS. This delivers the logical separation the campus segmentation design requires.

Why this answer

VRF-Lite (B) is correct because it creates multiple virtual routing and forwarding instances on the same physical device, each with its own separate routing table, thereby logically segmenting Layer 3 traffic on a shared campus infrastructure. Cisco TrustSec with Security Group Tags (C) is correct because it provides identity- and role-based segmentation by tagging packets with SGTs and enforcing group-based policies, independent of IP addresses or VLANs. VLANs (E) are correct because they are the foundational Layer 2 segmentation mechanism in a campus design, isolating broadcast domains and separating traffic between different user or device groups.

Standard routing protocols without filters (A) do not segment traffic—they advertise reachability between networks and would actually defeat isolation. Port forwarding (D) is a NAT/port-mapping technique for exposing internal services, not a segmentation technology, so it does not belong.

Exam trap

SDSI often tests the misconception that routing protocols or port forwarding provide segmentation, when in fact segmentation requires isolation mechanisms like VRFs, VLANs, and SGTs.

Full explanation →

21

MCQmedium

An organization is performing a risk assessment for a new remote access design. They identify that the SOC currently lacks visibility into anomalous VPN session behavior. Which Cisco solution should the design incorporate to provide behavioral analytics for incident response tool selection?

A.Cisco Identity Services Engine

B.Cisco Umbrella

C.Cisco Secure Network Analytics

D.Cisco Secure Firewall Management Center

AnswerC

Cisco Secure Network Analytics applies behavioural modelling and anomaly detection to network flows, including VPN sessions, surfacing deviations the SOC cannot see today. It satisfies the stem's requirement for behavioural analytics feeding incident response tool selection, unlike signature-based options that only match known threats.

Why this answer

Cisco Secure Network Analytics (formerly Stealthwatch) uses NetFlow and telemetry to build behavioural baselines and detect anomalies such as unusual VPN session patterns, data transfers, or connection volumes. It is purpose-built for network behavioural analytics and feeds incident response tooling with actionable detections. This directly addresses the SOC's lack of visibility into anomalous VPN behaviour.

Exam trap

SDSI often tests the distinction between identity/policy platforms (ISE), DNS security (Umbrella), and true network behavioural analytics (Secure Network Analytics), tempting candidates to pick the most familiar Cisco security product.

How to eliminate wrong answers

Option A is wrong because Cisco Identity Services Engine is a policy and identity enforcement platform for network access control, not a behavioural analytics engine for VPN session anomalies. Option B is wrong because Cisco Umbrella provides DNS-layer security and secure web gateway functions, which do not deliver the network flow behavioural analytics required here. Option D is wrong because Cisco Secure Firewall Management Center manages firewall policy and events; while it has some analytics, it is not the dedicated behavioural analytics solution for VPN session visibility across the network.

Full explanation →

22

MCQmedium

You are designing an API security layer for a public-facing web application. Which security control is most effective against 'Broken Function Level Authorization' (BFLA) attacks?

A.Rate limiting

B.Blocking traffic from known malicious IP addresses

C.Strict RBAC/ABAC authorization checks on every function

D.Encrypting all traffic with TLS 1.3

AnswerC

BFLA occurs when an authenticated user invokes functions above their privilege level. Enforcing RBAC or ABAC checks on every function verifies the caller's role or attributes against each endpoint's required permission, blocking unauthorised function invocation regardless of valid authentication tokens.

Why this answer

BFLA occurs when an API endpoint enforces authentication but fails to verify whether the authenticated user is authorized to invoke that specific function (e.g., a regular user calling an admin-only endpoint). The only control that directly addresses this is enforcing strict role- or attribute-based authorization checks on every function invocation, so that each request is validated against the caller's permissions regardless of how the endpoint is reached. Rate limiting, IP blocking, and TLS encryption do not evaluate user privilege, so they cannot stop a legitimate low-privilege user from invoking a high-privilege function.

Exam trap

SDSI often tests the distinction between authentication, authorization, and transport security, so candidates pick TLS or rate limiting thinking 'security control' generically rather than mapping the control to the specific BFLA weakness.

How to eliminate wrong answers

Option A is wrong because rate limiting only throttles request volume and does nothing to verify whether the caller is authorized to execute the targeted function. Option B is wrong because IP blocklists target known-bad sources, but BFLA attacks typically originate from authenticated, legitimate clients using valid credentials from trusted IPs. Option D is wrong because TLS 1.3 only protects data in transit from eavesdropping and tampering; it has no concept of function-level permissions and cannot prevent an authorized-but-underprivileged user from calling a restricted endpoint.

Full explanation →

23

MCQhard

When designing an API security strategy using Cisco API Security, how should you address APIs that are currently using legacy authentication?

A.Force the legacy backend to support modern OAuth

B.Block all access to legacy APIs immediately

C.Use an API gateway to terminate modern authentication and proxy to the legacy backend

D.Ignore the legacy APIs as they are 'trusted'

AnswerC

The API gateway terminates modern authentication (for example OAuth 2.0 or mutual TLS) at the edge, then proxies requests to the legacy backend using its existing authentication. This isolates legacy protocols from clients while enforcing current identity controls.

Why this answer

The correct approach is to use an API gateway to terminate modern authentication (e.g., OAuth 2.0, OpenID Connect) and then proxy requests to the legacy backend, which may still use basic auth, API keys, or other legacy methods. This allows you to enforce strong authentication at the edge without modifying the legacy backend, which is often impractical or impossible. Cisco API Security solutions, such as those integrated with Cisco API Gateway, support this pattern by handling token validation, scopes, and policies before forwarding traffic.

This decouples security from the legacy system and provides a migration path.

Exam trap

SDSI often tests the misconception that legacy systems must be modified to support modern authentication, or that they can be ignored if deemed 'trusted'; the trap is overlooking the API gateway as a translation layer that bridges modern and legacy auth.

How to eliminate wrong answers

Option A is wrong because forcing the legacy backend to support modern OAuth is often infeasible due to technical debt, lack of vendor support, or risk of breaking existing integrations. Option B is wrong because blocking all access immediately would disrupt business operations and is not a practical security strategy; a phased approach is preferred. Option D is wrong because ignoring legacy APIs as 'trusted' is a dangerous assumption—legacy authentication is often weak and a prime target for attackers, so they must be secured.

Full explanation →

24

MCQmedium

What is the benefit of using 'Identity-Based' microsegmentation in Cisco Secure Workload?

A.It requires less initial configuration

B.It relies on hard-coded firewall rules

C.It provides stable policies that persist through workload moves and scaling

D.It is only compatible with physical servers

AnswerC

Identity-based microsegmentation labels workloads by logical attributes such as role or environment rather than IP addresses, so policies remain valid when workloads move, scale or change address. This directly satisfies the stem's benefit: stable, persistent policy enforcement across dynamic Cisco Secure Workload environments without constant rule rewrites.

Why this answer

Identity-based microsegmentation in Cisco Secure Workload uses workload identity (labels, tags, process attributes) rather than IP addresses to define policy. Because policies are anchored to identity, they remain valid even when workloads move, scale, or change IPs — providing stable, portable policy across dynamic environments. This is the key benefit over IP-based rules.

Exam trap

SDSI often tests the contrast between identity-based and IP-based policy, and candidates who think identity-based means 'less configuration' or 'only physical servers' miss that its real value is policy stability across dynamic workload changes.

How to eliminate wrong answers

Option A is wrong because identity-based segmentation typically requires more initial configuration (labeling, agent deployment, policy discovery) than simple IP rules, not less. Option B is wrong because hard-coded firewall rules are the opposite of identity-based policy — they are static, IP-based, and brittle, which is what identity-based segmentation replaces. Option D is wrong because Cisco Secure Workload supports physical servers, virtual machines, and containers; identity-based segmentation is not limited to physical servers.

Full explanation →

25

MCQhard

When designing security for a cloud-native architecture, why is it better to use an identity-based model instead of a network-based model for microsegmentation?

A.Because it is easier to implement IP-based rules

B.Because identity is always known to the network hardware

C.Because it doesn't require any policy configuration

D.Because identity is persistent while IP addresses are volatile

AnswerD

Identity-based microsegmentation satisfies the cloud-native constraint of dynamic workloads, where containers and VMs constantly acquire new IP addresses. Microsoft Entra ID identities persist across those lifecycle changes, so policy follows the workload rather than a transient address. Network-based rules tied to IPs break on every redeployment or autoscale event.

Why this answer

In cloud-native environments, workload IP addresses are ephemeral — containers and pods are constantly created, destroyed, and rescheduled, so IP-based policies quickly become stale and either over-permit or break legitimate traffic. Identity (service account, SPIFFE ID, labels, or workload identity) persists across IP changes and is therefore the stable anchor for microsegmentation policy. This is the foundational reason identity-based segmentation is preferred.

Exam trap

The trap is picking the 'easier to implement' or 'hardware knows identity' answer because it sounds operationally simple — the exam wants you to recognize that IP volatility in cloud-native environments is the technical reason identity-based policy is superior.

How to eliminate wrong answers

Option A is wrong because IP-based rules are actually harder to maintain in dynamic environments, not easier — the question asks why identity is better, and this option inverts the reasoning. Option B is wrong because network hardware does not inherently know workload identity; identity must be established via agents, service mesh, or control-plane integration, so this statement is factually incorrect. Option C is wrong because identity-based microsegmentation absolutely requires policy configuration — it is not configuration-free; it simply uses identity as the policy selector instead of IP.

Full explanation →

26

MCQmedium

You are designing security for a multi-tier application. Why is it recommended to use a Service Mesh to manage the identity of microservices?

A.To simplify the management of IP addresses

B.To replace the need for firewalls

C.To increase the network throughput

D.To provide cryptographically verifiable workload identity

AnswerD

A service mesh issues each microservice a SPIFFE-style identity backed by mutual TLS certificates, so workloads authenticate cryptographically rather than trusting network location. This satisfies the multi-tier design requirement by removing implicit trust between tiers.

Why this answer

A service mesh provides each microservice with a cryptographically verifiable identity, typically through mutual TLS (mTLS) certificates issued by a built-in certificate authority (CA). This identity is based on the service's attributes (e.g., Kubernetes service account) rather than its IP address, enabling strong authentication and authorization between services. This is essential for zero-trust security in dynamic environments where IPs change frequently.

Exam trap

SDSI often tests the misconception that service meshes are primarily for network performance or IP management, when their core security value is cryptographically verifiable identity and mTLS.

How to eliminate wrong answers

Option A is wrong because service meshes abstract away IP addresses by using service discovery and identity-based routing, but simplifying IP management is not the primary security goal. Option B is wrong because service meshes complement firewalls by providing identity-based policies, but they do not replace firewalls; network firewalls still control traffic at the perimeter. Option C is wrong because service meshes add overhead for encryption and policy enforcement, often reducing throughput slightly, not increasing it.

Full explanation →

27

MCQeasy

What is the primary role of a 'Security Policy Engine' (e.g., Cisco Secure Firewall) within an automated data center architecture?

A.Application load balancing

B.Centralized policy enforcement

C.Server virtualization

D.DNS resolution

AnswerB

A centralised engine defines and distributes policy to every enforcement point, so segmentation and inspection rules stay uniform across the data centre. This satisfies the automated architecture's requirement for consistent, scalable control rather than per-device manual configuration.

Why this answer

A Security Policy Engine (such as Cisco Secure Firewall) in an automated data center architecture is responsible for centralized policy enforcement — it applies security rules, intrusion prevention, and access control consistently across the environment. It acts as a policy decision and enforcement point, ensuring that traffic is inspected and allowed or denied based on centrally managed policies.

Exam trap

SDSI often tests the role of security components by mixing in unrelated functions like load balancing or DNS, hoping candidates confuse the security policy engine with other data center services.

How to eliminate wrong answers

Option A is wrong because application load balancing is handled by load balancers (e.g., F5, Citrix NetScaler, or Cisco ACI load balancing), not by a security policy engine. Option C is wrong because server virtualization is provided by hypervisors (VMware ESXi, KVM, Hyper-V) and orchestration platforms, not by a firewall. Option D is wrong because DNS resolution is a network service provided by DNS servers (e.g., Infoblox, Windows DNS, BIND), not by a security policy engine.

Full explanation →

28

MCQhard

For a high-availability firewall architecture, which design element is critical when utilizing a routed-mode configuration in a data center?

A.Configuring HSRP between firewall interfaces.

B.Implementing OSPF equal-cost multi-path (ECMP) for load balancing.

C.Using a virtual MAC address per interface.

D.Utilizing a dedicated stateful failover link between firewalls.

AnswerD

A dedicated stateful failover link synchronises session tables and NAT translations between peers, so the standby firewall already holds the connection state needed to forward traffic immediately after failover. This satisfies the high-availability requirement in routed mode, where asymmetric routing and dropped sessions would otherwise occur during transition.

Why this answer

In a routed-mode high-availability firewall pair, each firewall maintains its own routing table and forwards based on Layer 3, so the two units must synchronize connection state to survive a failover without dropping established sessions. A dedicated stateful failover link carries that state (session tables, NAT translations, VPN state) between the peers. Without it, traffic that was mid-session would be dropped when the standby takes over.

Exam trap

SDSI often tests the distinction between first-hop redundancy (HSRP/VRRP), routing protocols (OSPF/ECMP), and true stateful failover, so the trap is selecting a routing or L2 mechanism that sounds like HA but does not carry session state.

How to eliminate wrong answers

Option A is wrong because HSRP is a first-hop redundancy protocol for routers/hosts, not the mechanism that synchronizes firewall connection state; it can complement HA but does not provide stateful failover. Option B is wrong because OSPF ECMP is a routing/load-balancing technique and does not itself preserve session state across a firewall failover. Option C is wrong because a virtual MAC address per interface is characteristic of transparent (Layer 2) firewall failover, not the critical element for routed-mode stateful HA.

Full explanation →

29

MCQeasy

What is the primary purpose of conducting a risk assessment as part of the security design process?

A.To identify and prioritize security controls based on threat and vulnerability data.

B.To automate the patching of all network servers.

C.To ensure compliance with local labor laws.

D.To select the cheapest security hardware.

AnswerA

Risk assessment maps threats and vulnerabilities against assets, producing prioritised findings that direct where security controls are applied. This satisfies the design goal of identifying and prioritising controls based on threat and vulnerability data rather than deploying controls arbitrarily.

Why this answer

A risk assessment identifies threats, vulnerabilities, and potential impacts, then prioritizes them so that security controls can be selected and funded based on actual risk rather than guesswork. This ensures the design addresses the most significant risks first and justifies control selection to stakeholders.

Exam trap

The trap is selecting an operational or cost-focused answer (patching, cheapest hardware) instead of recognizing that risk assessment is about identifying and prioritizing controls based on threat and vulnerability data.

How to eliminate wrong answers

Option B is wrong because patching automation is an operational vulnerability-management activity, not the purpose of a risk assessment — the assessment may inform patching priorities but does not automate patching. Option C is wrong because labor law compliance is unrelated to security risk assessment; it falls under HR and legal compliance, not security design. Option D is wrong because selecting the cheapest hardware is a cost decision, not a risk-based decision — risk assessment may justify spending more on controls for high-risk areas, not less.

Full explanation →

30

MCQhard

You are designing a secure API gateway architecture using Cisco API Connectivity (part of the Cisco AppDynamics/Cisco Networking stack). To protect against OWASP Top 10 threats, which specific feature should be enabled on the API Gateway to validate request payloads?

A.Configure JSON/XML schema validation policies based on the imported OpenAPI specification.

B.Enable Basic Authentication for all API endpoints.

C.Deploy a WAF rule to block all traffic from unknown IP addresses.

D.null

E.Enable rate limiting on the gateway to prevent DoS attacks.

AnswerA

Importing the OpenAPI specification gives the gateway a machine-readable contract, so JSON or XML schema validation policies reject payloads that deviate from defined structure, types, or required fields. This directly mitigates injection and malformed-input threats among the OWASP Top 10.

Why this answer

JSON/XML schema validation policies derived from the imported OpenAPI specification allow the API gateway to reject requests whose payloads do not conform to the contract, which directly mitigates OWASP API threats such as injection, mass assignment, and malformed input. Because the schema is generated from the OpenAPI document, the gateway enforces the exact structure, types, and constraints the API expects, blocking malformed or malicious payloads before they reach the backend. This is the payload-level validation control specifically designed for API security.

Exam trap

The trap is reaching for a WAF or rate limiting as the default 'security' answer — the question specifically asks about validating request payloads, which is schema validation, not network filtering or volume control.

How to eliminate wrong answers

Option B is wrong because Basic Authentication only verifies credentials in a base64-encoded header — it does not inspect or validate request payloads, and it is itself a weak authentication mechanism that does not address OWASP Top 10 injection or validation threats. Option C is wrong because blocking unknown IPs is a network-layer access control that does nothing to validate the content of requests from allowed sources; attackers routinely originate from trusted IP ranges. Option E is wrong because rate limiting addresses availability (DoS) by capping request volume, but it does not inspect payload structure or content, so it cannot prevent injection or malformed-data attacks.

Full explanation →

31

Multi-Selecthard

Which THREE Cisco solutions support the 'Secure Work from Anywhere' concept?

Select 3 answers

A.Cisco Secure Client (AnyConnect).

B.Cisco Duo.

C.Physical desk phone only.

D.Manual VPN configuration files.

E.Cisco Umbrella.

AnswersA, B, E

Cisco Secure Client (AnyConnect) provides the encrypted VPN tunnel and endpoint posture, giving remote users protected connectivity to corporate resources from any location. It is the foundational remote-access component of the Secure Work from Anywhere architecture.

Why this answer

Cisco Secure Client (AnyConnect) is correct because it provides the endpoint VPN and security agent that lets remote users establish encrypted connectivity to corporate resources from any location. Cisco Duo is correct because its zero-trust, multi-factor authentication and device-trust capabilities verify user and device identity before granting access to applications, which is central to securing a distributed workforce. Cisco Umbrella is correct because its DNS-layer security and secure web gateway protect off-network users from malicious domains and enforce acceptable-use policies regardless of where they connect.

Physical desk phone only does not belong because it is a location-bound device that cannot enable secure remote work. Manual VPN configuration files also do not belong because they are a static, error-prone configuration method rather than a managed Cisco solution supporting secure work from anywhere.

Exam trap

SDSI often tests whether candidates confuse point products with the integrated stack — the trap is selecting legacy or manual approaches (config files, desk phones) that sound plausible but do not deliver automated zero-trust remote access.

Full explanation →

32

MCQeasy

A design requirements gathering phase identifies that users frequently access untrusted SaaS applications. Which Cisco solution should be included to mitigate data exfiltration risks?

A.Cisco Secure Firewall with IPS enabled.

B.Cisco Umbrella with CASB capability enabled.

C.Cisco AnyConnect VPN.

D.Cisco Identity Services Engine (ISE).

AnswerB

Umbrella's CASB capability provides inline visibility and control over sanctioned and unsanctioned SaaS traffic, applying data-loss prevention policies to block uploads of sensitive data. This directly addresses the untrusted-SaaS exfiltration risk identified during requirements gathering.

Why this answer

Cisco Umbrella with CASB capability enabled provides visibility and control over SaaS application usage, including the ability to detect and block unsanctioned apps, enforce DLP policies, and mitigate data exfiltration risks. It is specifically designed to secure cloud access and protect data in SaaS environments.

Exam trap

The trap is selecting a traditional network security tool (firewall, VPN, ISE) for a SaaS data exfiltration problem; candidates must recognize that CASB capabilities, like those in Umbrella, are specifically designed for SaaS visibility and control.

How to eliminate wrong answers

Option A is wrong because Cisco Secure Firewall with IPS focuses on network intrusion prevention and does not provide the granular SaaS application visibility and data-level controls needed for untrusted SaaS. Option C is wrong because Cisco AnyConnect VPN provides secure remote access but does not inspect or control SaaS application usage or data exfiltration. Option D is wrong because Cisco ISE is for identity and access control for network devices, not for monitoring or securing SaaS application data.

Full explanation →

33

Multi-Selecthard

When designing for cloud-native API security, which TWO components are critical for ensuring visibility into API traffic? (Choose TWO)

Select 2 answers

A.Manual inspection of firewall rules

B.Disabling TLS for easier traffic analysis

C.API Gateway access logs

D.Physical network tap at the data center core

E.Traffic telemetry from the service mesh sidecars

AnswersC, E

API Gateway access logs record every request — caller identity, endpoint, response code, latency — providing the authoritative request-level audit trail. Without these logs, individual API calls and their outcomes remain invisible to security monitoring.

Why this answer

Option C (API Gateway access logs) is correct because the API gateway is the ingress point for all API calls, and its access logs capture per-request metadata such as client IP, request path, HTTP method, status code, latency, and API key usage, providing the authoritative audit trail needed for API visibility in cloud-native environments. Option E (Traffic telemetry from the service mesh sidecars) is correct because sidecar proxies (e.g., Envoy in Istio/Linkerd) intercept east-west service-to-service traffic and emit metrics, distributed traces, and L7 request telemetry (via OpenTelemetry, Prometheus, or access logs) that reveal internal API calls the gateway never sees. Option A is wrong because manually reading firewall rules only shows static allow/deny policy, not actual API request behavior or payload-level activity.

Option B is wrong because disabling TLS exposes data in transit and violates security best practices; visibility should come from TLS-terminating proxies and observability tooling, not from weakening encryption. Option D is wrong because a physical network tap at the data center core cannot inspect encrypted east-west traffic and is impractical for dynamic, ephemeral cloud-native workloads.

Exam trap

SDSI often tests whether candidates understand that cloud-native visibility comes from application-layer instrumentation (gateway logs, mesh telemetry), not from physical taps or firewall rule reviews — the trap is picking legacy network-centric visibility methods.

Full explanation →

34

MCQeasy

A retail company is designing a DevSecOps pipeline that uses Cisco Secure Workload to enforce micro-segmentation for its containerized applications. The security team wants to automatically generate and apply micro-segmentation policies based on application behavior observed in the CI/CD environment. Which Cisco Secure Workload capability should be leveraged to achieve this automation?

A.Cisco Secure Workload Flow Analytics with manual policy export

B.Cisco Secure Workload Enforcement Agent with scripted policy deployment

C.Cisco Secure Workload Policy Lifecycle Management with automatic policy generation

D.Cisco Secure Workload API with third-party orchestration tools

AnswerC

Cisco Secure Workload's Policy Lifecycle Management includes automatic policy generation that analyzes observed traffic and workload behavior to recommend micro-segmentation policies. By integrating this capability into the CI/CD pipeline, the team can automatically create and apply policies that reflect the application's communication patterns, ensuring dynamic and accurate segmentation without manual rule writing.

Why this answer

Cisco Secure Workload's Policy Lifecycle Management automates the creation of micro-segmentation policies by analyzing actual workload communications. This capability is designed to continuously discover and recommend policies, which can be automatically applied via integration with CI/CD tools. It directly addresses the need for automated, behavior-based policy generation, reducing manual effort and ensuring policies stay current with application changes.

Exam trap

The trap here is assuming that flow visibility or enforcement agents alone can generate policies, when policy generation is a distinct capability within Policy Lifecycle Management.

Full explanation →

35

MCQhard

A security architect is designing an incident response workflow. Which action in the Cisco Secure Endpoint console would be most appropriate to perform if a 'Host Isolation' request fails during an active threat containment?

A.Clear the event logs in FMC

B.Reboot the Cisco Secure Endpoint server

C.Quarantine the host via Cisco ISE

D.Deploy a new firewall policy

AnswerC

When Host Isolation fails, quarantining the endpoint through Cisco ISE applies network-level access control, blocking the compromised host from communicating while remediation proceeds. This contains the active threat despite the failed endpoint-level isolation, maintaining containment without disrupting other devices.

Why this answer

When Host Isolation in Cisco Secure Endpoint fails, the endpoint remains on the network and the threat is still active, so the architect needs an alternative enforcement point. Cisco ISE can apply a quarantine or remediation authorization profile via 802.1X, MACsec, or TrustSec to restrict the endpoint's network access at the switch or wireless controller. This provides a network-layer containment fallback that does not depend on the endpoint agent's isolation capability.

Exam trap

SDSI often tests the assumption that endpoint isolation is the only containment tool, when the correct answer requires recognising that network access control (ISE) provides an independent fallback enforcement point.

How to eliminate wrong answers

Option A is wrong because clearing event logs in FMC destroys forensic evidence and does nothing to contain the threat; FMC is also a firewall management plane, not an endpoint containment tool. Option B is wrong because rebooting the Secure Endpoint server is a disruptive infrastructure action that would not isolate the compromised host and could interrupt protection for the entire estate. Option D is wrong because deploying a new firewall policy is a broad, slow change that does not target the specific compromised endpoint and would not reliably stop east-west or outbound traffic from that host.

Full explanation →

36

MCQmedium

Which Cisco product allows administrators to manage security policies across a multi-vendor firewall environment?

A.Cisco SecureX.

B.Cisco Defense Orchestrator (CDO).

C.Cisco ISE.

D.Cisco Firepower Management Center (FMC).

AnswerB

Cisco Defense Orchestrator provides cloud-delivered, centralised policy management across multi-vendor firewalls, including Cisco, Check Point, Palo Alto Networks and Fortinet. It normalises policies into a single interface, satisfying the stem's multi-vendor constraint directly, unlike single-platform tools such as Cisco Firepower Management Center or Cisco Secure Firewall.

Why this answer

Cisco Defense Orchestrator (CDO) is a cloud-based management platform designed to orchestrate security policy across multi-vendor firewalls (Cisco ASA, FTD, Meraki, and third-party devices). It provides a single console for policy consistency, object management, and device onboarding across heterogeneous environments. FMC is Firepower-only, ISE is identity/NAC, and SecureX is an integration/automation fabric, not a multi-vendor firewall policy manager.

Exam trap

The trap is assuming FMC is the universal firewall manager; the exam distinguishes Firepower-only (FMC) from multi-vendor (CDO), and candidates often pick FMC out of familiarity.

How to eliminate wrong answers

Option A is wrong because Cisco SecureX is a cloud-based integration and automation platform that unifies visibility across Cisco security products; it does not manage firewall policy across vendors. Option C is wrong because Cisco ISE is an identity and access control platform (NAC, 802.1X, TrustSec), not a firewall policy manager. Option D is wrong because Cisco Firepower Management Center (FMC) manages only Cisco Firepower/FTD devices, not multi-vendor firewalls.

Full explanation →

37

MCQmedium

A design team is integrating Cisco Secure Firewall with an existing SIEM. Which telemetry export format is best for comprehensive security analysis?

A.NetFlow

B.SNMP

C.eStreamer

D.ICMP

AnswerC

eStreamer streams raw event data directly from the firewall's detection engine to a SIEM, covering connection, intrusion, file and malware events. Unlike syslog, which is limited and lossy, it delivers the comprehensive telemetry the SIEM requires for correlation and threat analysis.

Why this answer

eStreamer is Cisco's dedicated telemetry export protocol for Cisco Secure Firewall (formerly Firepower) that streams detailed event data—including connection, intrusion, file, malware, and Security Intelligence events—directly to a SIEM or external analysis tool. Unlike flow-only protocols, eStreamer delivers rich, contextual security events needed for comprehensive threat analysis and correlation.

Exam trap

SDSI often tests the confusion between flow-export protocols (NetFlow/IPFIX) and full event-export protocols (eStreamer), tricking candidates who assume any telemetry format works for SIEM integration.

How to eliminate wrong answers

Option A is wrong because NetFlow exports only Layer 3/Layer 4 flow metadata (IPs, ports, byte counts) and lacks the deep inspection data, IPS verdicts, and file/malware events required for comprehensive security analysis. Option B is wrong because SNMP is a management protocol for polling device health metrics (CPU, interface status, counters), not for exporting security event telemetry. Option D is wrong because ICMP is a diagnostic/error-reporting protocol (ping, unreachable messages) and has no role in exporting firewall telemetry to a SIEM.

Full explanation →

38

Multi-Selectmedium

Which TWO features assist in protecting the network control plane against DoS attacks?

Select 2 answers

A.Configuring static routing only.

B.Increasing interface speed.

C.Disabling all physical interfaces.

D.Control Plane Policing (CoPP).

E.Control Plane Protection (CPPr).

AnswersD, E

Control Plane Policing rate-limits traffic destined to the route processor, filtering malicious floods before they reach the CPU. This directly satisfies the stem's requirement to protect the control plane, since CoPP preserves routing protocol stability and device availability during a DoS attack by dropping excess punted packets.

Why this answer

Control Plane Policing (CoPP), option D, is correct because it applies a QoS policy to the control plane to rate-limit and filter traffic destined to the router's CPU, protecting routing protocols and management services from DoS floods. Control Plane Protection (CPPr), option E, is correct because it extends CoPP by dividing the control plane into host, transit, and CEF-exception subinterfaces, allowing granular policing of specific traffic types such as ICMP or routing protocol packets. Static routing only (A) does not defend against DoS; it merely removes dynamic routing updates and can even reduce resilience.

Increasing interface speed (B) increases bandwidth but does nothing to stop CPU-targeted floods. Disabling all physical interfaces (C) would halt all traffic, including legitimate traffic, so it is not a viable protection mechanism.

Exam trap

SDSI often tests the confusion between data-plane and control-plane protections, tricking candidates into choosing interface-level or routing changes instead of dedicated control-plane policing features.

Full explanation →

39

MCQhard

In a Cisco Secure Firewall architecture, what is the purpose of the 'Intrusion Policy'?

A.To optimize routing paths.

B.To handle VPN authentication.

C.To identify and block malicious traffic based on pattern matching.

D.To manage firewall NAT rules.

AnswerC

An Intrusion Policy applies signature and heuristic pattern matching to inspected traffic, detecting and dropping known malicious flows. This satisfies the requirement to identify and block threats beyond static access rules, complementing the access control policy that handles permitted traffic.

Why this answer

An Intrusion Policy in Cisco Secure Firewall defines the set of intrusion detection/prevention rules (Snort rules) that inspect traffic for malicious patterns and, when configured in prevention mode, block matching traffic. It is the mechanism that identifies and blocks malicious traffic based on signature/pattern matching. It does not handle routing, VPN authentication, or NAT.

Exam trap

The trap is confusing intrusion policy with other FTD policy types (NAT, VPN, routing); candidates must remember that intrusion policy is specifically the Snort-based detection/prevention ruleset.

How to eliminate wrong answers

Option A is wrong because routing path optimization is a network routing function (e.g., OSPF, BGP, ECMP), not an intrusion policy. Option B is wrong because VPN authentication is handled by VPN configuration and identity services (IKEv2, certificates, AAA), not by intrusion policies. Option D is wrong because NAT rules are configured in the NAT policy, a separate policy type on FMC/FTD, not in the intrusion policy.

Full explanation →

40

MCQhard

A risk assessment reveals that internal servers are vulnerable to unauthorized access via SMB protocols. Which Cisco feature should be implemented on the internal switching infrastructure to mitigate this risk?

A.ACLs on the core switch.

B.Cisco Secure Endpoint scan.

C.Cisco TrustSec (SGTs).

D.Cisco Umbrella local policy.

AnswerC

Cisco TrustSec assigns Security Group Tags to endpoints and enforces group-based access control within the switching fabric, so SMB traffic from unauthorised segments is blocked regardless of IP addressing, directly mitigating the unauthorised SMB access risk identified.

Why this answer

Cisco TrustSec uses Security Group Tags (SGTs) to enforce role-based access control within the switching infrastructure, allowing segmentation and policy enforcement based on identity/role rather than IP addresses. By tagging SMB traffic and applying SGACLs, unauthorized access to internal servers via SMB can be blocked at the switch level. This is the appropriate internal segmentation control for the described risk.

Exam trap

The trap is choosing a familiar but less appropriate control (ACLs on core switch) over the identity-aware segmentation feature (TrustSec/SGTs) that the exam expects for internal SMB risk mitigation.

How to eliminate wrong answers

Option A is wrong because ACLs on the core switch are static, IP-based, and do not scale well for dynamic role-based segmentation; while they can block SMB, TrustSec provides the identity-aware, scalable mitigation expected in a secure architecture design. Option B is wrong because Cisco Secure Endpoint scan is an endpoint-level malware scan, not a network segmentation control for SMB access. Option D is wrong because Cisco Umbrella local policy is DNS-layer security and does not enforce SMB access control on internal switching infrastructure.

Full explanation →

41

MCQeasy

A security architect is designing a Cisco Secure Firewall deployment for a multi-cloud environment. Which design approach provides the most consistent security policy enforcement across AWS and Azure?

A.Deploy individual local managers for each cloud provider.

B.Rely on native cloud-native security groups only.

C.Implement separate FTD instances with unique local access control lists.

D.Utilize Cisco Defense Orchestrator for centralized policy management.

AnswerD

Cisco Defense Orchestrator centrally manages policies across multiple firewall platforms and cloud environments, pushing a single consistent policy to AWS and Azure deployments. This avoids per-cloud configuration drift, satisfying the requirement for uniform enforcement across both providers.

Why this answer

Cisco Defense Orchestrator (CDO) provides centralized, cloud-delivered management of Cisco Secure Firewall (FTD) policies across multiple environments, including AWS and Azure. By managing all firewalls from a single pane, CDO ensures consistent access control, intrusion prevention, and URL filtering policies regardless of which cloud the firewall instance runs in.

Exam trap

SDSI often tests the difference between centralized management (CDO) and distributed/local management, tempting candidates with options about local managers or cloud-native security groups that do not deliver consistent Cisco policy enforcement.

How to eliminate wrong answers

Option A is wrong because individual local managers per cloud create policy silos and inconsistency, which is the opposite of the goal. Option B is wrong because native cloud security groups only control cloud-level network access and do not provide consistent Cisco firewall policy enforcement across AWS and Azure. Option C is wrong because separate FTD instances with unique local ACLs produce divergent policies and operational overhead, not consistency.

Full explanation →

42

MCQhard

When automating security with Cisco XDR, which component allows for the execution of arbitrary scripts on third-party security tools?

A.Cisco XDR Workflow Engine

B.Cisco XDR Threat Intel module

C.Cisco XDR Telemetry API

D.Cisco XDR Dashboard

AnswerA

The Workflow Engine orchestrates automation by invoking external tools through their APIs, letting analysts run arbitrary scripts on third-party security products. This satisfies the stem's requirement for script execution across integrated tools, rather than merely correlating telemetry or visualising incidents.

Why this answer

The Cisco XDR Workflow Engine allows for the execution of arbitrary scripts and actions on third-party security tools by orchestrating automated response workflows. It connects to integrated tools via APIs and runs playbooks that can invoke scripts, isolate endpoints, block IPs, or create tickets. This is the automation and orchestration layer of Cisco XDR.

Exam trap

SDSI often tests the distinction between XDR modules — candidates confuse the Workflow Engine (execution/orchestration) with Threat Intel (data enrichment) or Telemetry API (data ingestion), missing that only the Workflow Engine performs actions on third-party tools.

How to eliminate wrong answers

Option B is wrong because the Threat Intel module aggregates and correlates threat intelligence feeds; it informs decisions but does not execute scripts on third-party tools. Option C is wrong because the Telemetry API is for ingesting and querying telemetry data from various sources, not for executing actions. Option D is wrong because the Dashboard is a visualization and reporting interface, not an execution engine.

Full explanation →

43

MCQhard

When designing an automated remediation workflow for Cisco Secure Firewall, what is the specific function of the 'Cisco Secure Firewall REST API' in the context of threat intelligence feeds?

A.Encryption key rotation

B.Automated firmware flashing

C.Traffic scrubbing

D.Dynamic update of Network Objects

AnswerD

The REST API dynamically updates Network Objects, letting the remediation workflow push newly identified malicious IP addresses and FQDNs directly into policy objects without manual intervention. This satisfies the stem's automation constraint, enabling threat intelligence feeds to trigger immediate enforcement on Cisco Secure Firewall through programmatic object modification rather than static rule edits.

Why this answer

The Cisco Secure Firewall REST API enables programmatic creation, update, and deletion of Network Objects (such as IP addresses, ranges, and FQDN objects) that are used in access control policies. In an automated remediation workflow, threat intelligence feeds can push malicious IPs to these Network Objects via the API, and the firewall policy referencing those objects is updated dynamically without manual intervention. This is the specific function relevant to threat intelligence feed integration.

Exam trap

SDSI often tests the specific API capability for threat feed integration, so the trap is choosing a generic security operation like encryption or firmware management instead of the actual object update function.

How to eliminate wrong answers

Option A is wrong because encryption key rotation is a cryptographic management task handled by the firewall's certificate and VPN configuration, not by the REST API for threat feed integration. Option B is wrong because automated firmware flashing is not a function of the REST API; firmware upgrades are handled through management platforms like FMC or CDO. Option C is wrong because traffic scrubbing is a DDoS mitigation function typically performed by upstream scrubbing centers, not by the firewall REST API.

Full explanation →

44

Multi-Selectmedium

Which THREE components are part of the Cisco Secure Firewall architecture? (Select 3)

Select 3 answers

A.Firepower Appliance

B.Cisco ISE

C.Firepower Management Center (FMC)

D.Firepower Threat Defense (FTD)

E.Cisco Stealthwatch

AnswersA, C, D

The Firepower appliance is the enforcement node of the Cisco Secure Firewall architecture, hosting the threat inspection engines that process traffic. Management and event analysis are handled by separate components, so the appliance supplies the data-plane function.

Why this answer

The Cisco Secure Firewall architecture is built around three core components: the Firepower Appliance (A), which is the physical or virtual hardware platform that runs the firewall software; the Firepower Management Center (FMC) (C), which provides centralized configuration, policy management, event analysis, and reporting across managed devices; and Firepower Threat Defense (FTD) (D), which is the unified software image combining firewall, IPS, AMP, and URL filtering capabilities on the appliance. These three together form the appliance, the management plane, and the software threat-defense layer of the architecture. Cisco ISE (B) is a separate identity and access-control (NAC/AAA) product, and Cisco Stealthwatch (E) is a separate network traffic analysis and flow-monitoring solution; neither is a component of the Secure Firewall architecture itself.

Exam trap

SDSI often tests whether candidates can distinguish core firewall architecture components from adjacent Cisco security products like ISE and Stealthwatch that integrate with but are not part of the Secure Firewall stack.

Full explanation →

45

MCQeasy

Which Cisco product is specifically designed to provide visibility into encrypted traffic without the need for manual decryption?

A.Cisco Encrypted Traffic Analytics (ETA).

B.Cisco Identity Services Engine (ISE).

C.Cisco Stealthwatch.

D.Cisco Firepower IPS.

AnswerA

Cisco Encrypted Traffic Analytics (ETA) satisfies the visibility-without-decryption constraint by analysing packet metadata and initial handshake fields, using machine learning to detect malware in encrypted flows. It identifies threats in TLS traffic without requiring decryption keys or breaking encryption, unlike solutions needing SSL inspection.

Why this answer

Cisco Encrypted Traffic Analytics (ETA) uses machine learning and network telemetry to identify malware in encrypted traffic without decrypting it. It analyzes flow metadata and sequence of packet lengths and times (SPLT) to detect threats, preserving privacy and reducing complexity. This is specifically designed for visibility into encrypted traffic.

Exam trap

SDSI often tests the distinction between tools that require decryption (Firepower IPS) and those that analyze encrypted traffic without decryption (ETA); candidates may confuse ETA with Stealthwatch or Firepower.

How to eliminate wrong answers

Option B is wrong because Cisco ISE is for identity and access control, not traffic analysis. Option C is wrong because Cisco Stealthwatch provides network visibility and behavioral analysis but does not specifically analyze encrypted traffic without decryption; it may rely on ETA for that. Option D is wrong because Cisco Firepower IPS can decrypt traffic for inspection but requires manual decryption configuration and does not provide visibility without decryption.

Full explanation →

46

Multi-Selecthard

Which THREE of the following are key AI/ML design considerations when selecting a security automation platform?

Select 3 answers

A.Number of employees on the vendor's team

B.Explainability and transparency (XAI)

C.API integration and extensibility

D.Local hardware GPU acceleration

E.Data quality and labeling

AnswersB, C, E

Explainability and transparency (XAI) satisfies the requirement that automated security decisions remain auditable and defensible. Security teams must understand why a model flagged an event, so XAI techniques such as feature attribution and surrogate models expose the reasoning behind each verdict, enabling analyst review, regulatory compliance and bias detection.

Why this answer

Option B (Explainability and transparency, XAI) is correct because security automation platforms increasingly rely on AI/ML models to triage alerts and make risk decisions, so analysts and auditors must be able to understand why a model produced a given verdict to trust, validate, and defend it. Option C (API integration and extensibility) is correct because a security automation platform must interoperate with SIEM, SOAR, EDR, ticketing, and threat-intel systems via REST APIs, webhooks, and plugins, so its ability to integrate and be extended determines how well the AI/ML capabilities fit existing workflows. Option E (Data quality and labeling) is correct because ML model accuracy in security use cases depends directly on well-curated, correctly labeled, and representative training data (e.g., labeled true/false positives), and poor data quality leads to high false-positive rates and unreliable automation.

Option A is not a key AI/ML design consideration because vendor team headcount does not determine model explainability, integration capability, or data quality. Option D is not a key AI/ML design consideration for platform selection because local GPU acceleration is an infrastructure/deployment detail, not a core AI/ML design factor, and many platforms deliver inference via cloud or vendor-managed services.

Full explanation →

47

MCQeasy

When designing security for SaaS applications, what is the primary benefit of an API-based CASB like Cisco Cloudlock over a proxy-based CASB?

A.Proxy-based is cheaper

B.API-based only works on-premises

C.API-based does not require routing user traffic through the CASB

D.Proxy-based is always faster

AnswerC

API-based CASB connects directly to the SaaS provider's APIs for scanning and policy enforcement, so no inline proxy sits in the data path. This satisfies the requirement for visibility and control without routing user traffic through the CASB, avoiding latency and breakage of non-web protocols.

Why this answer

API-based CASBs like Cisco Cloudlock connect directly to SaaS APIs (e.g., Microsoft 365, Google Workspace, Salesforce) using OAuth, so they can scan data at rest and enforce policies without proxying user traffic. This avoids the latency, certificate, and routing complexity that proxy-based CASBs introduce.

Exam trap

SDSI often tests the inline-vs-out-of-band distinction, so candidates who assume 'CASB must see traffic' pick the proxy option and miss that API-based CASBs work without routing user traffic.

How to eliminate wrong answers

Option A is wrong because cost is not the primary architectural benefit of API-based CASB and is not a reliable differentiator — proxy-based deployments often require more infrastructure. Option B is wrong because API-based CASBs are cloud-delivered and specifically designed for SaaS, not on-premises-only. Option D is wrong because proxy-based CASBs add an inline hop that typically increases latency, so 'always faster' is factually incorrect.

Full explanation →

48

MCQhard

In a multi-cloud design, which protocol is preferred for secure inter-site communication to support micro-segmentation?

A.VXLAN with SGTs.

B.Standard GRE.

C.VLAN tagging.

D.802.1Q.

AnswerA

VXLAN with Security Group Tags carries micro-segmentation metadata directly in the encapsulated frame, so enforcement follows traffic across multi-cloud sites without relying on IP-based rules. This satisfies the stem's inter-site requirement, since group-based policy travels with each packet rather than being tied to a single provider's native fabric.

Why this answer

VXLAN with Security Group Tags (SGTs) is preferred for secure inter-site communication supporting micro-segmentation because it combines scalable Layer 2 overlay transport (VXLAN) with Cisco TrustSec's SGT-based policy enforcement. SGTs are carried in the VXLAN header (Group Policy ID field), allowing consistent security policy across sites and clouds without relying on IP-based rules.

Exam trap

SDSI often tests the confusion between basic tunneling protocols (GRE) and policy-aware overlays (VXLAN with SGTs), tricking candidates who overlook the need for identity-based micro-segmentation across sites.

How to eliminate wrong answers

Option B is wrong because standard GRE is a tunneling protocol that lacks native support for carrying security group metadata like SGTs, so it cannot enforce micro-segmentation policy consistently across sites. Option C is wrong because VLAN tagging is limited to 4094 VLANs, is Layer 2 only, and does not scale across multi-cloud or provide the identity-based policy needed for micro-segmentation. Option D is wrong because 802.1Q is the VLAN tagging standard itself—it operates at Layer 2 within a single administrative domain and cannot extend micro-segmentation policy across sites or clouds.

Full explanation →

49

Multi-Selecthard

When designing microsegmentation policies in Cisco Secure Workload (Tetration) for a multi-tier application, which THREE factors must be considered to ensure traffic flow integrity?

Select 3 answers

A.Application dependency mapping

B.DHCP lease duration

C.Workload inventory classification

D.Infrastructure zone isolation

E.User identity mapping

AnswersA, C, D

Application dependency mapping reveals the actual inter-tier communication flows, ensuring microsegmentation policies permit only legitimate traffic between workloads. Without it, policies risk blocking required east-west connections, violating the traffic flow integrity constraint in the stem. It grounds policy in observed behaviour rather than assumptions.

Why this answer

Application dependency mapping (A) is correct because Cisco Secure Workload (Tetration) builds microsegmentation policy from observed flow telemetry, so you must first map which workloads communicate with which others, on which ports and protocols, to write allow rules that preserve legitimate multi-tier traffic. Workload inventory classification (C) is correct because labeling workloads by role (for example web, app, or database tier), environment, and application scope is what lets Tetration group endpoints into policy scopes and apply consistent, intent-based rules rather than per-IP exceptions. Infrastructure zone isolation (D) is correct because segmentation boundaries such as data center zones, VRF/VLAN segments, and security zones determine which flows are even permitted to cross boundaries, so policies must respect those zones to avoid breaking routing or creating unintended east-west paths.

DHCP lease duration (B) is not a microsegmentation design factor because Tetration policies are based on workload identity and labels rather than transient IP addressing, and user identity mapping (E) is not required for traffic flow integrity in this scenario since the question concerns workload-to-workload policy, not user-based access control.

Exam trap

The trap is selecting plausible-sounding but irrelevant factors like DHCP lease duration or user identity — the exam tests whether you know that microsegmentation is workload-centric and depends on dependency mapping, classification, and zone isolation.

Full explanation →

50

Multi-Selecthard

Which THREE actions are recommended when designing a secure API architecture using Cisco API Security to mitigate OWASP API Top 10 threats? (Choose THREE)

Select 3 answers

A.Implement strict schema validation on all incoming API requests

B.Allow all API traffic to bypass authentication for performance

C.Disable all logging of API request headers

D.Monitor API traffic for anomalies that indicate data exfiltration

E.Deploy API Security to detect Broken Object Level Authorization (BOLA)

AnswersA, D, E

Strict schema validation rejects malformed or unexpected payloads at the API boundary, directly mitigating OWASP API Top 10 injection and mass assignment style attacks. It enforces the expected data contract before requests reach backend logic.

Why this answer

Option A is correct because strict schema validation on all incoming API requests enforces expected data types, formats, and required fields, which directly mitigates OWASP API threats such as mass assignment, injection, and improper input handling by rejecting malformed or unexpected payloads before they reach backend logic. Option D is correct because continuous monitoring of API traffic for anomalies that indicate data exfiltration helps detect and respond to threats like excessive data exposure and data harvesting, which are core concerns in the OWASP API Top 10. Option E is correct because deploying Cisco API Security to detect Broken Object Level Authorization (BOLA) addresses the top-ranked OWASP API risk, where attackers manipulate object identifiers to access resources belonging to other users; API security tooling can baseline and flag such unauthorized object access patterns.

Option B is incorrect because bypassing authentication for performance eliminates access control entirely and would worsen, not mitigate, OWASP API threats such as broken authentication and BOLA. Option C is incorrect because disabling logging of API request headers removes critical audit and forensic visibility needed to detect and investigate attacks, undermining rather than strengthening API security.

Exam trap

SDSI often tests whether candidates confuse generic web-security controls (WAF, TLS, logging) with API-specific controls — the trap is picking 'disable logging' or 'bypass auth' as performance optimizations when both directly violate OWASP API Top 10 design principles.

Full explanation →

51

MCQeasy

In a cloud-native environment, which Cisco solution provides visibility into vulnerabilities within the application code and runtime environment?

A.Cisco Secure Endpoint

B.Cisco Stealthwatch

C.Cisco Secure Malware Analytics

D.Cisco Secure Application for AppDynamics

AnswerD

Cisco Secure Application for AppDynamics instruments the application runtime, correlating code-level vulnerabilities and attacks with business transactions, so it provides visibility into flaws within application code and the live runtime environment rather than only network or host layers.

Why this answer

Cisco Secure Application for AppDynamics provides full-stack security observability including code vulnerabilities and runtime threats.

Full explanation →

52

MCQmedium

You are designing security for a microservices environment. You want to ensure that if one service is compromised, it cannot easily move laterally to other services. What is the most effective architectural design choice?

A.Keep all services on the same VLAN

B.Implement microsegmentation between services

C.Disable all internal firewalls for better performance

D.Use a single shared database for all services

AnswerB

Microsegmentation enforces per-service network policies, so a compromised service can reach only explicitly permitted peers rather than the whole subnet. This directly satisfies the stem's containment constraint, blocking east-west lateral movement that flat network segmentation would allow.

Why this answer

Microsegmentation between services enforces least-privilege east-west policies so that a compromised service can only communicate with explicitly authorized peers, directly preventing lateral movement. This is the architectural control designed for the stated goal. It works at workload granularity and is the standard Zero Trust answer for limiting blast radius in microservices.

Exam trap

The trap is picking a network simplification or shared-resource answer (same VLAN, shared DB) because it sounds operationally convenient — the exam wants you to recognize that lateral movement prevention requires explicit, least-privilege segmentation between every service.

How to eliminate wrong answers

Option A is wrong because putting all services on the same VLAN creates a flat network where any compromised service can reach every other service — the opposite of what is needed. Option C is wrong because disabling internal firewalls removes the very controls that prevent lateral movement and is a severe security anti-pattern. Option D is wrong because a single shared database increases blast radius and coupling — a compromise of one service can access or corrupt data used by all services, and it violates the principle of least privilege.

Full explanation →

53

MCQeasy

In the context of microsegmentation, what is the primary benefit of using a 'Whitelist' approach over a 'Blacklist' approach?

A.It improves performance of the underlying network

B.It provides a more secure, 'deny-all' default posture

C.It is easier to configure

D.It removes the need for security policies

AnswerB

A whitelist enforces a default-deny posture: only explicitly permitted traffic flows, so unknown or newly introduced threats are blocked automatically. This satisfies microsegmentation's requirement to minimise lateral movement, unlike blacklists that must enumerate every prohibited flow and inevitably miss novel attack paths.

Why this answer

A whitelist approach in microsegmentation explicitly allows only known, authorized traffic and denies everything else by default, providing a more secure 'deny-all' posture. This is in contrast to a blacklist approach, which allows all traffic except known bad actors, leaving potential gaps for unknown threats. The whitelist model enforces least privilege and reduces the attack surface.

Exam trap

The trap here is thinking that whitelisting is easier to configure or improves performance, when its primary advantage is security through a default-deny posture, which can be more complex to set up but offers stronger protection.

How to eliminate wrong answers

Option A is wrong because whitelisting does not inherently improve network performance; it is a security measure, and performance depends on other factors. Option C is wrong because whitelisting is often more complex to configure initially, as it requires identifying all allowed traffic, not easier. Option D is wrong because whitelisting does not remove the need for security policies; it is a type of security policy itself.

Full explanation →

54

MCQhard

In a multi-cloud design, which component is used to connect remote offices directly to the cloud provider while maintaining Cisco-level security?

A.Local NAT translation.

B.Cisco Secure Access Control Server (ACS).

C.Standard site-to-site IPsec tunnel.

D.Cisco SD-WAN Cloud OnRamp.

AnswerD

Cloud OnRamp extends the SD-WAN fabric directly into cloud providers, giving remote offices optimised, encrypted paths to workloads while applying the same Cisco security policy. This satisfies the stem's requirement for direct cloud connectivity with Cisco-level protection.

Why this answer

Cisco SD-WAN Cloud OnRamp automates the creation of secure, optimized connectivity from branch offices directly to cloud providers (AWS, Azure, GCP) while applying Cisco's security stack (e.g., Umbrella, SIG, or FTDv) at the branch or cloud edge. It maintains Cisco-level security by integrating with the SD-WAN fabric and policy, unlike a generic IPsec tunnel. This provides direct cloud access without backhauling through a data center.

Exam trap

SDSI often tests the confusion between generic IPsec VPNs and SD-WAN Cloud OnRamp; candidates pick the IPsec tunnel because it's familiar, but the exam expects the automated, security-integrated Cloud OnRamp.

How to eliminate wrong answers

Option A is wrong because local NAT translation only translates addresses and provides no secure connectivity or cloud integration. Option B is wrong because Cisco ACS is a legacy AAA/RADIUS/TACACS+ server, not a cloud connectivity solution. Option C is wrong because a standard site-to-site IPsec tunnel provides connectivity but lacks the automation, optimization, and integrated Cisco security policy enforcement that Cloud OnRamp delivers.

Full explanation →

55

MCQeasy

What is the primary benefit of 'Shift Left' security in a DevSecOps pipeline?

A.Automated hardware deployment

B.Increased development speed

C.Elimination of security teams

D.Reduced remediation costs

AnswerD

Fixing flaws during design and coding costs far less than remediating them after deployment, since production incidents demand emergency patching, incident response and potential breach notification. Shift Left therefore directly satisfies the stem's cost-reduction objective by moving defect discovery to the earliest, cheapest pipeline stage.

Why this answer

Shift Left security moves security testing, scanning, and review earlier in the SDLC — into design, coding, and CI stages — so vulnerabilities are caught before they reach production. The primary measurable benefit is reduced remediation cost, because fixing a flaw during development is far cheaper than fixing it after deployment or after a breach.

Exam trap

SDSI often tests the misconception that Shift Left is about speed or replacing security teams — the exam wants you to recognize cost reduction via early detection as the primary benefit.

How to eliminate wrong answers

Option A is wrong because automated hardware deployment is an infrastructure automation concern (IaC, provisioning), not a security practice outcome. Option B is wrong because while Shift Left can improve flow, increased development speed is not its primary benefit — security gates can even slow initial velocity. Option C is wrong because Shift Left integrates security into development teams; it does not eliminate security teams, which remain essential for threat modeling, policy, and incident response.

Full explanation →

56

MCQmedium

When designing a network segmentation strategy using Cisco TrustSec, what is an SGT tag used for?

A.To map IP addresses to MAC addresses

B.To identify the VLAN ID

C.To configure port security

D.To enforce security policy based on identity

AnswerD

An SGT is a 16-bit tag carried in the packet, applied at ingress and enforced by security group ACLs on egress. It decouples policy from IP addresses, letting TrustSec enforce rules based on a device's identity and role rather than its subnet.

Why this answer

An SGT (Scalable Group Tag) is a metadata tag used in Cisco TrustSec to classify traffic based on identity, such as user role, device type, or location. It enables enforcement of security policies based on that identity, rather than IP addresses. SGTs are inserted into packets and used by network devices to apply SGACLs.

Exam trap

SDSI often tests the purpose of SGTs, and candidates may confuse them with VLANs or MAC-based security features, missing the identity-based policy enforcement aspect.

How to eliminate wrong answers

Option A is wrong because mapping IP addresses to MAC addresses is the function of ARP, not SGTs. Option B is wrong because identifying VLAN ID is a Layer 2 function, and SGTs are separate from VLANs; they can be used across VLANs. Option C is wrong because configuring port security is a switch feature to restrict MAC addresses, not related to SGTs.

Full explanation →

57

MCQeasy

What is the primary function of Cisco pxGrid in a network design?

A.To encrypt traffic.

B.To exchange security context and data between Cisco and third-party products.

C.To filter web traffic.

D.To manage physical hardware.

AnswerB

pxGrid shares security context, such as identity, posture and threat data, between Cisco platforms and third-party tools, enabling coordinated enforcement. This context-exchange role is the primary function the stem asks for, distinct from inline traffic inspection.

Why this answer

Cisco pxGrid is a platform that enables bidirectional, context-sharing integration between Cisco security products and third-party solutions. It publishes security context — such as identity, endpoint posture, threat detection, and session data — and allows subscribers to query or receive that data to trigger coordinated responses. Its primary function is exchanging security context and data, not enforcing traffic controls itself.

Exam trap

SDSI often tests whether candidates mistake pxGrid for an enforcement or encryption mechanism, when it is actually a context-sharing integration bus — the trap is picking a function that belongs to another Cisco product.

How to eliminate wrong answers

Option A is wrong because pxGrid does not encrypt traffic; encryption is handled by protocols like IPsec, TLS, or MACsec, and pxGrid itself uses certificate-based mutual TLS only to secure its own control/data channel. Option C is wrong because pxGrid is not a web proxy or content filter — web filtering is performed by Cisco Umbrella or Secure Web Appliance (WSA). Option D is wrong because pxGrid does not manage physical hardware; it is a software integration fabric that runs as a service on Cisco ISE and exchanges contextual data with ecosystem partners.

Full explanation →

58

MCQmedium

In an AI-enhanced security design, what is 'Supervised Learning' primarily used for?

A.Classification of malicious vs. benign data

B.Predicting hardware failure

C.Automated documentation generation

D.Unsupervised clustering of anomalies

AnswerA

Supervised learning trains on labelled datasets, mapping input features to known output categories. For security, that means classifying traffic or files as malicious or benign based on examples of each, which is precisely the labelled binary classification task described.

Why this answer

Supervised learning uses labeled training data to learn a mapping from inputs to outputs, making it ideal for classification tasks such as distinguishing malicious from benign data. In AI-enhanced security, labeled datasets of known malware and clean files train models to classify new, unseen samples. This is the foundational use case for supervised learning in security analytics.

Exam trap

SDSI often tests the distinction between supervised and unsupervised learning, and candidates incorrectly associate anomaly clustering (unsupervised) with supervised learning.

How to eliminate wrong answers

Option B is wrong because predicting hardware failure is typically a regression or time-series forecasting problem, which is a different application of supervised learning (or sometimes unsupervised anomaly detection), not the primary classification use case described. Option C is wrong because automated documentation generation is a natural language processing task, not a security classification task, and is unrelated to supervised learning's core security application. Option D is wrong because unsupervised clustering of anomalies is by definition unsupervised learning, not supervised learning — the key distinction is the presence of labeled data.

Full explanation →

59

MCQeasy

When designing a remote access VPN solution using Cisco AnyConnect, which protocol is preferred to optimize performance for latency-sensitive applications like VoIP?

A.DTLS

B.TLS

C.IPsec IKEv2

D.SSTP

AnswerA

DTLS runs over UDP, avoiding TCP retransmission and head-of-line blocking, so voice and video packets traverse the AnyConnect tunnel with lower jitter and latency. This satisfies the requirement to optimise performance for latency-sensitive VoIP traffic.

Why this answer

DTLS (Datagram Transport Layer Security) is preferred for Cisco AnyConnect remote access VPN because it operates over UDP, avoiding TCP's head-of-line blocking and retransmission delays that degrade latency-sensitive traffic like VoIP. AnyConnect uses DTLS as the data transport while TLS handles the control channel, providing lower latency and jitter for real-time applications. This makes DTLS the optimal choice for optimizing performance of VoIP over AnyConnect.

Exam trap

SDSI often tests the misconception that TLS is always preferred for security, but for latency-sensitive applications, DTLS over UDP is the correct choice due to its lower overhead and avoidance of TCP retransmission delays.

How to eliminate wrong answers

Option B is wrong because TLS runs over TCP, which introduces retransmission delays and head-of-line blocking that increase latency and jitter for real-time traffic like VoIP. Option C is wrong because IPsec IKEv2 is a separate VPN protocol not used by Cisco AnyConnect for its data transport; AnyConnect relies on TLS/DTLS, and IKEv2 would require a different client or configuration. Option D is wrong because SSTP is a Microsoft proprietary protocol that uses TCP and is not supported by Cisco AnyConnect, making it irrelevant for this scenario.

Full explanation →

60

MCQmedium

A security architect is designing a DR strategy. Which feature of Cisco Secure Firewall ensures that configurations are synchronized between primary and backup units in a high-availability pair?

A.Cisco Secure Firewall Failover Link.

B.Cisco Defense Orchestrator auto-sync.

C.Cisco Identity Services Engine RADIUS sync.

D.Cisco FMC policy deployment.

AnswerA

The failover link is a dedicated connection between the pair that carries stateful failover messages, including connection state and configuration synchronisation. It lets the standby unit mirror the active unit's configuration so it can take over without manual rebuilding.

Why this answer

In a Cisco Secure Firewall high-availability (failover) pair, the failover link is the dedicated interface used to exchange hello/heartbeat messages and synchronize state and configuration between the primary and secondary units. It carries the failover communication that keeps the standby unit's configuration and connection state consistent with the active unit. Without a functioning failover link, the pair cannot maintain synchronized state or properly detect peer health.

Exam trap

The trap is conflating centralized management (FMC, CDO) with HA synchronization; candidates assume any 'management' product handles failover config sync, when in fact the dedicated failover link is the correct mechanism.

How to eliminate wrong answers

Option B is wrong because Cisco Defense Orchestrator is a cloud-based multi-device management platform; it does not perform real-time HA configuration synchronization between firewall peers. Option C is wrong because Cisco ISE RADIUS sync relates to identity/authentication policy, not firewall HA state or configuration replication. Option D is wrong because FMC policy deployment pushes policies from the manager to managed devices; it is not the mechanism that synchronizes configuration between the two units of an HA pair.

Full explanation →

61

MCQmedium

A security architect is designing a remote-work solution. What is the benefit of using Split Tunneling in Cisco Secure Client?

A.It provides dual authentication layers for the user.

B.It encrypts only the authentication phase of the VPN connection.

C.It allows internal traffic to be routed over the VPN while local traffic bypasses it.

D.It enforces all traffic through the corporate firewall.

AnswerC

Split tunnelling inspects the destination of each flow: traffic destined for corporate subnets traverses the encrypted VPN tunnel, while internet-bound traffic exits locally via the user's own connection. This preserves security for internal resources and reduces latency and headend load.

Why this answer

Split tunneling in Cisco Secure Client allows the VPN client to route only traffic destined for corporate internal networks through the encrypted VPN tunnel, while all other traffic (e.g., internet browsing, local LAN resources) is sent directly out the local network interface. This reduces bandwidth consumption on the VPN headend, lowers latency for cloud/SaaS apps, and avoids backhauling personal traffic. The correct option captures this exact behavior: internal traffic over VPN, local traffic bypasses it.

Exam trap

SDSI often tests the misconception that split tunneling encrypts only part of the connection or provides authentication benefits, when in fact it is purely a routing decision about which traffic enters the VPN tunnel.

How to eliminate wrong answers

Option A is wrong because dual authentication layers (e.g., certificate + username/password) are provided by authentication methods like IKEv2 or SAML, not by split tunneling. Option B is wrong because split tunneling does not selectively encrypt only the authentication phase; the entire VPN tunnel is encrypted, but the decision is about which traffic enters the tunnel. Option D is wrong because full tunneling (not split tunneling) forces all traffic through the corporate firewall; split tunneling explicitly allows local traffic to bypass the corporate security stack.

Full explanation →

62

MCQmedium

In an AI-based security architecture, which data source provides the most value for training an ML model to detect unauthorized data exfiltration?

A.NetFlow/IPFIX logs

B.User password history

C.System process logs

D.DHCP lease logs

AnswerA

NetFlow and IPFIX records capture flow metadata — source, destination, port, protocol, byte and packet counts — across the network, giving an ML model the volumetric and behavioural baselines needed to flag anomalous outbound transfers indicative of exfiltration.

Why this answer

NetFlow/IPFIX logs provide detailed metadata about network flows, including source/destination IPs, ports, protocols, and byte counts, which are highly valuable for training ML models to detect data exfiltration patterns (e.g., large transfers to unusual destinations). This data source captures the network behavior necessary to identify anomalies indicative of exfiltration.

Exam trap

The trap is choosing host-based logs (process, DHCP) over network flow data; candidates may think endpoint logs are more detailed, but exfiltration detection requires network-level visibility that NetFlow/IPFIX provides.

How to eliminate wrong answers

Option B is wrong because user password history is irrelevant to detecting data exfiltration; it is used for authentication policy enforcement. Option C is wrong because system process logs focus on host-level activities and may not provide the network context needed to detect exfiltration across the network. Option D is wrong because DHCP lease logs only map IP addresses to MAC addresses and do not contain information about data flows or volumes.

Full explanation →

63

MCQhard

For a zero-trust architecture, what is the primary function of Cisco ISE?

A.Managing user passwords.

B.Packet filtering at the edge.

C.Acting as a Policy Decision Point (PDP) for access control.

D.Automating WAN path selection.

AnswerC

Cisco ISE evaluates identity, device posture and contextual conditions, then makes the authorisation decision that grants or denies access — the Policy Decision Point role. Enforcement is delegated to network devices acting as Policy Enforcement Points, satisfying the zero-trust requirement for centralised access decisions.

Why this answer

Cisco ISE (Identity Services Engine) serves as the Policy Decision Point (PDP) in a zero-trust architecture. It evaluates identity, device posture, and contextual attributes (e.g., location, time, threat level) against configured policies to make dynamic access control decisions. These decisions are then enforced by Policy Enforcement Points (PEPs) like switches, wireless controllers, or firewalls.

Thus, ISE's primary function is centralized policy decision-making for network access, not password management or packet filtering.

Exam trap

SDSI often tests the distinction between policy decision and enforcement points, causing candidates to confuse ISE's role with that of firewalls or SD-WAN controllers.

How to eliminate wrong answers

Option A is wrong because managing user passwords is typically handled by directory services (e.g., Active Directory, LDAP) or identity management systems; ISE integrates with them but does not primarily manage passwords. Option B is wrong because packet filtering at the edge is performed by firewalls or routers, not ISE; ISE is not a data-plane device. Option D is wrong because automating WAN path selection is a function of SD-WAN controllers (e.g., Cisco vManage), not ISE, which focuses on access control policy.

Full explanation →

64

MCQhard

When designing an API strategy, what is the 'API Contract' and why is it important for security?

A.A password file for the API

B.A technical specification that allows for automated schema validation and security enforcement

C.A legal document for the API usage

D.A file that lists all allowed IP addresses

AnswerB

An API contract defines the expected request and response schemas, so gateways can automatically reject malformed or unexpected payloads before they reach backend services. This enforces the stem's security requirement by validating every call against the specification, blocking injection and schema-abuse attempts at the edge.

Why this answer

An API Contract is a formal, machine-readable specification (typically OpenAPI/Swagger, RAML, or gRPC proto) that defines endpoints, methods, parameters, request/response schemas, and authentication requirements. Because it is machine-readable, it enables automated schema validation of every request and response, and it lets security controls (input validation, auth scopes, rate limits) be enforced consistently at the gateway. This makes it a security asset, not just documentation.

Exam trap

The trap here is confusing 'contract' with legal or credential artifacts — candidates see 'contract' and think of a legal agreement or a secrets file, missing that in API security the contract is a machine-readable schema used for automated validation and enforcement.

How to eliminate wrong answers

Option A is wrong because a password file is a credential store, not a specification — it has nothing to do with defining API structure or enabling validation. Option C is wrong because a legal document (terms of use, SLA) governs business/legal obligations and cannot enforce technical schema validation. Option D is wrong because an IP allowlist is a single narrow control, not a contract; it does not describe the API's schema, methods, or data types and cannot drive automated validation.

Full explanation →

65

Multi-Selectmedium

Which THREE factors should be considered when designing a security approach for a hybrid work model? (Select 3)

Select 3 answers

A.Physical security of the home office

B.Multi-factor authentication (MFA)

C.VLAN mapping for home routers

D.Direct internet access security

E.Endpoint posture assessment

AnswersB, D, E

Multi-factor authentication directly satisfies the identity-verification requirement of a hybrid model, where users connect from unmanaged networks and personal devices. By combining something the user knows with a possession or biometric factor, MFA blocks credential-replay attacks that password-only sign-ins cannot stop, regardless of location.

Why this answer

Option B (Multi-factor authentication, MFA) is correct because in a hybrid work model users authenticate from untrusted home networks and public locations, so adding a second factor beyond passwords mitigates credential theft, phishing, and replay attacks. Option D (Direct internet access security) is correct because remote workers typically bypass the corporate perimeter and connect straight to SaaS and cloud services, so secure web gateways, DNS filtering, CASB, and TLS inspection must protect that direct path. Option E (Endpoint posture assessment) is correct because devices operating outside the managed network must be checked for patch level, disk encryption, EDR health, and compliance before being granted access, often enforced via conditional access or NAC.

Option A is not among the selected answers because physical security of a home office, while useful, is not a core technical control for hybrid-work security design, and Option C is not selected because VLAN mapping on home routers is impractical to standardize and is not a recognized enterprise security design factor.

Exam trap

SDSI often tests the distinction between technical security controls and physical or home-network controls, and candidates may incorrectly include physical security or VLAN mapping as core design factors.

Full explanation →

66

MCQmedium

You are automating Cisco Secure Firewall policies. Why is 'Version Control' (e.g., Git) considered a security control?

A.Automatically encrypts all traffic

B.Increases bandwidth

C.Replaces the need for a firewall

D.Provides audit trails and change history

AnswerD

Git records every policy commit with author, timestamp and diff, creating tamper-evident audit trails that satisfy the change-history constraint in the stem. This lets you trace who altered which Cisco Secure Firewall rule and when, supporting forensic review and rollback — capabilities a plain configuration file on disk cannot provide.

Why this answer

Version control systems like Git provide audit trails and change history, which are essential security controls for tracking who changed firewall policies, when, and why. This enables accountability, rollback of malicious or erroneous changes, and compliance with change management requirements. In automated environments, version control ensures that policy changes are reviewed and approved before deployment, reducing the risk of unauthorized modifications.

Exam trap

The trap is assuming that automation tools inherently provide security; candidates may overlook that version control's security value is in auditability and change control, not in encryption or traffic filtering.

How to eliminate wrong answers

Option A is wrong because version control does not encrypt traffic; encryption is handled by protocols like TLS or IPsec. Option B is wrong because version control has no impact on bandwidth; it manages code and configuration, not network throughput. Option C is wrong because version control does not replace a firewall; it is a management and auditing tool, not an enforcement mechanism.

Full explanation →

67

Multi-Selectmedium

Which TWO strategies are recommended for securing a cloud-native SaaS environment?

Select 2 answers

A.Duo MFA integration.

B.CASB implementation.

C.Opening all firewall ports.

D.Storing passwords in clear text.

E.Disabling all logging.

AnswersA, B

Duo MFA integration satisfies the stem's cloud-native SaaS constraint by enforcing identity verification at the SaaS application layer, independent of on-premises infrastructure. Unlike domain-joined Windows Hello or certificate-based smartcard logon, Duo brokers authentication through a cloud service, adding phishing-resistant or push-based second factors to federated sessions with Microsoft Entra ID.

Why this answer

Duo MFA integration (A) is correct because enforcing multi-factor authentication via Duo adds a strong identity-verification layer that protects SaaS accounts even if passwords are compromised, directly reducing credential-based attacks in a cloud-native environment. CASB implementation (B) is correct because a Cloud Access Security Broker provides visibility and control over SaaS usage, enforcing data loss prevention, encryption, and compliance policies across sanctioned and unsanctioned cloud apps. Opening all firewall ports (C) is wrong because it exposes services to unnecessary network access, vastly expanding the attack surface.

Storing passwords in clear text (D) is wrong because it makes credentials trivially readable and violates basic security and compliance requirements. Disabling all logging (E) is wrong because it eliminates audit trails and detection capability, preventing incident response and forensic analysis.

Exam trap

SDSI often tests whether candidates can identify the two legitimate security controls among obviously insecure distractors, so the trap is overthinking and selecting a plausible-sounding but harmful option like opening firewall ports.

Full explanation →

68

Multi-Selectmedium

Which THREE of the following represent common challenges when implementing automated security in a legacy environment?

Select 3 answers

A.Cultural resistance to change

B.Too much documentation

C.Excessive API performance

D.Fragmented or inconsistent log data

E.Lack of native API support in legacy devices

AnswersA, D, E

Legacy operations teams often distrust automation that removes manual oversight, so cultural resistance directly obstructs rollout. This human factor is a recognised implementation challenge, distinct from technical gaps such as missing APIs or inconsistent logs, and must be managed through change enablement before automated security can succeed.

Why this answer

Cultural resistance to change (A) is a correct challenge because security automation alters established operational workflows and requires staff to trust tooling over manual, experience-based procedures, and legacy IT teams often resist ceding control to automated remediation. Fragmented or inconsistent log data (D) is correct because legacy systems frequently emit proprietary or non-standard formats (e.g., syslog variants, flat files, no CEF/LEEF normalization), which breaks correlation, SIEM ingestion, and automated event-driven response. Lack of native API support in legacy devices (E) is correct because many older appliances and applications expose only CLI, SNMP, or screen-scraping interfaces rather than REST/SOAP APIs, forcing brittle scripting and preventing clean integration with orchestration and SOAR platforms.

Option B is not a challenge in this context, since documentation is generally beneficial and not a barrier to automation, and option C is incorrect because excessive API performance is a benefit, not a problem — the real legacy issue is the absence or poor performance of APIs.

Exam trap

SDSI often tests whether candidates can separate genuine legacy-automation barriers (culture, fragmented logs, no APIs) from non-issues like 'too much documentation' or 'excessive API performance' — the trap is picking plausible-sounding but technically backwards options.

Full explanation →

69

MCQmedium

When designing security for a microservices architecture, why should you implement a 'Zero Trust' approach at the service level?

A.To rely solely on network perimeter security

B.To ensure that every service-to-service call is authenticated and authorized

C.To increase the latency of inter-service communication

D.To simplify the management of firewall rules

AnswerB

Zero Trust removes implicit trust based on network location, so each service-to-service call must carry verifiable identity and be authorised against policy. This satisfies the microservices constraint where lateral movement between containers is otherwise unrestricted, limiting blast radius if one service is compromised.

Why this answer

Zero Trust at the service level ensures that every service-to-service call is authenticated and authorized, regardless of network location. This prevents lateral movement in case of a breach and enforces least privilege. It is essential in microservices architectures where traditional perimeter security is insufficient.

Exam trap

SDSI often tests the misconception that Zero Trust is only about external access; candidates may overlook the need for internal service-level authentication and authorization.

How to eliminate wrong answers

Option A is wrong because relying solely on network perimeter security contradicts Zero Trust principles and is ineffective for internal service calls. Option C is wrong because Zero Trust aims to secure communication, not increase latency; while some overhead may occur, it is not the goal. Option D is wrong because Zero Trust may actually increase the complexity of managing policies, but it provides better security; simplification is not the primary reason.

Full explanation →

70

MCQeasy

Which design principle helps minimize the impact of a compromised API key?

A.Hard-coding keys in the source code

B.Rotating keys frequently

C.Using long-lived static API keys

D.Sharing a single key among all users

AnswerB

Frequent rotation is a standard security practice to limit exposure.

Why this answer

Frequent key rotation limits the window of opportunity for an attacker who has stolen or leaked a key — the compromised credential becomes useless once rotated. It also forces teams to build automated rotation and revocation workflows, which reduces the blast radius of any single key exposure. This is a core principle of credential hygiene and least-privilege design.

Exam trap

The trap is assuming that a 'strong' or 'long' key is inherently secure — candidates pick long-lived static keys thinking length equals safety, when the real risk is the exposure window, not the key's entropy.

How to eliminate wrong answers

Option A is wrong because hard-coding keys in source code exposes them to anyone with repository access, logs, or build artifacts, dramatically increasing compromise risk. Option C is wrong because long-lived static keys give an attacker unlimited time to exploit a leaked credential, maximizing impact. Option D is wrong because sharing a single key among all users destroys accountability and non-repudiation, and one leak compromises every user simultaneously.

Full explanation →

71

MCQmedium

When designing a firewall architecture for a high-security zone, which inspection mode is required to identify malware within encrypted payloads?

A.Passive logging mode.

B.SSL/TLS Decryption and Inspection.

C.Bypass inspection mode.

D.Layer 3 routing mode.

AnswerB

Encrypted payloads are opaque to standard stateful inspection, so malware hidden inside TLS sessions passes undetected. SSL/TLS decryption terminates the session, decrypts traffic, inspects the plaintext against threat signatures, then re-encrypts it — the only mode satisfying the high-security zone's requirement to identify malware within encrypted payloads.

Why this answer

SSL/TLS Decryption and Inspection is required because malware can be hidden inside encrypted traffic, and a firewall cannot inspect the payload without first decrypting it. This mode terminates the TLS session, examines the plaintext for threats, then re-encrypts the traffic. Without decryption, the firewall only sees encrypted bytes and cannot identify malicious content.

Exam trap

SDSI often tests the misconception that encryption alone provides security, but the exam expects you to know that inspection requires decryption to see inside encrypted payloads.

How to eliminate wrong answers

Option A is wrong because passive logging mode only records traffic metadata and does not inspect payloads, encrypted or otherwise. Option C is wrong because bypass inspection mode explicitly skips security inspection, allowing malware to pass unchecked. Option D is wrong because Layer 3 routing mode only forwards packets based on IP addresses and does not perform deep packet inspection or decryption.

Full explanation →

72

Multi-Selecteasy

Which TWO of the following are common benefits of using API-based security automation?

Select 2 answers

A.Automatic removal of all vulnerabilities

B.Unlimited system memory

C.Consistent enforcement across infrastructure

D.Elimination of all human security analysts

E.Increased deployment speed

AnswersC, E

API-based automation applies identical policy definitions through code across every environment, eliminating the drift that arises when engineers configure devices manually. This satisfies the consistency requirement by making the same enforcement logic reproducible regardless of scale or platform.

Why this answer

Option C is correct because API-based security automation applies policies programmatically and uniformly across cloud, on-premises, and hybrid infrastructure, ensuring the same controls are enforced everywhere without manual drift. Option E is correct because automating security checks and remediation through APIs integrates into CI/CD pipelines, allowing faster, repeatable deployments without slowing down release cycles. Option A is incorrect because automation can detect and remediate known issues but cannot guarantee the removal of all vulnerabilities, especially unknown or zero-day flaws.

Option B is incorrect because memory is a hardware/resource constraint unrelated to API-based automation. Option D is incorrect because automation augments analysts rather than eliminating the need for human judgment, triage, and incident response.

Exam trap

SDSI often tests whether candidates overstate automation's capabilities — options claiming 'elimination of all vulnerabilities' or 'elimination of all human analysts' are classic distractors that sound appealing but are technically impossible.

Full explanation →

73

Multi-Selecthard

Which THREE design principles are key for a multi-cloud security strategy?

Select 3 answers

A.Using different security tools for each cloud.

B.Consistent security policies across environments.

C.Allowing all cross-cloud traffic.

D.Unified threat visibility.

E.Centralized management plane (FMC).

AnswersB, D, E

Uniform policy enforcement across AWS, Azure and on-premises removes per-provider policy drift, so a workload's security posture stays identical wherever it runs. This directly satisfies the multi-cloud design goal of governing heterogeneous environments through one coherent rule set rather than duplicated, divergent configurations.

Why this answer

Option B is correct because a multi-cloud security strategy requires consistent security policies across environments, so that the same access control, inspection, and segmentation rules are enforced uniformly in AWS, Azure, GCP, and on-premises rather than drifting per provider. Option D is correct because unified threat visibility aggregates logs, events, and telemetry from all clouds into a single view, enabling correlation and detection of threats that span multiple providers instead of relying on fragmented per-cloud consoles. Option E is correct because a centralized management plane such as Cisco Firepower Management Center (FMC) lets administrators define policy once and push it to firewalls and sensors across clouds, which is the practical mechanism for achieving the consistency and visibility described above.

Option A is not correct because using different, uncoordinated security tools per cloud creates policy gaps and operational complexity, which is the opposite of a sound multi-cloud design. Option C is not correct because allowing all cross-cloud traffic violates least-privilege and zero-trust principles; cross-cloud flows should be explicitly permitted, inspected, and segmented.

Exam trap

SDSI often tests the misconception that multi-cloud security requires different tools per cloud, but the exam emphasizes consistency, visibility, and centralized management as the key principles.

Full explanation →

74

Multi-Selectmedium

When designing an API security architecture to protect against unauthorized data access, which THREE mechanisms are considered best practices for securing API endpoints in a Cisco environment? (Choose THREE)

Select 3 answers

A.Hardcoding API keys directly into the client-side source code.

B.Disabling TLS to improve API request processing performance.

C.Enforcing fine-grained authorization policies using scopes or claims.

D.Implementing OAuth 2.0 with OpenID Connect for secure authentication.

E.Applying rate limiting and throttling on the API Gateway.

AnswersC, D, E

Scopes and claims embedded in tokens let the gateway evaluate precisely which resources and actions a caller may access, enforcing least privilege per request. This satisfies the requirement to prevent unauthorised data access by rejecting tokens lacking the required scope, rather than relying on coarse network-level trust.

Why this answer

Option C is correct because enforcing fine-grained authorization with scopes or claims ensures that authenticated clients can only access the specific resources and actions their token permits, which directly prevents unauthorized data access. Option D is correct because OAuth 2.0 with OpenID Connect provides standards-based, token-based authentication and identity verification, avoiding credential exposure and enabling secure delegated access to APIs. Option E is correct because rate limiting and throttling on the API Gateway mitigate abuse, brute-force attempts, and denial-of-service conditions that could otherwise lead to unauthorized data exposure or service disruption.

Option A is not appropriate because hardcoding API keys in client-side source code exposes secrets to anyone who inspects the application, enabling credential theft and unauthorized access. Option B is not appropriate because disabling TLS removes encryption and integrity protection, allowing eavesdropping, token theft, and man-in-the-middle attacks, which directly undermines API security.

Exam trap

SDSI often tests whether candidates confuse authentication (who you are) with authorization (what you can do) — options that only address one layer (e.g., API keys alone) are distractors because they don't cover both identity and permission enforcement.

Full explanation →

75

MCQhard

When designing a secure remote access solution, what is the 'Always-On' VPN feature in AnyConnect primarily used for?

A.To reduce authentication time

B.To improve performance

C.To enable seamless roaming

D.To enforce security policy for off-network users

AnswerD

Always-On VPN establishes the tunnel automatically before user login and keeps it active, so traffic from off-network endpoints is forced through the corporate security stack. This satisfies the constraint of enforcing policy on devices that are not on the trusted network.

Why this answer

Always-On VPN in AnyConnect ensures the VPN tunnel is established automatically whenever the endpoint has network connectivity, even before the user logs in, so security policy (firewall, posture, split-tunneling rules) is enforced for off-network users at all times. This prevents users from bypassing corporate controls by simply not connecting.

Exam trap

The trap is confusing Always-On VPN with roaming or performance features; candidates who associate 'always connected' with seamless roaming pick option C, missing that the feature's purpose is continuous policy enforcement.

How to eliminate wrong answers

Option A is wrong because Always-On does not reduce authentication time — it may actually add a step by requiring tunnel establishment before access. Option B is wrong because Always-On is a security enforcement feature, not a performance optimization; it can add latency by forcing traffic through the tunnel. Option C is wrong because seamless roaming is a separate capability (mobility across networks) and is not the primary purpose of Always-On, which is policy enforcement.

Full explanation →

Page 1 of 4

All pages

Practice SDSI by domain

Target a specific domain to shore up weak areas.

AI Automation And Devsecops Risk Events And Requirements Secure Infrastructure Design Application Security Design

See all domains with question counts →