Cisco Designing Cisco Security Infrastructure (SDSI, 300-745, CCNP Security, design-focused) (SDSI) SDSI Questions 76–150 | Page 2/4

MCQmedium

During a risk assessment, it is determined that a legacy application cannot be patched. Which Cisco security control should be prioritized to compensate for this vulnerability?

A.Cisco Stealthwatch behavioral alerts.

B.Cisco AnyConnect VPN.

C.Virtual patching via Cisco Secure Firewall IPS.

D.Cisco Umbrella DNS blocking.

AnswerC

Virtual patching through Cisco Secure Firewall IPS satisfies the unpatched legacy application constraint by inspecting traffic inline and blocking exploits targeting known vulnerabilities, without touching the host. It compensates for the missing vendor patch by enforcing signature-based and anomaly detection at the network layer, shielding the application until it can be retired or replaced.

Why this answer

Virtual patching via Cisco Secure Firewall IPS provides a compensating control for unpatched vulnerabilities by inspecting and blocking exploit traffic at the network layer. It does not require modifying the legacy application, making it ideal when patching is not possible. This approach reduces risk while maintaining availability.

Exam trap

SDSI often tests the difference between detection (Stealthwatch) and prevention (IPS); candidates may choose a monitoring tool when an active compensating control is required.

How to eliminate wrong answers

Option A is wrong because Stealthwatch provides behavioral alerts and visibility but does not actively block or compensate for a specific vulnerability. Option B is wrong because AnyConnect VPN provides secure remote access but does not address application vulnerabilities. Option D is wrong because Umbrella DNS blocking can block malicious domains but does not protect against exploits targeting a known vulnerability in the application itself.

Full explanation →

MCQeasy

What is the benefit of integrating Cisco Secure Email with Cisco Threat Intelligence (Talos)?

A.It increases email storage capacity.

B.It creates automated email backups.

C.It allows for remote administration of the email server.

D.It provides real-time threat intelligence for filtering.

AnswerD

Talos continuously feeds reputation and signature data into Secure Email, so messages are judged against current threat campaigns rather than static local rules. This satisfies the stem's requirement for real-time intelligence, blocking emerging malware, phishing and malicious URLs before delivery.

Why this answer

Integrating Cisco Secure Email with Cisco Talos provides real-time threat intelligence that feeds directly into the email filtering pipeline. Talos continuously analyzes global email traffic, malware campaigns, and phishing infrastructure, and pushes that intelligence to Secure Email so messages can be blocked or quarantined based on current threat data rather than static signatures. This dynamic, reputation-based filtering is the core security benefit of the integration.

Exam trap

The trap here is confusing 'integration with threat intelligence' with operational features like storage, backup, or remote management; candidates must recognize that Talos is purely a real-time reputation and threat feed.

How to eliminate wrong answers

Option A is wrong because email storage capacity is a function of the appliance or cloud mailbox quota, not threat intelligence integration. Option B is wrong because Talos does not perform email backups; backup is a separate retention/archiving function (e.g., Cisco Secure Email and Web Manager). Option C is wrong because remote administration is provided by management interfaces and APIs, not by Talos threat feeds.

Full explanation →

MCQmedium

You are designing security for a microservices cluster. You want to ensure that if a pod is compromised, it cannot make unauthorized calls to the database. Which design approach is most effective?

A.Disable all internal network logging

B.Put the database in the public cloud

C.Use microsegmentation to restrict database access to authorized services only

D.Open all network ports to the database

AnswerC

Microsegmentation enforces east-west traffic controls at the workload level, so a compromised pod cannot reach the database unless explicitly permitted. This directly satisfies the stem's containment requirement: limiting blast radius by denying unauthorised pod-to-database calls, rather than relying on perimeter defences that assume internal traffic is trusted.

Why this answer

Microsegmentation applies least-privilege network policy so that each workload can only communicate with the specific services it needs. In a microservices cluster, this means the database only accepts connections from authorized service identities (e.g., the billing service's service account), so a compromised pod cannot reach the database even if it is on the same network. This contains lateral movement and limits blast radius.

Exam trap

SDSI often tests whether candidates confuse 'put it in the cloud' or 'open ports' with security controls, when the actual answer is least-privilege segmentation that restricts which identities can reach the database.

How to eliminate wrong answers

Option A is wrong because disabling internal network logging removes the visibility needed to detect and investigate the very compromise you're trying to contain — it weakens security rather than strengthening it. Option B is wrong because putting the database in the public cloud (without specifying private networking, security groups, or private endpoints) increases exposure and does not restrict which services can reach it. Option D is wrong because opening all ports to the database is the opposite of least privilege and directly enables the unauthorized access the question asks you to prevent.

Full explanation →

MCQmedium

A developer needs to ensure that microservices within a Kubernetes cluster communicate securely. Which design element ensures that the service-to-service communication is encrypted using mTLS?

A.Configuring standard Kubernetes Service objects

B.Using a physical load balancer in front of the cluster

C.Enabling IPsec on the physical nodes

D.Deploying a Service Mesh

AnswerD

A service mesh injects sidecar proxies that transparently intercept pod traffic, performing mutual TLS handshakes and certificate rotation between services. This satisfies the requirement for encrypted service-to-service communication without altering application code, since mTLS is enforced at the infrastructure layer rather than within each microservice.

Why this answer

Deploying a Service Mesh (e.g., Istio, Linkerd) provides mutual TLS (mTLS) for service-to-service communication within a Kubernetes cluster. The service mesh injects sidecar proxies that automatically encrypt and authenticate traffic between microservices, ensuring confidentiality and integrity without application code changes. This is the standard design element for achieving mTLS in Kubernetes.

Exam trap

The trap is confusing network-level encryption (IPsec) with application-level mTLS; candidates may pick IPsec because it encrypts traffic, but it lacks the identity and per-service granularity that mTLS provides.

How to eliminate wrong answers

Option A is wrong because standard Kubernetes Service objects only provide load balancing and service discovery; they do not encrypt traffic or provide identity-based authentication. Option B is wrong because a physical load balancer sits in front of the cluster and does not secure internal east-west traffic between microservices. Option C is wrong because enabling IPsec on physical nodes encrypts node-to-node traffic but does not provide per-service identity or mTLS, and it is not granular to microservices.

Full explanation →

MCQeasy

A design needs to restrict network access based on the user's role and device type. Which Cisco product is the primary engine for this context-aware policy control?

A.Cisco SecureX.

B.Cisco Firepower Management Center.

C.Cisco Umbrella.

D.Cisco Identity Services Engine (ISE).

AnswerD

Cisco ISE evaluates identity, device posture and role attributes, then enforces context-aware access policy through network enforcement. This satisfies the requirement by combining user role and device type into authorisation decisions, which is ISE's core policy engine function.

Why this answer

Cisco Identity Services Engine (ISE) is the primary policy engine for context-aware access control in Cisco's security architecture. It evaluates identity attributes (user role, group membership) and device attributes (device type, posture, location) to enforce dynamic network access policies via 802.1X, MAB, and TrustSec. ISE integrates with switches, wireless controllers, and VPNs to apply role-based and device-based access restrictions, making it the correct answer for this requirement.

Exam trap

SDSI often tests the distinction between policy enforcement engines (ISE) and threat detection/response platforms (SecureX, Firepower, Umbrella), so candidates may incorrectly choose a product that provides security visibility rather than access control.

How to eliminate wrong answers

Option A is wrong because Cisco SecureX is a cloud-based platform that integrates multiple security products for threat detection and response, but it does not enforce network access policies based on user role and device type. Option B is wrong because Cisco Firepower Management Center manages Firepower next-generation firewalls and IPS devices, focusing on threat defense and policy management for those appliances, not on identity and device-based network access control. Option C is wrong because Cisco Umbrella is a cloud-delivered secure internet gateway that provides DNS-layer security, web filtering, and cloud firewall capabilities, but it does not serve as the primary engine for context-aware network access control based on user and device attributes.

Full explanation →

MCQhard

Which design approach is best for protecting APIs against 'Mass Assignment' vulnerabilities?

A.Encrypting all API requests with AES-256

B.Disabling all API writes

C.Using a strong password policy

D.Implementing strict input validation and allowing only specified fields

AnswerD

Strict input validation with an explicit allowlist of permitted fields prevents clients from binding unintended properties to objects, directly neutralising mass assignment. Rejecting unspecified fields ensures only sanctioned attributes are accepted, satisfying the API protection requirement.

Why this answer

Mass assignment (also called over-posting or autobinding) occurs when an API blindly binds client-supplied JSON/XML fields to internal object properties, letting attackers set fields they shouldn't (e.g., isAdmin=true, role=admin). The correct defense is strict input validation combined with an allowlist of explicitly permitted fields (schema-based binding), so any unexpected or privileged field is rejected or ignored. This ensures the API only accepts the fields the developer intended.

Exam trap

SDSI often tests whether candidates reach for encryption or password policies as generic 'security' answers when the actual flaw is an authorization/binding issue that only input validation and field allowlisting can fix.

How to eliminate wrong answers

Option A is wrong because AES-256 encryption protects data in transit but does nothing to prevent a client from submitting extra fields in an otherwise valid, encrypted request — the attacker's payload is still processed. Option B is wrong because disabling all API writes destroys functionality and is not a security control; it's a denial of service against legitimate business operations. Option C is wrong because a strong password policy addresses credential strength and authentication, not the authorization/binding flaw that allows extra fields to be written to objects.

Full explanation →

MCQeasy

Which design component is essential for securing traffic in a cloud-native environment using Cisco Secure Workload without relying on physical network appliances?

A.Workload-level security agents

B.Physical tap aggregation

C.VLAN-based segmentation

D.Direct Connect integration

AnswerA

Workload-level security agents enforce policy directly on each host, delivering microsegmentation and flow visibility without inline appliances. This satisfies the stem's constraint of securing cloud-native traffic absent physical hardware, since enforcement travels with the workload across any environment and cannot be bypassed by east-west traffic.

Why this answer

Cisco Secure Workload secures cloud-native traffic using workload-level security agents installed on hosts, VMs, or containers that enforce policy and provide visibility without physical appliances. This agent-based architecture is what allows policy enforcement to follow the workload across clouds and on-premises environments, satisfying the 'no physical network appliances' constraint.

Exam trap

SDSI often tests whether candidates understand that cloud-native workload security uses host/agent-based enforcement rather than physical taps, VLANs, or cloud connectivity services like Direct Connect.

How to eliminate wrong answers

Option B is wrong because physical tap aggregation requires hardware taps and aggregation devices, which contradicts the cloud-native, appliance-free requirement and cannot see intra-host or encrypted east-west traffic. Option C is wrong because VLAN-based segmentation is a Layer 2 network construct that does not exist meaningfully inside cloud-native environments and cannot enforce workload-level policy across clouds or containers. Option D is wrong because Direct Connect integration is an AWS connectivity service (dedicated private link to AWS) that addresses network transport, not workload security policy or traffic inspection — it does not secure east-west traffic between workloads.

Full explanation →

Multi-Selecthard

Which THREE components are part of a robust Cisco Zero Trust for the Workplace architecture?

Select 3 answers

A.Cisco Secure Endpoint for device posture.

B.Cisco Duo for user authentication.

C.DHCP for network address assignment.

D.Standard static IP filtering.

E.Cisco ISE for policy enforcement.

AnswersA, B, E

Cisco Secure Endpoint supplies continuous device posture telemetry, feeding endpoint compliance signals into the Zero Trust policy engine. This satisfies the architecture's requirement for verified device trust before granting access, complementing identity and network components. Posture assessment is a core pillar, so this component belongs in the robust design.

Why this answer

Cisco Secure Endpoint is correct (A) because it provides endpoint detection and response plus device posture signals that Zero Trust needs to continuously assess device trust before granting access. Cisco Duo is correct (B) because it delivers strong multi-factor user authentication and device trust verification, which are foundational to verifying identity in a Zero Trust for the Workplace architecture. Cisco ISE is correct (E) because it acts as the policy decision and enforcement point, using identity, posture, and context to dynamically authorize and segment network access.

DHCP (C) only assigns IP addresses and provides no identity, posture, or policy enforcement capability, so it is not a Zero Trust component. Standard static IP filtering (D) is a legacy, location-based control that cannot verify user or device trust and therefore does not belong in a Zero Trust architecture.

Exam trap

SDSI often tests whether candidates confuse foundational network services (DHCP, static IP filtering) with the identity, posture, and policy components that actually constitute a Zero Trust architecture.

Full explanation →

MCQmedium

To secure API endpoints exposed via Cisco Secure API Gateway, which policy type is best suited to prevent brute-force attacks on authentication endpoints?

A.Identity Propagation Policy

B.Schema Validation Policy

C.Rate Limiting Policy

D.Transformation Policy

AnswerC

Rate Limiting Policy caps requests per client within a time window, throttling the high-volume repeated authentication attempts that define brute-force attacks. It targets the attack's volume characteristic at the gateway before requests reach backend authentication services.

Why this answer

A Rate Limiting Policy is best suited to prevent brute-force attacks on authentication endpoints because it restricts the number of requests a client can make within a specified time window. This mitigates repeated login attempts that characterize brute-force attacks.

Exam trap

SDSI often tests the specific purpose of each API gateway policy type — candidates may confuse rate limiting with schema validation or identity propagation, but only rate limiting directly addresses brute-force by controlling request frequency.

How to eliminate wrong answers

Option A is wrong because Identity Propagation Policy is used to pass user identity information to backend services, not to limit request rates. Option B is wrong because Schema Validation Policy ensures that API requests conform to a defined schema, which can prevent malformed requests but does not stop brute-force attacks. Option D is wrong because Transformation Policy modifies request or response payloads, which is unrelated to rate limiting.

Full explanation →

MCQmedium

When designing for SaaS security, why should you implement a 'Least Privilege' policy for third-party application integrations?

A.To avoid paying license fees

B.To improve the application's performance

C.To make the application easier to install

D.To limit the impact if the third-party application is compromised

AnswerD

Least privilege grants each integration only the scopes it genuinely requires, so a compromised third-party application cannot abuse excessive permissions to reach unrelated data or perform privileged actions. This containment directly limits blast radius, matching the stated design goal.

Why this answer

Least privilege limits the permissions granted to a third-party integration to only what it strictly needs, so if that third party is breached, the attacker inherits only that narrow scope rather than broad access to the SaaS tenant. This directly reduces blast radius and is a core Zero Trust and SaaS security control. It is a security control, not a licensing, performance, or usability feature.

Exam trap

SDSI often tests whether candidates conflate security principles with operational benefits — options like 'improve performance' or 'reduce cost' sound plausible but miss the actual risk-reduction rationale behind least privilege.

How to eliminate wrong answers

Option A is wrong because least privilege is a security principle unrelated to licensing; license fees are determined by seat count, API call volume, or tier, not by permission scope. Option B is wrong because restricting permissions does not improve performance — if anything, additional authorization checks add negligible latency, and performance is governed by infrastructure, caching, and query efficiency. Option C is wrong because least privilege typically makes installation more complex, not easier, since you must enumerate and grant only the specific scopes required rather than a blanket admin token.

Full explanation →

MCQmedium

In a post-incident design, which tool should be used to provide visibility into user activity across multiple SaaS applications?

A.Cisco ISE.

B.Cisco Stealthwatch.

C.Cisco Secure Firewall.

D.Cisco Umbrella (with CASB).

AnswerD

Cisco Umbrella's CASB component discovers sanctioned and unsanctioned SaaS usage and reports user activity across those applications, satisfying the multi-SaaS visibility requirement. Its cloud-native proxy logs API-based activity from integrated services, giving the post-incident view the stem demands.

Why this answer

Cisco Umbrella with CASB provides visibility and control over user activity across SaaS applications by combining DNS-layer security with cloud access security broker capabilities. CASB discovers shadow SaaS usage, enforces policies, and provides activity visibility across sanctioned and unsanctioned apps. ISE is identity/NAC, Stealthwatch is network flow analytics, and Secure Firewall is perimeter/IPS — none deliver SaaS application activity visibility the way Umbrella CASB does.

Exam trap

The trap is picking a network security tool (Stealthwatch, Secure Firewall) for SaaS activity visibility; the exam expects you to recognize CASB (Umbrella with CASB) as the SaaS visibility layer.

How to eliminate wrong answers

Option A is wrong because Cisco ISE provides identity and network access control, not SaaS application activity visibility. Option B is wrong because Cisco Stealthwatch analyzes network flows for anomalies and threats, but does not provide per-user SaaS application activity visibility. Option C is wrong because Cisco Secure Firewall enforces network security policy and IPS at the perimeter, but lacks the CASB-level SaaS application discovery and user activity insight.

Full explanation →

MCQhard

In an SD-WAN architecture, how does the design ensure the security of traffic between branches?

A.Configuring static VPN keys.

B.Using clear-text GRE tunnels.

C.Relying on MPLS provider security.

D.Enabling automated IPsec tunnels with IKEv2.

AnswerD

Automated IPsec tunnels with IKEv2 encrypt all branch-to-branch traffic across the transport, providing confidentiality and integrity regardless of the underlying WAN. IKEv2 handles key negotiation and rekeying, satisfying the stem's requirement for securing inter-branch traffic.

Why this answer

In SD-WAN, security between branches is achieved by automatically establishing IPsec tunnels using IKEv2. This provides encryption, integrity, and authentication for all traffic traversing the overlay network, regardless of the underlying transport (MPLS, internet, LTE). The automation ensures consistent policy enforcement and scalability across thousands of sites without manual key management.

Exam trap

SDSI often tests the misconception that MPLS or GRE alone can secure branch traffic, but the key is that SD-WAN automates IPsec with IKEv2 for scalable, secure connectivity.

How to eliminate wrong answers

Option A is wrong because static VPN keys are not scalable and lack the dynamic key exchange and rotation provided by IKEv2, making them vulnerable to compromise and operationally burdensome. Option B is wrong because clear-text GRE tunnels provide no encryption or authentication, leaving traffic exposed to eavesdropping and tampering. Option C is wrong because relying on MPLS provider security assumes the provider's network is trusted and does not protect traffic over untrusted links like the internet; SD-WAN typically uses IPsec over any transport.

Full explanation →

MCQhard

When designing for multi-cloud, why is an orchestration layer for security policy so important?

A.To increase the performance of the cross-cloud traffic

B.To reduce the cost of the cloud service

C.To eliminate the need for cloud-native firewalls

D.To ensure consistent policy enforcement across heterogeneous environments

AnswerD

Each cloud provider exposes distinct native policy constructs, so an orchestration layer translates one intent into each environment's enforcement mechanism. This satisfies the stem's multi-cloud design requirement by eliminating per-provider policy drift and guaranteeing uniform rules across heterogeneous platforms.

Why this answer

An orchestration layer for security policy is crucial in multi-cloud because it abstracts the underlying cloud-native security controls (e.g., AWS Security Groups, Azure NSGs, GCP Firewall Rules) and provides a single point of policy definition and enforcement. This ensures that security policies are applied consistently across all clouds, regardless of the differences in native tools, APIs, and policy models. Without such a layer, organizations risk policy drift, misconfigurations, and gaps that attackers can exploit.

Thus, it directly addresses the challenge of maintaining uniform security posture in heterogeneous environments.

Exam trap

SDSI often tests the misconception that orchestration layers replace native security controls or improve performance/cost, when their primary value is consistent policy enforcement across heterogeneous environments.

How to eliminate wrong answers

Option A is wrong because orchestration layers focus on policy consistency, not network performance; they may even add slight latency due to abstraction. Option B is wrong because orchestration tools add management overhead and licensing costs; cost reduction is not their primary purpose and may not be achieved. Option C is wrong because orchestration layers typically integrate with, not replace, cloud-native firewalls; they rely on native controls for enforcement, so eliminating them is neither feasible nor desirable.

Full explanation →

Multi-Selecthard

Which THREE criteria should be used to design microsegmentation policies in Cisco Secure Workload? (Choose THREE)

Select 3 answers

A.Workload attributes and labels (metadata)

B.Connectivity telemetry and flow history

C.Physical switch port IDs

D.Application processes and behavioral patterns

E.Dynamic IP addresses of the servers

AnswersA, B, D

Labels and attributes supply the metadata dimension Secure Workload needs to build policy scopes, letting rules target workloads by role, environment or tag rather than by IP address, which satisfies the requirement to design microsegmentation around dynamic workload identity.

Why this answer

Option A is correct because Cisco Secure Workload builds microsegmentation policies around workload attributes and labels (metadata such as role, environment, application, and location), which are used to define policy scopes and group workloads logically rather than by network topology. Option B is correct because Secure Workload relies on connectivity telemetry and flow history collected from the workloads to discover actual communication patterns and generate allow-list policies based on observed dependencies. Option D is correct because application processes and behavioral patterns are analyzed to identify which processes communicate, enabling process-level (Layer 7) policy enforcement rather than just IP/port rules.

Option C is not correct because physical switch port IDs are not used as a policy construct in Secure Workload; policies are workload-centric, not tied to switch port locations. Option E is not correct because dynamic IP addresses are unreliable identifiers in modern environments and Secure Workload deliberately abstracts policy away from IP addresses by using labels and metadata instead.

Exam trap

SDSI often tests whether candidates understand that microsegmentation is identity- and behavior-based, not topology-based — the trap is selecting IP addresses or switch ports because they feel concrete, when Secure Workload explicitly abstracts away from those volatile identifiers.

Full explanation →

MCQmedium

A security architect is configuring Cisco SecureX for the first time. Which is the most important step to enable centralized incident response?

A.Setting the dashboard background color.

B.Manually uploading log files.

C.Renaming all the products in the dashboard.

D.Integrating product API credentials (e.g., Secure Endpoint, Umbrella).

AnswerD

SecureX achieves centralised incident response only by pulling telemetry and response actions from each integrated product, which requires supplying API credentials for Secure Endpoint, Umbrella and similar tools. Without those credentials no data or remediation capability flows into the platform, so this step underpins the entire centralised workflow.

Why this answer

Cisco SecureX aggregates data and enables automated workflows across Cisco security products by integrating their APIs. To enable centralized incident response, you must integrate product API credentials (e.g., Secure Endpoint, Umbrella, Firepower) so SecureX can pull events, correlate them, and trigger response actions. Without API integration, SecureX has no data to work with.

Exam trap

SDSI often tests the misconception that SecureX works out-of-the-box without integration — candidates pick cosmetic or manual options, but the exam expects you to know that API credential integration is the foundational step for centralized incident response.

How to eliminate wrong answers

Option A is wrong because dashboard background color is purely cosmetic and has no functional impact on incident response. Option B is wrong because manually uploading log files is not how SecureX ingests data — it uses API integrations for continuous, automated telemetry, and manual uploads would not scale or provide real-time response. Option C is wrong because renaming products in the dashboard is a display customization and does not enable any incident-response capability.

Full explanation →

MCQhard

When designing for API security, how does Cisco API Security provide protection against 'Excessive Data Exposure' vulnerabilities?

A.By implementing strict rate limiting on all users

B.By automatically blocking all outgoing API traffic

C.By replacing all API keys with OAuth tokens

D.By analyzing response schemas to detect sensitive data in API payloads

AnswerD

Cisco API Security inspects API response schemas and payloads, identifying fields returning sensitive data beyond what the endpoint's purpose requires. This detection satisfies the Excessive Data Exposure constraint by flagging over-permissive responses before attackers harvest them.

Why this answer

Cisco API Security analyzes API response schemas and payloads to identify when endpoints return more data than the client actually needs, which is the definition of Excessive Data Exposure (OWASP API #3). By flagging sensitive fields (PII, tokens, internal IDs) in responses, it lets designers trim payloads before attackers can harvest them.

Exam trap

SDSI often tests whether candidates conflate authentication/authorization controls (OAuth, rate limiting) with data-minimization controls, so picking OAuth or rate limiting for Excessive Data Exposure is the classic wrong answer.

How to eliminate wrong answers

Option A is wrong because rate limiting addresses brute-force and DoS-style abuse (OWASP API #4), not the over-sharing of data in responses. Option B is wrong because blocking all outgoing API traffic would break the API entirely and is not a security control for data exposure. Option C is wrong because replacing API keys with OAuth tokens improves authentication and authorization but does nothing to prevent an authorized client from receiving excessive data in a response.

Full explanation →

MCQhard

A security architect is designing a solution to meet a regulatory requirement that all administrative access to network devices must be authenticated with multi-factor authentication (MFA) and that all commands executed by administrators must be logged and auditable. Which Cisco solution should be integrated into the design?

A.Cisco Secure Firewall Management Center with RADIUS authentication

B.Cisco Umbrella with Active Directory integration

C.Cisco Identity Services Engine (ISE) with TACACS+ and external MFA integration

D.Cisco Secure Network Analytics with LDAP authentication

AnswerC

ISE can act as a TACACS+ server to provide centralized authentication, authorization, and accounting for network device administrative access. It integrates with external MFA providers to enforce multi-factor authentication. Additionally, ISE logs all commands executed, providing the audit trail required by the regulation.

Why this answer

The requirement is for MFA and command auditing for network device administrative access. Cisco ISE with TACACS+ provides centralized device administration, integrates with MFA providers, and logs all commands. This meets the regulatory requirements for authentication and auditability.

Exam trap

The trap here is confusing management platform authentication with network device administrative access control, which requires TACACS+ or RADIUS.

Full explanation →

MCQmedium

When designing an architecture to mitigate the risk of data exfiltration, which Cisco solution provides visibility into the data being sent out of the organization?

A.Cisco Secure Firewall with TLS Inspection.

B.Cisco Umbrella (DNS only).

C.Cisco ISE.

D.Cisco Stealthwatch.

AnswerA

Secure Firewall decrypts outbound TLS sessions, inspects the plaintext payload against file and data policies, then logs or blocks the flow. TLS inspection is essential because encrypted egress otherwise hides exactly what data is leaving the organisation.

Why this answer

Cisco Secure Firewall with TLS Inspection is correct because it decrypts outbound TLS/SSL sessions, allowing the firewall's application-layer engines (Snort/IPS, URL filtering, file inspection) to see the actual payload leaving the organization. Without TLS inspection, encrypted exfiltration traffic is opaque to the firewall. This gives the deepest payload-level visibility into data being sent externally, which is exactly what exfiltration mitigation requires.

Exam trap

The trap here is confusing metadata-level visibility (NetFlow, DNS) with payload-level visibility — candidates pick Stealthwatch or Umbrella because they 'see traffic,' but only TLS inspection reveals the actual data content.

How to eliminate wrong answers

Option B is wrong because Cisco Umbrella (DNS only) can only see domain-name resolution requests, not the content of the data being transmitted — it can block known-bad domains but cannot inspect payloads for sensitive data. Option C is wrong because Cisco ISE is a network access control and identity policy platform (802.1X, MAB, profiling, posture, TrustSec), not a data-inspection or exfiltration-visibility tool. Option D is wrong because Cisco Stealthwatch (now Secure Network Analytics) analyzes NetFlow/IPFIX metadata for anomaly and threat detection — it sees flow patterns, not the actual data content being exfiltrated.

Full explanation →

MCQhard

You are designing the control plane security for a Cisco switch. Which feature limits the amount of traffic sent to the CPU, protecting it from DoS attacks?

A.Control Plane Policing (CoPP)

B.Port Security

C.Storm Control

D.DHCP Snooping

AnswerA

Control Plane Policing applies a QoS policy to traffic destined for the switch CPU, rate-limiting control-plane packets so a flood cannot overwhelm the processor. This satisfies the requirement to protect the CPU from denial-of-service attacks.

Why this answer

Control Plane Policing (CoPP) is a Cisco IOS feature that limits the amount of traffic sent to the CPU by applying QoS policies to control-plane traffic, protecting the route processor from DoS attacks and CPU overload. It classifies traffic destined to the control plane and rate-limits or drops it according to configured policy.

Exam trap

SDSI often tests whether candidates can distinguish CPU/control-plane protection (CoPP) from Layer 2 port-level protections (Port Security, Storm Control, DHCP Snooping), catching those who pick a familiar security feature without matching it to the control-plane DoS scenario.

How to eliminate wrong answers

Option B is wrong because Port Security restricts which MAC addresses can connect to a switch port, preventing MAC flooding and unauthorized device access — it does not protect the CPU from traffic floods. Option C is wrong because Storm Control limits broadcast, multicast, or unknown unicast traffic on a port to prevent storms, but it does not specifically police control-plane traffic to the CPU. Option D is wrong because DHCP Snooping prevents rogue DHCP servers and DHCP starvation attacks, not general control-plane DoS.

Full explanation →

MCQhard

A network security designer is planning segmentation for a new data center that uses Cisco Nexus switches with Cisco Application Centric Infrastructure (ACI). The design must enforce east-west microsegmentation between web, app, and database endpoint groups (EPGs) based on Layer 4 ports and allow a security team to insert a service graph for inspection. Which ACI construct should be used to define the permitted communication?

A.Contracts with filters applied between EPGs

B.VRF instances with route leaking between tenants

C.Tenant policies with external routed networks and L3Outs

D.Access policies with VLAN pools and interface profiles

AnswerA

In Cisco ACI, contracts define the communication policy between EPGs. A contract contains subjects and filters that specify Layer 3 and Layer 4 parameters such as protocol and port. By applying a contract between web, app, and database EPGs, the designer enforces east-west microsegmentation with precise Layer 4 control. Contracts also support service graph insertion for inspection, so this construct meets both the segmentation and service insertion requirements.

Why this answer

Cisco ACI uses contracts to define allowed communication between EPGs. Contracts contain subjects and filters that specify Layer 3 and Layer 4 parameters, enabling precise east-west microsegmentation. They also support service graph insertion, allowing a firewall or load balancer to be inserted between EPGs for inspection.

The other constructs address connectivity, isolation, or fabric access but do not provide the required port-level policy and service insertion.

Exam trap

The trap here is confusing VRF-based isolation with contract-based microsegmentation, when VRFs only provide Layer 3 separation and cannot enforce Layer 4 port filtering between EPGs.

Full explanation →

MCQhard

For a DevSecOps pipeline involving Cisco Secure Firewall, what is the 'CI' (Continuous Integration) component responsible for?

A.User access authentication

B.Monitoring runtime attacks

C.Deploying to production

D.Validating and testing code changes

AnswerD

Validating and testing code changes is precisely what Continuous Integration performs: developers merge to a shared repository, triggering automated builds and tests that surface defects early. This satisfies the pipeline's need to verify each change before deployment, ensuring only tested code reaches the Cisco Secure Firewall configuration stages.

Why this answer

In a DevSecOps pipeline for Cisco Secure Firewall, the Continuous Integration (CI) component is responsible for validating and testing code changes — automatically building, linting, and running tests on firewall policy or automation code before it is merged. This ensures that changes meet quality and security standards before progressing to deployment.

Exam trap

SDSI often tests the distinction between CI and CD — candidates confuse 'validating and testing code changes' (CI) with 'deploying to production' (CD), especially in the context of security automation.

How to eliminate wrong answers

Option A is wrong because user access authentication is handled by identity and access management systems, not the CI stage of a DevSecOps pipeline. Option B is wrong because monitoring runtime attacks is part of security operations and continuous monitoring, not CI. Option C is wrong because deploying to production is the Continuous Deployment/Delivery (CD) stage, which occurs after CI has validated the code.

Full explanation →

MCQhard

A design architect is deploying a Cisco Secure Firewall in a High Availability (HA) pair. Which configuration is required to ensure stateful failover across firewalls?

A.Stateful failover link

B.HSRP on the interfaces

C.Control plane sync via FMC

D.VSS for Firewall

AnswerA

A dedicated stateful failover link synchronises connection tables and session state between the HA peers, so established flows survive a failover without re-establishment. Without it, the standby unit cannot replicate sessions, breaking the stateful requirement in the stem.

Why this answer

Stateful failover in a Cisco Secure Firewall HA pair requires a dedicated stateful failover link (also called the failover interface) that synchronizes connection state, translation tables, and other runtime data between the active and standby units. Without this link, failover is stateless and existing connections are dropped, breaking user sessions. The stateful failover link is the configuration element that enables seamless session continuity.

Exam trap

SDSI often tests whether candidates confuse management-plane synchronization (FMC) or first-hop redundancy (HSRP) with the data-plane stateful failover link, so the trap is selecting a management or routing protocol instead of the dedicated stateful failover interface.

How to eliminate wrong answers

Option B is wrong because HSRP is a first-hop redundancy protocol for IP gateway failover; it does not synchronize firewall connection state and is not the mechanism that provides stateful failover. Option C is wrong because FMC (Firepower Management Center) provides centralized management and configuration sync, but it does not carry the runtime stateful failover traffic between HA peers — that is done over the dedicated failover link. Option D is wrong because VSS (Virtual Switching System) is a Cisco Catalyst switch technology for combining two switches into one logical switch; it is not applicable to firewall HA stateful failover.

Full explanation →

MCQmedium

Which design principle is most important when implementing microsegmentation in an environment with high workload volatility (e.g., auto-scaling groups)?

A.Use label-based dynamic security policies

B.Manually update firewall rules when scaling

C.Disable scaling to maintain network stability

D.Use IP-based static access control lists

AnswerA

Label-based dynamic policies attach security rules to workload identity labels rather than fixed IP addresses, so auto-scaling groups that constantly create and destroy instances inherit correct segmentation automatically. This satisfies the high-volatility constraint where static address-based rules would break.

Why this answer

In environments with high workload volatility, such as auto-scaling groups, IP addresses change frequently, making IP-based policies impractical. Label-based dynamic security policies allow microsegmentation rules to follow workloads as they scale, because labels are applied to pods or instances and policies reference those labels rather than ephemeral IPs. This ensures consistent security enforcement regardless of scaling events.

Exam trap

SDSI often tests the trade-off between static IP-based controls and dynamic label-based controls — candidates may default to IP-based thinking, but volatility makes labels the correct choice.

How to eliminate wrong answers

Option B is wrong because manually updating firewall rules when scaling is operationally unsustainable and error-prone in volatile environments; it defeats the purpose of automation and introduces security gaps during scaling events. Option C is wrong because disabling scaling to maintain network stability sacrifices the elasticity and cost benefits of cloud-native architectures, and it is not a viable security strategy. Option D is wrong because IP-based static access control lists cannot keep pace with dynamic IP assignments in auto-scaling groups, leading to stale rules and either over-permissive or broken connectivity.

Full explanation →

MCQmedium

Why is it important to include 'Application Context' when defining microsegmentation policies in Cisco Secure Workload?

A.To bypass the need for firewall rules

B.To align security policies with business and application logic

C.To make the policy easier to read for network admins

D.To reduce the amount of memory consumed by the agent

AnswerB

Application Context maps workloads to their business roles, letting policies express intent such as "web tier may reach database tier" rather than raw IP sets. This satisfies the stem's requirement by tying enforcement to application logic, so microsegmentation rules remain accurate as addresses change and reflect genuine business relationships.

Why this answer

Application Context lets microsegmentation policies be expressed in terms of application tiers, roles, and business logic (e.g., 'web tier to app tier') rather than raw IPs and ports. This aligns security with how the business actually operates, makes policies meaningful and maintainable, and ensures enforcement follows the application even as IPs change. It is about semantic alignment, not performance or readability alone.

Exam trap

The trap is choosing 'easier to read' because it sounds reasonable — but the exam tests whether you understand that Application Context exists to bind security policy to business/application logic, not merely to improve documentation.

How to eliminate wrong answers

Option A is wrong because Application Context does not bypass firewall rules — it informs how microsegmentation policies are defined and enforced; firewalls still exist in the architecture. Option C is wrong because while readable policies are a side benefit, the primary reason is business/application alignment, not admin convenience — the exam wants the security rationale. Option D is wrong because Application Context is a policy-modeling concept and has no bearing on agent memory consumption.

Full explanation →

100

Multi-Selecthard

When designing a post-incident security architecture, which THREE factors are critical for determining the placement of Cisco Secure Firewall sensors?

Select 3 answers

A.The number of users connected to the local office Wi-Fi.

B.Local temperature of the server room.

C.Physical segmentation of the network (VLANs/VRFs).

D.Availability of mirror ports or TAP points for traffic inspection.

E.Traffic throughput capacity of the firewall hardware.

AnswersC, D, E

VLANs and VRFs define the physical and logical segmentation boundaries within the network. Sensor placement must align with these boundaries so inspection points sit at trust transitions between segments, satisfying the requirement to monitor inter-segment traffic.

Why this answer

Option C is correct because the physical and logical segmentation of the network (VLANs and VRFs) dictates where a sensor can be inserted and which traffic flows it can observe, since a firewall sensor must sit at a boundary between segments to inspect inter-segment traffic. Option D is correct because placing a sensor requires either a SPAN/mirror port on a switch or a network TAP to copy traffic for inspection; without such a monitoring point, the sensor cannot passively receive the packets it needs to analyze. Option E is correct because the firewall hardware's traffic throughput capacity must match or exceed the volume of traffic at the proposed placement, otherwise the sensor will drop packets or become a bottleneck, undermining both security and availability.

Option A does not belong because the count of Wi-Fi users is a rough scale indicator, not a determinant of sensor placement, which depends on traffic paths and segmentation rather than user population. Option B does not belong because server room temperature is a facilities/environmental concern and has no bearing on where a network security sensor is logically or physically positioned.

Exam trap

SDSI often tests the confusion between environmental factors (like temperature) and network architecture factors; candidates may select user count or temperature instead of segmentation, TAP availability, and throughput.

Full explanation →

101

MCQmedium

A network security designer is planning a Cisco Identity Services Engine deployment for a large campus with 20,000 endpoints. The design requires high availability and the ability to enforce differentiated authorization policies for wired and wireless users. Which design approach best meets these requirements while minimizing single points of failure?

A.Deploy two standalone ISE nodes and configure them as a failover pair using VRRP.

B.Deploy a single ISE node with a large VM and enable all personas on the same node.

C.Deploy a single standalone ISE node with a backup database.

D.Deploy a distributed ISE deployment with two Policy Administration Nodes and multiple Policy Service Nodes in different locations.

AnswerD

A distributed deployment separates the Policy Administration Node (PAN) from Policy Service Nodes (PSNs), allowing PSNs to handle authentication and authorization independently. With two PANs for redundancy and multiple PSNs across locations, the design provides high availability and can enforce differentiated policies for wired and wireless users, meeting the scale and resiliency requirements.

Why this answer

A distributed ISE deployment with redundant PANs and multiple PSNs provides the high availability and scalability required for a large campus. PSNs handle authentication and authorization, while PANs manage configuration and policy. This separation allows differentiated policies for wired and wireless users and eliminates single points of failure.

Exam trap

The trap here is assuming that any redundant ISE node configuration provides high availability, when in fact only a distributed deployment with separate PAN and PSN roles meets the scale and policy differentiation requirements.

Full explanation →

102

MCQmedium

In a Cisco Container Platform (CCP) environment, you need to ensure that pod-to-pod traffic within the same namespace is inspected for malicious patterns. Which design decision satisfies this requirement?

A.Use Kubernetes Network Policies to drop traffic

B.Deploy a service mesh to implement mutual TLS and traffic monitoring

C.Implement a Cisco Firepower NGIPS at the perimeter

D.Redirect all inter-pod traffic to an external load balancer

AnswerB

A service mesh with mutual TLS encrypts and authenticates pod-to-pod traffic, and its sidecar proxies enable inspection of that traffic for malicious patterns within the namespace. This satisfies the requirement without relying on host-level agents alone.

Why this answer

Deploying a service mesh provides sidecar proxies that can inspect pod-to-pod traffic within a namespace, enforce mutual TLS, and surface L7 telemetry for anomaly detection. This gives the required visibility and inspection of east-west traffic without relying on perimeter controls.

Exam trap

SDSI often tests whether candidates understand that perimeter IPS and Network Policies cannot inspect east-west pod traffic, so choosing a firewall or Network Policy for intra-namespace inspection is the standard trap.

How to eliminate wrong answers

Option A is wrong because Kubernetes Network Policies only allow or deny traffic based on L3/L4 selectors — they cannot inspect payloads for malicious patterns. Option C is wrong because a perimeter NGIPS inspects north-south traffic entering or leaving the cluster and cannot see intra-namespace pod-to-pod flows that never leave the node or cluster overlay. Option D is wrong because redirecting inter-pod traffic to an external load balancer adds latency, breaks the flat pod network model, and still does not provide deep inspection of east-west payloads.

Full explanation →

103

MCQeasy

When configuring a Cisco ASA/Firepower firewall, what is the 'inside' interface typically used for?

A.To connect to the trusted internal network.

B.To connect to the untrusted internet.

C.To connect to the DMZ.

D.To connect to the management network.

AnswerA

The inside interface faces the protected internal network, so security policies treat its traffic as trusted relative to the outside interface. This matches the stem's requirement, since the ASA/Firepower applies higher trust levels and less restrictive inspection to connections originating from that segment.

Why this answer

On a Cisco ASA/Firepower firewall, the 'inside' interface is the trusted network, typically the internal LAN where protected resources reside. It has a higher security level (default 100) than the 'outside' interface (default 0), allowing traffic to flow from inside to outside by default. This is the standard configuration for perimeter firewalls.

Exam trap

SDSI often tests the default security levels and interface naming conventions, tricking candidates who confuse the DMZ or management interface with the 'inside' interface.

How to eliminate wrong answers

Option B is wrong because the 'outside' interface connects to the untrusted internet. Option C is wrong because the DMZ is usually a separate interface (often called 'dmz') with a security level between inside and outside. Option D is wrong because the management network is typically a dedicated interface or VLAN, not the 'inside' interface.

Full explanation →

104

MCQhard

When designing a secure multi-cloud strategy for applications, how does Cisco Secure Workload facilitate consistent policy management?

A.By forcing all traffic to transit a VPN tunnel

B.By moving all traffic through a centralized Cisco hardware firewall

C.By providing a centralized policy plane that integrates with native cloud security controls

D.By manually creating ACLs in each cloud provider console

AnswerC

Cisco Secure Workload defines policy once in a centralised plane and translates it into each cloud provider's native constructs, such as security groups and network ACLs. This satisfies the multi-cloud constraint by removing per-cloud policy drift and inconsistent enforcement across environments.

Why this answer

Cisco Secure Workload provides a centralized policy plane that integrates with native cloud security controls (e.g., AWS Security Groups, Azure NSGs, GCP firewall rules) to enforce consistent micro-segmentation policies across multi-cloud environments. This allows a single policy definition to be translated and applied natively in each cloud, avoiding vendor lock-in and manual per-cloud configuration. The centralized plane maintains visibility and enforcement consistency regardless of where workloads run.

Exam trap

The trap here is confusing 'centralized management' with 'centralized traffic inspection'—candidates may pick a hardware firewall or VPN because they think centralization means funneling traffic through a single point, but Secure Workload centralizes policy, not packets.

How to eliminate wrong answers

Option A is wrong because forcing all traffic through a VPN tunnel does not provide consistent policy management; it only encrypts transport and does not address micro-segmentation or policy orchestration across clouds. Option B is wrong because a centralized hardware firewall creates a hairpin bottleneck and does not integrate with native cloud controls, defeating the purpose of a multi-cloud strategy. Option D is wrong because manually creating ACLs in each cloud console is error-prone, non-scalable, and the opposite of centralized policy management.

Full explanation →

105

MCQhard

In a Cisco SD-WAN environment, you need to ensure that branch office traffic destined for SaaS applications is optimized and secured. Which design approach is most appropriate?

A.Implementing Cisco Umbrella SIG integration on the SD-WAN edge devices for DIA.

B.Using static routing to bypass all security policies for trusted SaaS domains.

C.Deploying a dedicated physical firewall at every branch office.

D.Hair-pinning all SaaS traffic back to the corporate headend for inspection.

AnswerA

Cisco Umbrella SIG integrated on SD-WAN edge devices routes SaaS traffic directly to the internet while applying cloud-delivered DNS-layer security, CASB and SWG inspection. This satisfies both constraints: local internet breakout optimises SaaS performance, and SIG enforcement secures that direct access path.

Why this answer

In a Cisco SD-WAN environment, optimizing and securing branch traffic to SaaS applications is best achieved by integrating Cisco Umbrella SIG (Secure Internet Gateway) on the SD-WAN edge devices and using Direct Internet Access (DIA). This approach allows branch traffic to break out locally to the internet, where Umbrella enforces security policies (e.g., DNS-layer security, URL filtering, CASB) without backhauling to the corporate headend. This reduces latency and improves performance for SaaS apps while maintaining security.

The other options either bypass security, add unnecessary hardware, or reintroduce backhauling.

Exam trap

SDSI often tests the misconception that hair-pinning all traffic to the headend is necessary for security, when in fact DIA with cloud security (Umbrella SIG) is the recommended design for SaaS optimization.

How to eliminate wrong answers

Option B is wrong because using static routing to bypass all security policies for trusted SaaS domains creates a security hole and does not provide any optimization; it simply ignores security. Option C is wrong because deploying a dedicated physical firewall at every branch office is costly, complex, and not scalable; it also does not leverage SD-WAN's integration with cloud security. Option D is wrong because hair-pinning all SaaS traffic back to the corporate headend for inspection increases latency, consumes headend bandwidth, and defeats the purpose of DIA, which is to optimize SaaS access.

Full explanation →

106

MCQmedium

You are designing an IoT network segment. Which technology allows you to verify device identity at the hardware level?

A.MAC Authentication Bypass (MAB).

B.SNMPv3.

C.Static IP filtering.

D.802.1X with EAP-TLS.

AnswerD

802.1X enforces port-based network access control, and EAP-TLS authenticates each device using a client certificate, binding identity to a hardware-held credential. This certificate-based mutual authentication verifies device identity at the hardware level, satisfying the IoT segment requirement.

Why this answer

802.1X with EAP-TLS is correct because it performs mutual certificate-based authentication at the network access layer, where the supplicant's identity is proven using a digital certificate stored in a hardware-protected module (TPM or secure element). This binds the device identity to cryptographic keys that cannot be easily spoofed, unlike MAC or IP addresses. The hardware-level verification comes from the certificate's private key being protected by the device's hardware root of trust, making it resistant to cloning.

Exam trap

SDSI often tests the misconception that MAC address filtering or MAB provides hardware-level security, but these are easily spoofed; the key is recognizing that only certificate-based methods like EAP-TLS with hardware-protected keys achieve true device identity verification.

How to eliminate wrong answers

Option A is wrong because MAB relies solely on the MAC address, which is easily spoofed in software and provides no cryptographic proof of identity. Option B is wrong because SNMPv3 is a management protocol for monitoring and configuration, not an authentication mechanism for network access; it does not verify device identity at the hardware level. Option C is wrong because static IP filtering only checks the source IP address, which can be trivially spoofed and offers no hardware binding.

Full explanation →

107

MCQeasy

Which protocol is recommended for secure network time synchronization across security devices?

A.SNMP

B.HTTP

C.NTP with Authentication

D.DHCP

AnswerC

NTP with Authentication secures time synchronisation by appending a cryptographic Message Authentication Code to each packet, letting devices verify the sender and reject spoofed responses. This satisfies the stem's requirement for secure synchronisation across security devices, where unauthenticated NTP traffic could be manipulated to skew timestamps and undermine log correlation.

Why this answer

NTP with Authentication (such as NTPv4 with symmetric key authentication or Autokey) ensures that time synchronization messages are authenticated, preventing spoofing and man-in-the-middle attacks. Secure network time synchronization is critical for security devices because inaccurate time can break certificate validation, log correlation, and authentication protocols like Kerberos. Plain NTP is vulnerable to spoofing, so authentication is recommended.

Exam trap

SDSI often tests the importance of authentication for time synchronization, and candidates may overlook that plain NTP is insecure and that authentication is required for security devices.

How to eliminate wrong answers

Option A is wrong because SNMP is used for network management and monitoring, not time synchronization. Option B is wrong because HTTP is an application-layer protocol for web traffic and does not provide time synchronization. Option D is wrong because DHCP is used for IP address assignment and does not synchronize time, although DHCP options can provide NTP server addresses, it is not a time sync protocol itself.

Full explanation →

108

MCQhard

In a DevSecOps environment, you need to implement Cisco Secure Firewall Management Center (FMC) rule updates via Ansible. Which approach ensures the highest level of security and idempotency?

A.Manually updating via FMC UI then exporting JSON

B.Pushing configuration snapshots via SCP

C.Executing raw REST API calls via shell scripts

D.Utilizing the cisco.fmc Ansible collection

AnswerD

The cisco.fmc collection wraps FMC's REST API in declarative modules, so Ansible compares desired rule state against current configuration and applies only deltas. This delivers idempotency, while HTTPS with token-based authentication secures credential handling, satisfying the DevSecOps requirement for repeatable, secure rule updates.

Why this answer

The cisco.fmc Ansible collection is purpose-built to manage Cisco Secure Firewall Management Center through its REST API, exposing declarative modules that are natively idempotent and support secure credential handling via Ansible Vault. It abstracts raw API calls into state-based tasks, so repeated playbook runs converge on the desired rule set without duplicating or corrupting policy objects. This delivers both the security (encrypted secrets, authenticated API sessions) and idempotency required in a DevSecOps pipeline.

Exam trap

SDSI often tests whether candidates confuse 'automation' with 'idempotency' — raw API scripts and SCP snapshots look automated but are not state-aware, which is the specific property the question demands.

How to eliminate wrong answers

Option A is wrong because manual UI updates followed by JSON export are non-idempotent, unauditable, and cannot be safely automated or version-controlled. Option B is wrong because SCP snapshot pushes overwrite entire configurations blindly, lack state awareness, and bypass FMC's API validation, risking policy corruption. Option C is wrong because raw REST calls via shell scripts are not idempotent by default, require custom error handling, and often embed credentials insecurely in scripts.

Full explanation →

109

Multi-Selectmedium

Which THREE actions are essential for maintaining a secure SaaS posture using Cloudlock? (Choose THREE)

Select 3 answers

A.Monitor for anomalous user behavior (UEBA)

B.Review and prune unauthorized third-party application integrations

C.Continuously monitor and update DLP policies

D.Disable all public internet access

E.Update all enterprise server drivers

AnswersA, B, C

Cloudlock's UEBA baselines normal SaaS activity per user and application, then flags deviations such as impossible travel, mass downloads or unusual API calls. This satisfies the stem's secure SaaS posture requirement by detecting compromised accounts and insider misuse that static policy alone cannot surface.

Why this answer

Option A is correct because Cloudlock (Cisco Cloudlock/Cisco Cloud Security) provides User and Entity Behavior Analytics (UEBA) that baselines normal SaaS activity and flags anomalous behavior such as impossible travel, mass downloads, or unusual login patterns, which is essential to a secure SaaS posture. Option B is correct because Cloudlock's Cloud App Analytics and CASB capabilities surface OAuth-connected third-party apps and their scopes, letting administrators review and revoke risky or unauthorized integrations that could exfiltrate data. Option C is correct because Cloudlock's DLP engine relies on continuously tuned policies and regex/dictionary rules to detect sensitive data (PII, PCI, PHI) in SaaS traffic, and stale policies create blind spots, so ongoing monitoring and updates are essential.

Option D is incorrect because disabling all public internet access would break SaaS delivery entirely; SaaS security depends on controlled, monitored access, not blanket blocking. Option E is incorrect because enterprise server drivers are an on-premises infrastructure concern and have no bearing on Cloudlock's SaaS security posture management.

Exam trap

The trap is picking plausible-sounding 'hardening' answers (disable internet, patch drivers) that are generic IT hygiene rather than Cloudlock-specific CASB capabilities — the exam wants you to recognize the three pillars of SaaS security posture.

Full explanation →

110

MCQmedium

A network security designer is evaluating email security solutions. Which feature in Cisco Secure Email (ESA) is most effective against sophisticated Business Email Compromise (BEC) attacks?

A.Advanced Phishing Protection

B.URL Filtering

C.Spam Quarantine

D.DKIM Signing

AnswerA

Advanced Phishing Protection uses machine learning and sender behaviour analysis to detect impersonation and social-engineering patterns that lack malicious attachments or links, which is precisely the BEC attack profile. Signature and reputation filtering alone miss these text-only, no-payload messages.

Why this answer

Advanced Phishing Protection in Cisco Secure Email (ESA) is specifically designed to detect and block sophisticated Business Email Compromise (BEC) attacks that evade traditional signature-based defenses. It uses machine learning and behavioral analysis to identify anomalous sender behavior, such as display name spoofing, lookalike domains, and compromised accounts, which are hallmarks of BEC. Unlike URL filtering or spam quarantine, it focuses on the social engineering tactics and context of the email rather than just malicious links or bulk spam characteristics.

Exam trap

SDSI often tests the misconception that URL filtering or spam quarantine can stop BEC, but BEC attacks frequently use no malicious URLs and are not bulk spam, so candidates must recognize that Advanced Phishing Protection is purpose-built for these sophisticated social engineering threats.

How to eliminate wrong answers

Option B is wrong because URL filtering only inspects and blocks malicious links, but BEC attacks often contain no links or use legitimate URLs to avoid detection. Option C is wrong because spam quarantine relies on spam scores and bulk email detection, while BEC emails are typically highly targeted, low-volume, and may not trigger spam filters. Option D is wrong because DKIM signing is an authentication mechanism that verifies email integrity and domain ownership, but it does not prevent BEC attacks that use compromised legitimate accounts or spoofed display names without breaking DKIM.

Full explanation →

111

MCQmedium

In a SaaS security design, what is the role of a Cloud Access Security Broker (CASB)?

A.To provide visibility and control over SaaS usage

B.To manage identity for the cloud

C.To act as a firewall for SaaS traffic

D.To encrypt end-to-end traffic

AnswerA

A CASB sits between users and SaaS providers, discovering shadow IT and enforcing data-loss, encryption and access policies on cloud traffic. That visibility and control satisfies the SaaS security design requirement, which native provider controls alone cannot deliver across multiple services.

Why this answer

A CASB's core role is to provide visibility and control over SaaS usage — discovering shadow IT, monitoring user activity, enforcing DLP policies, and controlling access based on context. It sits between users and cloud services (via API or inline proxy) to apply security policy consistently across sanctioned and unsanctioned apps. This visibility-and-control function is the defining characteristic of a CASB.

Exam trap

The trap is confusing CASB with adjacent technologies — candidates pick IAM or firewall because CASB 'controls access' or 'sits in the path,' but the defining role is visibility and control over SaaS usage, not identity management or packet filtering.

How to eliminate wrong answers

Option B is wrong because managing identity for the cloud is the role of an Identity Provider (IdP) or IAM solution (e.g., Okta, Azure AD) — a CASB may integrate with IAM but does not replace it. Option C is wrong because a CASB is not a firewall for SaaS traffic; while inline CASBs can proxy traffic, their purpose is policy enforcement and visibility for cloud apps, not stateful packet filtering like a traditional firewall. Option D is wrong because end-to-end encryption is a cryptographic function (TLS, E2EE) provided by the application or transport layer, not by a CASB — CASBs may inspect encrypted traffic but do not provide end-to-end encryption.

Full explanation →

112

MCQhard

When assessing the risk of 'Data Loss' via USB devices, which Cisco product provides the best control for endpoint-based DLP?

A.Cisco Secure Endpoint.

B.Cisco Stealthwatch.

C.Cisco ISE.

D.Cisco Umbrella.

AnswerA

Secure Endpoint runs on the host, so it can detect and block file writes to removable media and apply device-control policies at the point of copy. That endpoint enforcement is what USB-based data loss prevention demands, unlike network or cloud controls.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) is the endpoint agent that provides device-level control, including USB device blocking and data loss prevention policies on endpoints. It is the only option that operates at the endpoint layer where USB devices are physically attached, making it the correct choice for endpoint-based DLP against USB data loss.

Exam trap

SDSI often tests the layer at which a control operates, and candidates who pick ISE or Stealthwatch for 'control' miss that USB DLP requires an endpoint agent, not network or identity infrastructure.

How to eliminate wrong answers

Option B is wrong because Cisco Stealthwatch analyzes network flow data (NetFlow/IPFIX) for anomaly detection; it has no endpoint USB control capability. Option C is wrong because Cisco ISE enforces network access policy (802.1X, profiling, posture) and can restrict network access but does not control USB storage devices on endpoints. Option D is wrong because Cisco Umbrella is a DNS-layer security and secure web gateway service for internet traffic, not an endpoint USB DLP control.

Full explanation →

113

MCQmedium

A SOC analyst requires a tool to gain visibility into encrypted traffic without full decryption. Which Cisco product feature should be included in the design to meet this requirement?

A.Cisco Encrypted Traffic Analytics (ETA).

B.Cisco Firepower SSL decryption policies.

C.Cisco AnyConnect Network Visibility Module (NVM).

D.Cisco Identity Services Engine (ISE) Profiling.

AnswerA

ETA derives security telemetry from encrypted flow metadata and sequence patterns without decrypting payloads, so threats in TLS traffic are detected while privacy and compliance constraints are preserved. This satisfies the requirement for visibility into encrypted traffic without full decryption.

Why this answer

Cisco Encrypted Traffic Analytics (ETA) uses machine learning and network telemetry (NetFlow, TLS metadata such as handshake fields and packet-length sequences) to detect malware in encrypted traffic without decrypting it. It is purpose-built for visibility into encrypted flows while preserving privacy and performance, exactly matching the SOC analyst's requirement.

Exam trap

SDSI often tests the distinction between decrypting traffic (SSL decryption) and analyzing encrypted traffic metadata (ETA) — candidates pick SSL decryption because it sounds more thorough, but the question explicitly says 'without full decryption.'

How to eliminate wrong answers

Option B is wrong because Firepower SSL decryption policies actually decrypt traffic (with a certificate), which is the opposite of 'without full decryption' and introduces privacy, performance, and certificate-management overhead. Option C is wrong because AnyConnect NVM collects endpoint telemetry (processes, applications) from the endpoint itself, not visibility into encrypted network traffic flows. Option D is wrong because ISE Profiling identifies and classifies endpoints on the network (device type, OS) for access control — it does not inspect encrypted traffic content or metadata for threat detection.

Full explanation →

114

MCQeasy

Which risk assessment methodology component focuses on identifying the 'crown jewels' of the organization's network architecture?

A.Control Implementation

B.Asset Identification

C.Vulnerability Scanning

D.Threat Vector Analysis

AnswerB

Asset identification inventories and classifies the systems, data and services in the architecture, establishing which are business-critical. That inventory is the prerequisite for designating crown jewels, since risk scoring cannot prioritise assets that have not first been discovered and documented.

Why this answer

Asset Identification is the component of risk assessment that focuses on discovering and cataloging all assets, especially the 'crown jewels'—the most critical and valuable data, systems, and applications. This step is foundational because you cannot protect what you haven't identified, and risk cannot be accurately assessed without knowing which assets are most business-critical. By identifying crown jewels first, organizations can prioritize subsequent risk analysis and controls where they matter most.

Exam trap

SDSI often tests the misconception that vulnerability scanning or threat vector analysis identifies crown jewels, but those activities assume you already know which assets are critical; the trap is confusing the order of operations in risk assessment.

How to eliminate wrong answers

Option A is wrong because Control Implementation is about deploying security measures (e.g., firewalls, encryption) to mitigate risks, not about identifying critical assets. Option C is wrong because Vulnerability Scanning focuses on discovering technical weaknesses in systems, not on determining which assets are the crown jewels. Option D is wrong because Threat Vector Analysis examines how attackers could exploit vulnerabilities, but it does not identify the organization's most valuable assets.

Full explanation →

115

MCQeasy

When designing security for a multi-tenant cloud application, which principle is most effectively addressed by using Cisco Secure Workload to create distinct security domains?

A.User Identity Provisioning

B.Data Backup and Recovery

C.Logical Tenant Isolation

D.null

E.Hardware Redundancy

AnswerC

Cisco Secure Workload builds microsegmentation policy from workload attributes, letting you group each tenant's workloads into distinct security domains with enforced east-west rules. This prevents cross-tenant traffic and satisfies logical tenant isolation in the shared environment.

Why this answer

Cisco Secure Workload (formerly Tetration) creates distinct security domains that enforce microsegmentation and policy boundaries between tenants, which directly implements logical tenant isolation in a multi-tenant cloud application. By defining separate security domains per tenant, the platform ensures that workloads from one tenant cannot communicate with another unless explicitly allowed, satisfying the isolation principle. This is the principle most effectively addressed by that design approach.

Exam trap

SDSI often tests the confusion between logical tenant isolation (a security segmentation principle) and other principles like identity provisioning or hardware redundancy — candidates pick a principle that sounds related to multi-tenancy but does not match what security domains actually enforce.

How to eliminate wrong answers

Option A is wrong because user identity provisioning concerns managing user accounts and access, not isolating tenant workloads at the network/security policy level. Option B is wrong because data backup and recovery is about resilience and data protection, not tenant isolation. Option D is null and therefore not a valid answer.

Option E is wrong because hardware redundancy addresses availability and fault tolerance, not logical separation between tenants.

Full explanation →

116

MCQmedium

You are designing the security for a SaaS application access scenario. What is the role of the Cloud Access Security Broker (CASB)?

A.To manage local network switches.

B.To gain visibility into SaaS application usage and prevent data exfiltration.

C.To encrypt all internet-bound traffic at the gateway.

D.To provide physical security for data centers.

AnswerB

A CASB sits between users and SaaS providers, giving the organisation visibility into which cloud applications are being used and enforcing data-loss prevention policies. This directly satisfies the scenario's requirement to detect shadow IT usage and block sensitive data leaving the tenant.

Why this answer

A CASB sits between users and cloud/SaaS providers, providing visibility into sanctioned and unsanctioned SaaS usage, enforcing DLP policies, and preventing data exfiltration. It operates via API mode, forward proxy, or reverse proxy to inspect traffic and apply granular controls. This makes it the correct answer for gaining SaaS visibility and stopping exfiltration.

Exam trap

SDSI often tests confusion between CASB and Secure Web Gateway (SWG) — candidates pick 'encrypt all internet traffic' thinking CASB is a proxy, missing its SaaS-specific visibility and DLP role.

How to eliminate wrong answers

Option A is wrong because managing local network switches is a LAN management function, not a CASB capability — CASBs operate at the cloud access layer. Option C is wrong because encrypting all internet-bound traffic is a gateway/VPN function (e.g., SWG or firewall), not the defining role of a CASB, which focuses on SaaS visibility and control. Option D is wrong because physical data center security is a facilities concern entirely outside CASB scope.

Full explanation →

117

Multi-Selectmedium

When designing a microsegmentation strategy with Cisco Secure Workload, which THREE metrics should be monitored to validate policy effectiveness? (Choose THREE)

Select 3 answers

A.Average server uptime

B.Reduction in unauthorized lateral movement flows

C.Total number of network switches used

D.Number of denied connection attempts

E.Frequency of policy changes

AnswersB, D, E

Microsegmentation aims to stop workload-to-workload traffic that policy does not permit. Tracking the decline in unauthorised lateral movement flows directly measures whether enforced rules are actually blocking east-west traffic, validating that the policy achieves its intended containment.

Why this answer

Option B is correct because the core goal of microsegmentation with Cisco Secure Workload is to shrink the attack surface, so a measurable reduction in unauthorized lateral movement flows directly demonstrates that east-west traffic is being constrained by policy. Option D is correct because denied connection attempts show the policy is actively enforcing allow-lists and blocking traffic that violates intent, providing evidence the rules are effective rather than merely present. Option E is correct because tracking the frequency of policy changes reveals policy churn and drift; excessive changes can indicate unstable or ineffective rules and help validate that the policy set has stabilized.

Option A is not relevant because server uptime measures availability, not segmentation enforcement, and Option C is not relevant because switch count is a topology/inventory metric unrelated to policy effectiveness.

Exam trap

The trap is selecting operational/infrastructure metrics (uptime, switch count) that sound like health indicators but do not measure whether segmentation is actually blocking unauthorized traffic — the exam wants security-outcome metrics, not availability metrics.

Full explanation →

118

MCQhard

During a design review, it is determined that the current logging architecture is missing context for user identity. Which Cisco tool must be integrated with the firewall to map IP addresses to specific usernames in the logs?

A.Cisco Defense Orchestrator.

B.Cisco Identity Services Engine (ISE).

C.Cisco Umbrella.

D.Cisco SecureX.

AnswerB

Cisco ISE supplies user-to-IP mapping through its identity and session directory, which the firewall consumes via pxGrid or the ISE identity source. This restores the missing user context in logs, resolving the design review finding.

Why this answer

Cisco Identity Services Engine (ISE) is the identity and policy platform that integrates with firewalls (via pxGrid or the ISE Identity Source) to map IP addresses to usernames, providing user-identity context in firewall logs. ISE maintains the active session directory of user-to-IP mappings from 802.1X, MAB, VPN, and passive authentication, which the firewall queries to enrich logs.

Exam trap

SDSI often tests the difference between management/orchestration platforms (Defense Orchestrator, SecureX) and the actual identity source (ISE) — candidates pick SecureX because it sounds like the central hub, but it does not itself provide IP-to-username mapping.

How to eliminate wrong answers

Option A is wrong because Cisco Defense Orchestrator is a cloud-based management platform for firewalls and other devices — it manages configurations and policies but does not provide user-to-IP identity mapping. Option C is wrong because Cisco Umbrella is a DNS-layer security service that blocks malicious domains; it does not map IPs to usernames for firewall log enrichment. Option D is wrong because Cisco SecureX is an integrated security platform that aggregates threat intelligence and automates workflows across products, but it relies on ISE (or similar) for identity data — it is not itself the identity source.

Full explanation →

119

MCQmedium

When designing automated security for Cisco Secure Workload, what does 'Micro-segmentation' provide in the context of DevSecOps?

A.Increased server performance

B.Reduced lateral movement risk

C.Hardware redundancy

D.Database optimization

AnswerB

Micro-segmentation enforces least-privilege, workload-level policies that restrict east-west traffic between application components, directly satisfying the DevSecOps requirement to contain breaches. By isolating each workload, an attacker compromising one cannot pivot to others, which is precisely the reduced lateral movement risk Cisco Secure Workload's automated policy lifecycle delivers.

Why this answer

Micro-segmentation in Cisco Secure Workload enforces granular, workload-level policies (often based on process, user, and flow attributes) that restrict which workloads can communicate with each other. In DevSecOps, this directly limits lateral movement if an attacker compromises a container or VM, because east-west traffic is denied by default except for explicitly allowed flows. It is a containment control, not a performance, redundancy, or database feature.

Exam trap

SDSI often tests whether candidates recognize micro-segmentation as an east-west containment control — the trap is selecting a benefit like performance or redundancy that sounds positive but is unrelated to segmentation's purpose.

How to eliminate wrong answers

Option A is wrong because micro-segmentation is a security control that restricts traffic; it does not increase server performance and can even add policy enforcement overhead. Option C is wrong because hardware redundancy is an availability/resilience concern handled by infrastructure design, not by segmentation policy. Option D is wrong because database optimization is a performance tuning discipline (indexing, query plans) unrelated to network segmentation.

Full explanation →

120

Multi-Selecthard

Which TWO of the following are benefits of using 'Infrastructure as Code' (IaC) with Cisco Secure Firewall?

Select 2 answers

A.Reduction of network bandwidth usage

B.Improved auditability of changes

C.Configuration consistency across environments

D.Elimination of the need for firewall policies

E.Automatic hardware repair

AnswersB, C

IaC stores firewall configuration as version-controlled declarative files, so every change is committed, diffed and attributable to an author. This produces a complete, tamper-evident change history, directly delivering the auditability benefit the question asks for.

Why this answer

Option B (Improved auditability of changes) is correct because IaC stores firewall configuration as version-controlled declarative files (e.g., Terraform HCL or Ansible playbooks in Git), so every change is tracked with commit history, diffs, and author metadata, providing a clear audit trail. Option C (Configuration consistency across environments) is correct because the same IaC templates are applied repeatedly to dev, test, and production, eliminating manual CLI drift and ensuring identical policy, NAT, and interface settings across deployments. Option A is incorrect because IaC addresses configuration management, not traffic forwarding or bandwidth optimization.

Option D is incorrect because firewall policies are still required; IaC only automates how those policies are defined and deployed. Option E is incorrect because IaC provisions and configures software, but it cannot physically repair failed hardware.

Exam trap

SDSI often tests the misconception that IaC eliminates the need for firewall policies or affects network performance, when its real benefits are auditability, consistency, and repeatability of configuration.

Full explanation →

121

MCQhard

An architect is reviewing post-incident logs in Cisco SecureX. Which feature allows the analyst to see the timeline of events from different integrated products in one view?

A.Stealthwatch Alarms view.

B.SecureX Incident/Event Timeline.

C.FMC Event Viewer.

D.ISE Auth Reports.

AnswerB

SecureX correlates telemetry from each integrated product into a single chronological Incident/Event Timeline, letting the analyst pivot across Secure Endpoint, Umbrella and firewall detections in one view. This directly satisfies the stem's requirement to see events from different integrated products together after an incident.

Why this answer

SecureX provides an Incident/Event Timeline view that aggregates events from all integrated products (Secure Endpoint, Umbrella, Firepower, Email, etc.) into a single chronological view for an investigation. This is the feature that lets an analyst see the sequence of events across products without pivoting between consoles. The other options are single-product event views that do not aggregate cross-product timelines.

Exam trap

The trap is picking a product-specific event view (Stealthwatch, FMC, ISE) when the question asks for a unified cross-product timeline — candidates confuse 'event view' with 'cross-product correlation'.

How to eliminate wrong answers

Option A is wrong because Stealthwatch Alarms view shows only network flow alarms from Secure Network Analytics, not a cross-product timeline. Option C is wrong because FMC Event Viewer displays firewall/IPS events only within the Firepower domain. Option D is wrong because ISE Auth Reports show authentication and authorization events for identity services, not a unified incident timeline.

Full explanation →

122

Multi-Selectmedium

Which THREE components are critical for an effective post-incident 'Architecture Adaptation'?

Select 3 answers

A.Increasing the number of helpdesk staff.

B.Updating security policies to address the identified gap.

C.Hardening of configurations on impacted network devices.

D.Renaming all user accounts in the domain.

E.Root Cause Analysis (RCA) report.

AnswersB, C, E

Architecture Adaptation requires closing the specific weakness the incident exposed, so revising security policies translates findings into enforceable controls. Without policy change, the same gap persists and the adaptation is incomplete, satisfying the stem's post-incident remediation requirement.

Why this answer

Option B is correct because architecture adaptation requires updating security policies to close the specific gap that enabled the incident, ensuring governance and controls reflect the lessons learned. Option C is correct because hardening configurations on impacted network devices directly remediates the exploitable weaknesses and prevents recurrence at the architectural/device level. Option E is correct because the Root Cause Analysis (RCA) report identifies the underlying failure and provides the evidence-based foundation for adapting the architecture.

Option A is not a structural or architectural change; adding helpdesk staff addresses operational capacity, not the root cause or design gap. Option D is not a remediation or adaptation measure; mass account renaming does not fix the vulnerability and can disrupt identity management without improving security posture.

Exam trap

SDSI often tests the difference between operational incident response tasks (e.g., staffing, account renaming) and strategic architectural changes. Candidates may pick operational actions that seem helpful but do not address the root cause or prevent recurrence.

Full explanation →

123

Multi-Selectmedium

Which THREE criteria are used during the 'Requirements Gathering' phase of a secure architecture design?

Select 3 answers

A.The color of the hardware rack units.

B.The personal email addresses of the network engineering team.

C.Business objectives and compliance requirements.

D.Throughput and latency requirements for critical applications.

E.Existing network topology and traffic flow patterns.

AnswersC, D, E

Requirements gathering begins by capturing what the business needs and what regulations mandate, since these drive every later design decision. Compliance obligations such as PCI DSS or GDPR directly shape segmentation, logging and control choices.

Why this answer

Option C is correct because requirements gathering in secure architecture design must capture business objectives and applicable compliance requirements (e.g., PCI DSS, HIPAA, GDPR), since these drive security controls, data handling, and risk tolerance. Option D is correct because throughput and latency requirements for critical applications define performance constraints that shape topology, link sizing, QoS, and redundancy decisions in the design. Option E is correct because the existing network topology and traffic flow patterns establish the baseline environment, including segmentation, choke points, and trust boundaries, that the secure architecture must integrate with or migrate from.

Option A is not a requirements-gathering criterion; rack unit color is a physical aesthetic detail with no bearing on security or functional design. Option B is also irrelevant, as personal email addresses of engineers are not a design requirement and would raise privacy concerns rather than inform architecture.

Exam trap

The trap is including irrelevant or personal details as 'requirements' — candidates may pick options that sound administrative or technical but have no impact on architecture design, such as rack color or personal contact info.

Full explanation →

124

MCQeasy

Which component of the Cisco Secure architecture is used to provide centralized visibility and threat analysis across the entire network based on NetFlow data?

A.Cisco ISE

B.Cisco Secure Endpoint

C.Cisco Secure Network Analytics

D.Cisco Firepower Management Center

AnswerC

Cisco Secure Network Analytics consumes NetFlow telemetry from across the estate, applying behavioural modelling and anomaly detection to deliver centralised visibility and threat analysis. This satisfies the requirement for network-wide flow-based detection rather than per-device inspection.

Why this answer

Cisco Secure Network Analytics (formerly Stealthwatch) is the component of the Cisco Secure architecture that provides centralized visibility and threat analysis using NetFlow data. It collects flow telemetry from network devices, applies behavioral analytics and machine learning to detect anomalies, and presents a centralized dashboard for threat hunting and incident response.

Exam trap

SDSI often tests whether candidates confuse the roles of Cisco security components — ISE (policy/identity), Secure Endpoint (endpoint), FMC (firewall management), and Secure Network Analytics (NetFlow-based visibility) — catching those who pick a familiar product without matching it to the described function.

How to eliminate wrong answers

Option A is wrong because Cisco ISE is a policy and identity engine for network access control, not a NetFlow-based visibility and threat analytics platform. Option B is wrong because Cisco Secure Endpoint (formerly AMP for Endpoints) provides endpoint protection and detection, not network-wide NetFlow analysis. Option D is wrong because Firepower Management Center manages Firepower appliances and correlates IPS/IDS events, but it is not the primary NetFlow-based network visibility and threat analytics platform — that role belongs to Secure Network Analytics.

Full explanation →

125

MCQeasy

A security architect is documenting security requirements for a new data center design. The requirements must include a control that provides visibility into all traffic flows, including those between virtual machines, and can detect advanced threats using behavioral analysis. Which Cisco solution should be included in the design to meet these requirements?

A.Cisco Umbrella Investigate

B.Cisco Identity Services Engine

C.Cisco Secure Network Analytics

D.Cisco Secure Firewall Management Center

AnswerC

Secure Network Analytics provides network-wide visibility by collecting NetFlow and other telemetry from physical and virtual network devices. It uses behavioral analysis and machine learning to detect advanced threats such as insider attacks and malware command-and-control. It can monitor inter-VM traffic when integrated with the virtual infrastructure, making it suitable for this requirement.

Why this answer

The design requires visibility into all traffic flows, including inter-VM, and behavioral analysis for advanced threats. Cisco Secure Network Analytics collects telemetry from network infrastructure and virtual switches, applying behavioral analytics to detect anomalies. It provides the necessary visibility and threat detection capabilities for the data center environment.

Exam trap

The trap here is assuming that firewall management tools provide comprehensive network visibility, when they only see traffic that traverses the firewall.

Full explanation →

126

MCQhard

When utilizing Cisco DevNet tools for security, which Python library is the standard for interacting with the Cisco FMC API efficiently?

A.requests_cisco

B.cisco_py

C.fmcapi

D.fmc_sdk

AnswerC

fmcapi is the community Python library that wraps the Cisco FMC REST API, handling authentication, token refresh, and CRUD operations on objects and policies. It removes manual HTTP handling, making FMC automation efficient and repeatable.

Why this answer

The `fmcapi` library is the de facto standard Python library for interacting with Cisco Firepower Management Center (FMC) REST API. It abstracts the low-level HTTP requests, handles authentication (token generation and refresh), and provides object-oriented classes for FMC objects like access policies, network objects, and rules. This makes it efficient for automation tasks such as bulk configuration, policy management, and reporting.

Other options are not recognized libraries for FMC API interaction.

Exam trap

SDSI often tests the misconception that any library with 'cisco' or 'fmc' in its name is the standard, but candidates must know that `fmcapi` is the community-driven standard for FMC automation, not an official Cisco SDK.

How to eliminate wrong answers

Option A is wrong because `requests_cisco` is not a real Python library; while `requests` is a popular HTTP library, it is not specific to Cisco FMC and lacks FMC-specific abstractions. Option B is wrong because `cisco_py` does not exist as a standard library for FMC; there is a `cisco` package but it is not the standard for FMC API. Option D is wrong because `fmc_sdk` is not a known library; the official Cisco SDK for FMC is not named that, and `fmcapi` is the community-standard.

Full explanation →

127

Multi-Selecthard

Which TWO Cisco products are used to achieve 'Zero Trust' for remote users?

Select 2 answers

A.Cisco Umbrella.

B.Cisco Identity Services Engine (ISE).

C.Cisco Stealthwatch.

D.Cisco AnyConnect.

E.Cisco Secure Email.

AnswersB, D

Cisco ISE enforces Zero Trust for remote users by applying posture assessment and identity-based policy before granting network access. It satisfies the scenario's requirement for continuous verification, integrating with Microsoft Entra ID to evaluate device compliance and user context, then dynamically authorising or restricting access through TrustSec segmentation.

Why this answer

Cisco Identity Services Engine (ISE) (B) is correct because it provides the policy decision and enforcement point for Zero Trust, performing identity-based authentication, authorization, posture assessment, and network access control (via RADIUS, 802.1X, and TrustSec/SGT) so that remote users are granted least-privilege access based on identity and device compliance. Cisco AnyConnect (D) is correct because it is the endpoint client that establishes the secure remote-access tunnel (SSL/TLS or IPsec IKEv2) and feeds endpoint posture and identity context into ISE, enabling continuous trust verification for remote users. Cisco Umbrella (A) is a DNS-layer and secure web gateway security service, not the identity/posture policy engine or the remote-access client required for Zero Trust enforcement.

Cisco Stealthwatch (C) is network traffic visibility and anomaly detection (flow analysis), and Cisco Secure Email (E) is email security; neither provides the identity-based access control or remote-user tunnel needed for Zero Trust.

Exam trap

SDSI often tests the distinction between Zero Trust enforcement components (ISE + AnyConnect) and Zero Trust visibility/protection add-ons (Umbrella, Stealthwatch, Secure Email) — candidates pick the well-known security products instead of the identity and endpoint enforcement pair.

Full explanation →

128

Multi-Selectmedium

You are designing an API security architecture for a hybrid cloud environment. Which TWO Cisco technologies would you implement to secure the API lifecycle?

Select 2 answers

A.Cisco Firepower

B.Cisco ISE

C.Cisco Secure Application for AppDynamics

D.Cisco AnyConnect

E.Cisco Secure API Gateway

AnswersC, E

Cisco Secure Application for AppDynamics instruments application runtimes to detect runtime API threats and business-logic abuse, feeding live behaviour into the API lifecycle. In a hybrid cloud, this runtime protection complements design-time and gateway controls, satisfying the requirement to secure APIs across both private and public deployment environments.

Why this answer

Cisco Secure API Gateway (E) is correct because it is purpose-built for API security across the API lifecycle, providing discovery, threat detection, schema validation, and protection against OWASP API Top 10 attacks such as injection, broken object level authorization, and data exposure in hybrid cloud deployments. Cisco Secure Application for AppDynamics (C) is correct because it integrates runtime application security with APM telemetry, using business transaction monitoring and runtime behavioral analysis to detect and block attacks against APIs and applications in real time, including in hybrid environments. Cisco Firepower (A) is a network firewall/IPS focused on perimeter and network traffic inspection, not API lifecycle security.

Cisco ISE (B) is a network access control and identity policy platform for users and devices, not API protection. Cisco AnyConnect (D) is a VPN/endpoint secure access client, unrelated to securing API design, runtime, or lifecycle management.

Exam trap

SDSI often tests whether candidates default to network security appliances (Firepower, AnyConnect, ISE) for API security — the exam expects application- and API-aware tools, not packet-level or access-layer products.

Full explanation →

129

Multi-Selectmedium

A security designer is tasked with improving the SOC's incident response time. Which TWO Cisco platform capabilities should be integrated to enable automated threat hunting and containment? (Choose two)

Select 2 answers

A.Cisco Secure Endpoint

B.Cisco Webex

C.Cisco UCS Manager

D.Cisco Secure Firewall

E.Cisco Prime Infrastructure

AnswersA, D

Cisco Secure Endpoint provides continuous endpoint telemetry and automated containment, isolating compromised hosts and enabling threat hunting across the estate. Integrating it supplies the endpoint detection and response capability the SOC needs to shorten incident response time through automated investigation and remediation actions.

Why this answer

Cisco Secure Endpoint (A) is correct because it provides endpoint detection and response (EDR) telemetry and can automatically isolate a compromised host, which directly supports automated threat hunting and containment at the endpoint layer. Cisco Secure Firewall (D) is correct because its management center (FMC) supports automated threat hunting via correlation/incident policies and can enforce containment by blocking malicious traffic through access control and intrusion policies. Together these platforms feed and act on threat intelligence to shorten SOC response time.

Cisco Webex (B) is a collaboration suite, Cisco UCS Manager (C) manages compute hardware, and Cisco Prime Infrastructure (E) is a network management tool; none of these provide the automated threat hunting and containment capabilities required here.

Exam trap

The trap here is confusing general Cisco infrastructure/management products (UCS Manager, Prime Infrastructure, Webex) with security enforcement and detection platforms; candidates who pick 'Cisco' products by brand familiarity rather than by security function will choose wrong.

Full explanation →

130

MCQhard

An organization wants to monitor all internal traffic for anomalies. Which Cisco tool is used for behavioral analysis of network flows?

A.Cisco Secure Network Analytics (Stealthwatch).

B.Cisco ISE.

C.Cisco Umbrella.

D.Cisco Firepower IPS.

AnswerA

Cisco Secure Network Analytics (Stealthwatch) uses NetFlow and IPFIX telemetry to build behavioural baselines of internal traffic, then applies anomaly detection to flag deviations. This satisfies the requirement to monitor all internal traffic for anomalies without deploying inline inspection at every segment.

Why this answer

Cisco Secure Network Analytics (formerly Stealthwatch) is specifically designed for behavioral analysis of network flows. It collects NetFlow, IPFIX, and other flow telemetry from routers, switches, and firewalls, then applies machine learning and behavioral analytics to detect anomalies such as data exfiltration, lateral movement, or command-and-control traffic. Unlike signature-based tools, it baselines normal traffic patterns and alerts on deviations, making it the correct choice for monitoring internal traffic for anomalies.

Exam trap

SDSI often tests the distinction between flow-based behavioral analytics (Stealthwatch) and signature-based intrusion prevention (Firepower IPS) or DNS-layer security (Umbrella). Candidates may confuse 'monitoring internal traffic' with packet inspection, leading them to pick Firepower IPS.

How to eliminate wrong answers

Option B is wrong because Cisco ISE is a network access control and policy enforcement platform for identity-based access, not a flow-based anomaly detection tool. Option C is wrong because Cisco Umbrella provides DNS-layer security and secure web gateway functions, focusing on external domain resolution rather than internal traffic flow analysis. Option D is wrong because Cisco Firepower IPS is a signature and policy-based intrusion prevention system that inspects packets inline, but it does not perform behavioral analysis of network flows across the internal network.

Full explanation →

131

MCQhard

Which design principle is essential when building an API Gateway for high-security environments?

A.Direct routing to services without inspection

B.Allowing the backend to perform all security checks

C.Centralized security enforcement at the ingress layer

D.Encrypting traffic only when it leaves the data center

AnswerC

Centralised security enforcement at the ingress layer consolidates authentication, authorisation, rate limiting and threat inspection at one choke point. This satisfies high-security requirements by preventing inconsistent per-service controls and ensuring every request is validated before reaching backend APIs.

Why this answer

Centralized security enforcement at the ingress layer means authentication, authorization, rate limiting, schema validation, and threat inspection are all applied consistently at the API Gateway before requests reach backend services. This prevents policy drift and ensures every API consumer passes the same controls.

Exam trap

SDSI often tests whether candidates understand the gateway as a centralized policy enforcement point, so answers that push security to the backend or skip inspection are the standard distractors.

How to eliminate wrong answers

Option A is wrong because direct routing without inspection bypasses all security controls and exposes backend services to unvalidated, potentially malicious requests. Option B is wrong because pushing all security checks to the backend creates inconsistent, duplicated, and often incomplete enforcement across microservices, and it violates the principle of defense at the edge. Option D is wrong because encrypting traffic only when it leaves the data center leaves east-west and intra-cluster traffic in plaintext, exposing it to lateral movement and sniffing inside the trusted zone.

Full explanation →

132

MCQeasy

Which document is essential for the SOC to standardize how they handle identified security incidents?

A.Vulnerability Assessment Report.

B.Vendor Product Data Sheets.

C.Incident Response Plan (IRP).

D.Network Topology Map.

AnswerC

The Incident Response Plan defines the standardised phases, roles, escalation paths and communication procedures the SOC follows for every identified incident. This satisfies the standardisation requirement by giving analysts one consistent, repeatable process rather than ad hoc handling.

Why this answer

The Incident Response Plan (IRP) is the document that standardizes how a SOC detects, responds to, and recovers from security incidents. It defines roles, escalation paths, communication procedures, and step-by-step playbooks, ensuring a consistent and repeatable response. This makes it the essential reference for incident handling.

Exam trap

SDSI often tests document purpose confusion, and candidates may pick a vulnerability report or topology map because they sound security-related, missing that only the IRP standardizes incident handling.

How to eliminate wrong answers

Option A is wrong because a Vulnerability Assessment Report documents discovered vulnerabilities and risk ratings; it informs remediation but does not standardize incident handling procedures. Option B is wrong because vendor product data sheets describe product features and specifications, not SOC incident response processes. Option D is wrong because a network topology map shows infrastructure layout and can assist troubleshooting, but it does not define incident response roles, escalation, or procedures.

Full explanation →

133

MCQmedium

You are designing a security architecture for a hybrid cloud environment using Cisco Secure Firewall. Which design pattern effectively mitigates the risk of lateral movement between VPCs in AWS while maintaining centralized policy enforcement?

A.Relying solely on AWS Security Groups for inter-VPC traffic.

B.Implementing an Overlay Network using Cisco ACI Remote Leaf.

C.Utilizing a Transit Gateway with a centralized inspection VPC and VPC attachments.

D.Deploying individual firewall appliances in each VPC.

AnswerC

A Transit Gateway hubs all VPC attachments through a centralised inspection VPC, so inter-VPC traffic is forced through Cisco Secure Firewall rather than routing directly. This satisfies centralised policy enforcement while blocking lateral movement between VPCs.

Why this answer

A Transit Gateway with a centralized inspection VPC and VPC attachments allows all inter-VPC traffic to be routed through a single inspection point where Cisco Secure Firewall can enforce policy. This design centralizes security policy, avoids the complexity of managing firewalls in every VPC, and effectively mitigates lateral movement by forcing east-west traffic through inspection before it reaches another VPC.

Exam trap

SDSI often tests the misconception that AWS Security Groups alone provide sufficient inter-VPC security, when centralized inspection via Transit Gateway and an inspection VPC is required for true lateral movement mitigation.

How to eliminate wrong answers

Option A is wrong because AWS Security Groups are stateful instance-level filters that do not provide centralized policy enforcement or deep inspection, and relying solely on them leaves lateral movement largely uncontrolled. Option B is wrong because Cisco ACI Remote Leaf is a data-center SDN construct for extending ACI policy to remote sites, not an AWS VPC inspection design pattern. Option D is wrong because deploying individual firewall appliances in each VPC creates distributed, inconsistent policy and does not provide centralized enforcement, increasing operational overhead and potential gaps.

Full explanation →

134

MCQeasy

What is the primary role of a Service Mesh in an API architecture?

A.To perform deep packet inspection of external user traffic

B.To act as a physical load balancer

C.To replace the need for API documentation

D.To abstract and manage service-to-service communication

AnswerD

A service mesh abstracts and manages service-to-service communication through sidecar proxies, delivering mutual TLS, retries, traffic splitting and observability without application code changes. This directly satisfies the stem's focus on the primary role in an API architecture, where east-west traffic between internal services must be secured and controlled consistently.

Why this answer

A service mesh is a dedicated infrastructure layer that handles service-to-service communication within a microservices or API architecture. It provides capabilities like traffic management, mutual TLS, observability, and policy enforcement without requiring changes to application code. By abstracting this communication into sidecar proxies or ambient nodes, it decouples networking concerns from business logic, which is its primary role.

This is why option D is correct.

Exam trap

SDSI often tests the misconception that a service mesh is equivalent to an API gateway or a load balancer, confusing north-south traffic management with east-west service-to-service communication.

How to eliminate wrong answers

Option A is wrong because deep packet inspection of external user traffic is typically handled by API gateways, WAFs, or firewalls, not service meshes; service meshes focus on internal east-west traffic. Option B is wrong because a service mesh is not a physical load balancer; it operates at the software layer and can perform load balancing, but it is not a hardware appliance and its primary role is broader communication management. Option C is wrong because a service mesh does not replace API documentation; documentation is still essential for developers and consumers, and the mesh does not generate or manage API contracts.

Full explanation →

135

MCQeasy

A network security designer is implementing Cisco TrustSec in a campus network to enforce segmentation based on user roles. The design requires that traffic between different security groups be controlled by a centralized policy. Which component is responsible for defining and distributing the security group tags (SGTs) and policies?

A.Cisco Identity Services Engine (ISE)

B.Cisco DNA Center

C.Cisco Firepower Management Center (FMC)

D.Cisco Stealthwatch

AnswerA

Cisco ISE is the centralized policy engine for TrustSec. It defines security group tags (SGTs) and security group ACLs (SGACLs), and distributes them to network devices. ISE also authenticates users and assigns SGTs based on identity and context, enabling role-based segmentation. This aligns with the requirement for a centralized policy component in a TrustSec design.

Why this answer

Cisco ISE is the centralized policy engine for TrustSec, responsible for defining and distributing security group tags (SGTs) and security group ACLs (SGACLs). It authenticates users and assigns SGTs, enabling role-based segmentation. Other components like DNA Center, Stealthwatch, and FMC have different roles and do not define TrustSec policies.

Exam trap

The trap here is confusing management or monitoring platforms with the policy decision point, leading to selecting a component that does not actually define or distribute SGTs and SGACLs.

Full explanation →

136

Multi-Selecteasy

Which TWO of the following are common components of an AI-driven security operations center (SOC)?

Select 2 answers

A.Automated incident response playbooks

B.Manual daily log exporting

C.Word processing software

D.Physical surveillance cameras

E.User and Entity Behavior Analytics (UEBA)

AnswersA, E

Automated incident response playbooks execute predefined containment, enrichment and remediation steps when detections fire, removing manual triage latency. They are a core SOC component because they operationalise AI verdicts into consistent action, satisfying the stem's requirement for a common AI-driven SOC building block.

Why this answer

Automated incident response playbooks (A) are a core AI-driven SOC component because they use orchestration, automation, and response (SOAR) capabilities to trigger predefined actions—such as isolating a host, disabling an account, or blocking an IP—based on alerts, dramatically reducing mean time to respond. User and Entity Behavior Analytics (UEBA) (E) is also fundamental, as it applies machine learning and statistical baselining to detect anomalous user and entity activity (e.g., impossible travel, unusual data access) that signature-based tools would miss. Manual daily log exporting (B) is not a common AI-driven SOC component; it is a labor-intensive, non-scalable manual process that AI/automation aims to replace.

Word processing software (C) is general office productivity tooling unrelated to security operations. Physical surveillance cameras (D) belong to physical security systems, not the AI-driven logical security operations center components described here.

Exam trap

The trap is selecting generic IT or physical-security items (cameras, word processors, manual log handling) as SOC components, when the question is specifically about AI-driven security operations capabilities.

Full explanation →

137

Multi-Selectmedium

Which TWO factors are critical for selecting a firewall architecture?

Select 2 answers

A.Using only legacy IPsec gateways.

B.Availability of local coffee in the DC.

C.Integration with current management ecosystem (e.g., FMC).

D.The color of the firewall chassis.

E.Required throughput and inspection depth.

AnswersC, E

Integration with the existing management ecosystem, such as Cisco FMC, determines operational overhead and policy consistency. Selecting an architecture that cannot be managed by current tooling forces parallel workflows, so this factor directly satisfies the requirement for manageable, centrally administered firewall deployment.

Why this answer

Option C is correct because selecting a firewall architecture must account for how the device integrates with the existing management ecosystem, such as Cisco Firepower Management Center (FMC), since centralized policy deployment, event correlation, and compliance reporting depend on that integration. Option E is correct because required throughput and inspection depth directly determine hardware sizing and architecture choices—deep inspection features like TLS decryption, IPS, and application visibility consume substantial CPU/ASIC resources, so the platform must be rated for the expected traffic load with those services enabled. Options A, B, and D are not critical architectural factors: restricting to legacy IPsec gateways is an outdated and overly narrow constraint, local coffee availability is irrelevant to firewall design, and chassis color has no bearing on security, performance, or manageability.

Exam trap

SDSI often tests whether candidates can distinguish genuine architectural selection criteria (throughput, inspection depth, management integration) from absurd or irrelevant distractors (coffee, chassis color, legacy-only constraints), catching those who overthink or select based on buzzwords.

Full explanation →

138

MCQmedium

When designing a firewall for a data center, what is the best practice for handling high-bandwidth traffic inspection?

A.Use software-based inspection only.

B.Disable deep packet inspection.

C.Route all traffic through the management interface.

D.Use hardware-accelerated inspection.

AnswerD

Hardware-accelerated inspection offloads pattern matching and cryptographic processing to dedicated ASICs or FPGAs, sustaining line-rate throughput that software inspection cannot match. This satisfies the stem's high-bandwidth constraint by preventing the firewall from becoming a bottleneck in data centre traffic flows.

Why this answer

Hardware-accelerated inspection offloads computationally intensive tasks like deep packet inspection (DPI), SSL/TLS decryption, and signature matching to dedicated ASICs, FPGAs, or network processors. This preserves throughput and low latency even at multi-gigabit or terabit speeds, which software-only inspection cannot sustain without massive CPU overhead. In a data center, where traffic volumes are high and latency-sensitive, hardware acceleration is the only practical way to maintain both security and performance.

Exam trap

SDSI often tests the misconception that software-based inspection can scale to high-bandwidth data center traffic without performance degradation, or that disabling DPI is an acceptable trade-off for performance.

How to eliminate wrong answers

Option A is wrong because software-based inspection relies on general-purpose CPUs, which become a bottleneck at high bandwidth, causing dropped packets, increased latency, and inability to inspect all traffic. Option B is wrong because disabling deep packet inspection removes the ability to detect advanced threats, malware, and application-layer attacks, leaving the network vulnerable. Option C is wrong because routing all traffic through the management interface is a security and performance anti-pattern: the management interface is typically low-bandwidth, out-of-band, and not designed for production traffic, and it exposes the firewall's management plane to attack.

Full explanation →

139

MCQmedium

You are designing an API security strategy. Which mechanism is used to verify the integrity and authenticity of API requests in a microservices environment?

A.JSON Web Tokens (JWT)

B.SSL/TLS termination at the server

C.Static IP allowlisting

D.Standard Basic Authentication

AnswerA

JSON Web Tokens carry a cryptographic signature over the header and payload, so each microservice can verify the token was issued by the trusted identity provider and not altered in transit, confirming both authenticity and integrity per request.

Why this answer

JSON Web Tokens (JWT) are signed (and optionally encrypted) tokens that carry claims about the caller and can be cryptographically verified by any microservice using the issuer's public key. This signature verification provides both integrity (the token was not tampered with) and authenticity (it was issued by a trusted identity provider), which is exactly what is needed to validate API requests in a distributed microservices environment. JWTs are stateless, so each service can verify them independently without a central session store.

Exam trap

The trap is assuming that transport-layer security (TLS) or network controls (IP allowlisting) provide request-level integrity and authenticity, when only a signed token like JWT does.

How to eliminate wrong answers

Option B is wrong because SSL/TLS termination only protects data in transit and authenticates the server (and optionally the client via mTLS), but it does not verify the integrity or authenticity of the request payload or the caller's identity claims. Option C is wrong because static IP allowlisting only restricts which source addresses can connect; it does not prove the request was not tampered with and breaks in dynamic environments where IPs change. Option D is wrong because Basic Authentication sends base64-encoded credentials that are trivially decodable and provide no integrity protection or cryptographic authenticity of the request itself.

Full explanation →

140

MCQeasy

During a post-incident review, an architect discovers that the SOC could not correlate logs across the Cisco Secure Email and Cisco Secure Endpoint platforms. Which integration should the design specify to improve future incident response?

A.Cisco Webex Control Hub

B.Cisco Security Cloud Control (SecureX)

C.Cisco DNA Center

D.Cisco ThousandEyes

AnswerB

Cisco Security Cloud Control (SecureX) aggregates telemetry from Secure Email and Secure Endpoint into a single console, correlating events across both platforms. This directly resolves the stem's cross-platform visibility gap, enabling the SOC to trace an incident end to end during future investigations.

Why this answer

Cisco Security Cloud Control (formerly SecureX) is the platform that aggregates telemetry from Cisco Secure Email, Secure Endpoint, Secure Firewall, and other products into a unified incident view. It enables cross-platform correlation, threat hunting, and automated response workflows, directly solving the SOC's inability to correlate logs across email and endpoint.

Exam trap

The trap is confusing network management (DNA Center) or monitoring (ThousandEyes) platforms with security telemetry correlation; the correct answer is the security integration fabric, Security Cloud Control/SecureX.

How to eliminate wrong answers

Option A is wrong because Webex Control Hub manages Webex collaboration services, not security telemetry correlation. Option C is wrong because Cisco DNA Center is a network controller/assurance platform for campus and SD-Access, not a security analytics or SIEM integration layer. Option D is wrong because ThousandEyes provides network path and digital experience monitoring, not security event correlation across email and endpoint.

Full explanation →

141

Multi-Selectmedium

Which THREE of the following technologies should be combined to create a 'Security-as-Code' pipeline for Cisco infrastructure?

Select 3 answers

A.Git (Version Control)

B.Physical console cables

C.Static Analysis (SAST) tools

D.Terraform or Ansible (Config Management)

E.Local SQL databases

AnswersA, C, D

Git provides version control, giving the pipeline an auditable history of every configuration change and enabling peer review via pull requests. This satisfies the requirement that security policy be stored, tracked and reviewed as code before automation consumes it.

Why this answer

Git (A) is correct because a Security-as-Code pipeline requires version control to store, track, review, and audit infrastructure and policy definitions as code, enabling pull requests, branching, and rollback of security configurations. Static Analysis (SAST) tools (C) are correct because they scan the declarative code and templates for misconfigurations, insecure defaults, and policy violations before deployment, shifting security left in the CI/CD pipeline. Terraform or Ansible (D) is correct because these configuration-management and infrastructure-as-code tools actually apply the desired security posture to Cisco devices and platforms in an idempotent, repeatable, automated manner.

Physical console cables (B) are not part of a code-driven pipeline since they represent manual out-of-band access rather than automated, versioned deployment. Local SQL databases (E) are not a Security-as-Code component; state and inventory are typically handled by the IaC tool's state files or a remote backend, not a local SQL store.

Exam trap

SDSI often tests whether candidates confuse 'automation' with 'Security-as-Code' — manual review boards and air-gapped networks sound secure but are the antithesis of codified, continuously tested pipelines.

Full explanation →

142

MCQhard

An enterprise is migrating legacy apps to a cloud-native architecture. You need to secure inter-service communication. Which Cisco solution provides mutual TLS and fine-grained access control using sidecar proxies?

A.Cisco Service Mesh Manager

B.Cisco Umbrella SIG

C.Cisco Secure Application for AppDynamics

D.Cisco Secure Firewall

AnswerA

Cisco Service Mesh Manager deploys sidecar proxies alongside each service, giving mutual TLS encryption and identity-based, fine-grained authorisation for service-to-service traffic without application changes. This directly satisfies the requirement for secured inter-service communication in a cloud-native migration.

Why this answer

Cisco Service Mesh Manager (built on Istio) deploys sidecar proxies (Envoy) alongside each microservice, enabling mutual TLS between services and fine-grained, identity-based access control policies. This is exactly the architecture required to secure east-west inter-service communication in a cloud-native environment.

Exam trap

SDSI often tests whether candidates confuse north-south perimeter security (firewall, SIG, Umbrella) with east-west service mesh security (sidecar proxies, mTLS), so picking a firewall for inter-service traffic is the classic wrong answer.

How to eliminate wrong answers

Option B is wrong because Cisco Umbrella SIG is a cloud-delivered secure internet gateway focused on north-south traffic (web, DNS, CASB, FWaaS), not east-west service-to-service mTLS inside a Kubernetes mesh. Option C is wrong because Cisco Secure Application for AppDynamics is a runtime application security and observability tool that detects attacks and vulnerabilities but does not implement sidecar-based mTLS or service mesh access control. Option D is wrong because Cisco Secure Firewall is a perimeter NGFW that inspects north-south traffic and cannot inject sidecar proxies into a Kubernetes service mesh for per-service mTLS.

Full explanation →

143

MCQmedium

You are designing an email security gateway deployment. What is the benefit of using Cisco Secure Email's 'Outbreak Filters'?

A.It blocks spam based on reputation

B.It archives email for compliance

C.It provides predictive protection for zero-day threats

D.It encrypts outgoing email

AnswerC

Outbreak Filters deliver predictive protection by quarantining suspicious messages for several hours while Cisco Talos analyses emerging campaigns, then releasing legitimate mail. This satisfies the zero-day constraint: signature-based engines cannot detect previously unseen malware or phishing URLs, so behaviour-based outbreak detection closes that gap before signatures exist.

Why this answer

Cisco Secure Email's Outbreak Filters provide predictive protection for zero-day threats by using Cisco Talos threat intelligence and real-time reputation/behavioral analysis to catch malicious messages before signatures are available. They can hold suspicious messages for a short period while Talos analyzes them, then release or quarantine based on the verdict. This 'predictive' capability is what distinguishes Outbreak Filters from standard anti-spam or antivirus.

Exam trap

The trap is conflating Outbreak Filters with anti-spam or antivirus — candidates pick 'blocks spam based on reputation' because it sounds like email security, but Outbreak Filters specifically address zero-day, signature-less threats.

How to eliminate wrong answers

Option A is wrong because blocking spam based on reputation is the function of the anti-spam engine (SenderBase/reputation filtering), not Outbreak Filters — Outbreak Filters target emerging, zero-day threats rather than bulk spam. Option B is wrong because email archiving for compliance is a separate feature (typically handled by the Email Security appliance's message tracking or a dedicated archiving solution), not Outbreak Filters. Option D is wrong because encrypting outgoing email is a separate capability (message encryption / Cisco Secure Email Encryption), not the function of Outbreak Filters.

Full explanation →

144

Multi-Selectmedium

Which THREE features of Cisco Secure Email help in mitigating email-based threats? (Select 3)

Select 3 answers

A.DHCP snooping

B.VLAN isolation

C.Cisco Threat Grid sandboxing

D.Outbreak filters

E.SenderBase reputation service

AnswersC, D, E

Cisco Threat Grid sandboxing detonates suspicious attachments and URLs in an isolated environment, observing actual behaviour rather than relying on signatures. This satisfies the stem's email-based threat mitigation requirement by catching zero-day malware and evasive threats that static filtering misses, blocking delivery before a user can interact with the payload.

Why this answer

Cisco Threat Grid sandboxing (C) is correct because it detonates suspicious attachments and URLs in an isolated environment to observe malicious behavior and derive verdicts, which is a core defense against weaponized email content. Outbreak filters (D) are correct because they use real-time threat intelligence to quarantine or delay suspicious messages during the early hours of a new outbreak, before traditional signature-based antivirus can catch them. SenderBase reputation service (E) is correct because it evaluates the reputation of sending IP addresses and domains to block or throttle mail from known spam and malware sources at the connection level.

DHCP snooping (A) and VLAN isolation (B) are Layer 2 network access controls for switches and are not email security features, so they do not belong in this scenario.

Exam trap

SDSI often tests whether candidates confuse general network security controls (DHCP snooping, VLANs) with email-specific threat mitigation features, so distractors are pulled from unrelated security domains.

Full explanation →

145

MCQhard

Which component of Cisco XDR (formerly Cisco SecureX) is critical for normalizing data from different Cisco security products to enable automated orchestration?

A.Cloud-native storage

B.Local management agent

C.Unified Data Model

D.Packet inspection engine

AnswerC

The Unified Data Model maps each product's disparate event schema into common, normalised fields, giving playbooks consistent observables and verdicts. That normalisation is the prerequisite for reliable automated orchestration across Cisco security products in XDR workflows.

Why this answer

The Unified Data Model (UDM) in Cisco XDR is the normalization layer that translates telemetry from disparate Cisco security products (Umbrella, Secure Endpoint, Secure Firewall, Email Security, etc.) into a common schema. This shared schema is what allows orchestration workflows and automation to reason about events consistently regardless of source product.

Exam trap

SDSI often tests the misconception that storage or inspection components enable orchestration — candidates overlook that orchestration depends on a common data schema, which is UDM's role.

How to eliminate wrong answers

Option A is wrong because cloud-native storage is an infrastructure concern — it holds data but does not normalize it across products. Option B is wrong because a local management agent handles endpoint or on-prem integration, not cross-product data normalization. Option D is wrong because a packet inspection engine analyzes traffic content for threats; it produces raw telemetry that still needs normalization before orchestration can use it.

Full explanation →

146

MCQeasy

In DevSecOps, what is the role of an 'Artifact Repository' such as Artifactory in relation to security?

A.Store and secure immutable build artifacts

B.Manage user identities

C.Monitor real-time network traffic

D.Execute live security testing

AnswerA

Artifactory stores versioned build artefacts with checksums and access controls, so pipelines consume only immutable, verified binaries rather than mutable latest tags. This satisfies the DevSecOps requirement that artefacts remain tamper-evident throughout the delivery chain.

Why this answer

An artifact repository like Artifactory stores and secures immutable build artifacts, providing a trusted source of truth for binaries, container images, and packages. It supports security through access controls, vulnerability scanning integration, and immutability guarantees that prevent tampering with released artifacts. This makes it a critical control point in the DevSecOps supply chain.

Exam trap

SDSI often tests the scope of DevSecOps tooling — candidates confuse artifact repositories with identity management or runtime security tools, missing that the repository's security role is about artifact integrity, access control, and supply chain provenance.

How to eliminate wrong answers

Option B is wrong because managing user identities is the role of an identity provider (IdP) or IAM system, not an artifact repository — Artifactory can integrate with LDAP/SAML but does not manage identities itself. Option C is wrong because monitoring real-time network traffic is the function of IDS/IPS, firewalls, or network monitoring tools, not an artifact repository. Option D is wrong because executing live security testing (DAST, penetration testing) is performed by dedicated tools like OWASP ZAP, Burp Suite, or Nessus, not by an artifact repository.

Full explanation →

147

Multi-Selectmedium

Which TWO methods provide identification for IoT devices in an enterprise network?

Select 2 answers

A.802.1X (EAP-TLS).

B.Ignoring the device type.

C.Using public Wi-Fi access.

D.Device profiling (ISE).

E.MAC address spoofing.

AnswersA, D

802.1X with EAP-TLS authenticates IoT devices using certificate-based identity at the switch port, satisfying the requirement for cryptographic, per-device identification. Devices lacking supplicants need alternatives, but certificate exchange provides strong identity without relying on inferred behaviour.

Why this answer

Option A, 802.1X with EAP-TLS, is correct because it provides strong, certificate-based mutual authentication that uniquely identifies IoT devices on the enterprise network before granting access. Option D, device profiling with Cisco ISE, is correct because ISE identifies IoT devices by collecting attributes such as MAC OUI, DHCP fingerprints, and HTTP user-agent data to classify and authorize them. Option B, ignoring the device type, is wrong because it provides no identification and defeats access control.

Option C, using public Wi-Fi access, is wrong because it is an untrusted network path that does not identify devices to the enterprise. Option E, MAC address spoofing, is wrong because spoofed MAC addresses are easily forged and cannot reliably identify a device.

Exam trap

SDSI often tests the difference between authentication (802.1X) and profiling (ISE) for IoT identification. Candidates may overlook profiling because they think only 802.1X provides identification, but many IoT devices cannot support 802.1X.

Full explanation →

148

MCQmedium

When designing a VPN solution for a hybrid workforce, which protocol provides the most robust support for DTLS to minimize latency for real-time traffic?

A.Cisco Secure Client with DTLS enabled.

B.SSL VPN Clientless portal.

C.L2TP/IPsec.

D.IPsec IKEv1.

AnswerA

DTLS runs over UDP, avoiding TCP head-of-line blocking and retransmission delays that degrade voice and video. Cisco Secure Client's DTLS-enabled VPN headend terminates this UDP-based tunnel, directly satisfying the stem's latency-minimisation constraint for real-time traffic across a hybrid workforce.

Why this answer

Cisco Secure Client (formerly AnyConnect) with DTLS enabled provides the most robust support for DTLS in a VPN solution. DTLS (Datagram Transport Layer Security) runs over UDP and avoids TCP-over-TCP meltdown, minimizing latency for real-time traffic like voice and video. Cisco Secure Client natively supports DTLS and can fall back to TLS if UDP is blocked.

Exam trap

SDSI often tests the confusion between DTLS and TLS — candidates select clientless or IPsec options, not realizing that only Cisco Secure Client with DTLS enabled provides UDP-based low-latency transport.

How to eliminate wrong answers

Option B is wrong because the SSL VPN Clientless portal is browser-based and does not support DTLS — it relies on TLS over TCP, which adds latency and is unsuitable for real-time traffic. Option C is wrong because L2TP/IPsec does not use DTLS; it uses IPsec for encryption and is generally less optimized for latency-sensitive applications. Option D is wrong because IPsec IKEv1 is a key exchange protocol for IPsec and does not provide DTLS support; it is also older and less efficient than modern alternatives.

Full explanation →

149

Multi-Selecthard

Which THREE of the following are best practices for securing a CI/CD pipeline itself?

Select 3 answers

A.Allow root access to all developers

B.Scan the pipeline code for vulnerabilities

C.Use isolated and ephemeral build runners

D.Use a secure secret management service

E.Use unencrypted communication channels

AnswersB, C, D

Pipeline code defines every build, test and deployment action, so scanning it for vulnerabilities detects injection flaws, insecure dependencies and tampered definitions before they execute, protecting the CI/CD pipeline itself rather than only the artefacts it produces.

Why this answer

Option B is correct because scanning the pipeline's own code (e.g., Jenkinsfiles, GitLab CI YAML, GitHub Actions workflows) with SAST/SCA tools detects injection flaws, insecure plugin usage, and vulnerable dependencies before they can be exploited to compromise builds. Option C is correct because isolated, ephemeral build runners (fresh containers or VMs destroyed after each job) prevent cross-job contamination, credential persistence, and lateral movement if a build is compromised. Option D is correct because a dedicated secret management service (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) provides encrypted storage, access control, auditing, and rotation of credentials instead of hardcoding them in pipeline files or environment variables.

Option A is wrong because granting root access to all developers violates least privilege and massively expands the attack surface. Option E is wrong because unencrypted communication channels expose credentials, artifacts, and source code to interception; TLS should be enforced everywhere.

Exam trap

SDSI often tests the misconception that convenience (like root access for developers) or simplicity (like unencrypted channels) can be acceptable in a secure pipeline, but the exam expects strict adherence to least privilege, encryption, and isolation.

Full explanation →

150

Multi-Selectmedium

Which THREE factors are required to ensure the successful deployment of a Zero Trust microsegmentation architecture? (Choose THREE)

Select 3 answers

A.A flat network architecture

B.A centralized, automated enforcement policy engine

C.Visibility into every communication flow

D.Identification and classification of all workloads

E.Shared administrative credentials for all servers

AnswersB, C, D

A centralized, automated enforcement policy engine satisfies the requirement for consistent, dynamic control across distributed workloads. It evaluates identity, device and workload context to permit or deny east-west traffic, removing manual rule maintenance. This directly enables the least-privilege, assume-breach enforcement that Zero Trust microsegmentation demands, aligning with Microsoft Entra ID conditional access principles.

Why this answer

Option B is correct because Zero Trust microsegmentation depends on a centralized, automated enforcement policy engine (e.g., a policy controller/management plane) that consistently translates identity- and context-based rules into allow/deny decisions across all workloads without manual per-host configuration. Option C is correct because you cannot segment what you cannot see: complete visibility into every communication flow (east-west and north-south, typically via flow logs, packet inspection, or agents) is required to baseline legitimate traffic and detect anomalies. Option D is correct because identifying and classifying all workloads (by application, owner, sensitivity, and tags/labels) is the prerequisite for defining meaningful microsegmentation policies and grouping assets into segments.

Option A is not correct because a flat network architecture is the opposite of what microsegmentation requires — it removes the internal boundaries that segmentation is meant to create. Option E is not correct because shared administrative credentials violate Zero Trust least-privilege and per-identity authentication principles, increasing lateral movement risk rather than enabling secure deployment.

Exam trap

The trap is selecting 'flat network' because it sounds like a simplification enabler — but flat networks are the vulnerability microsegmentation eliminates, and shared credentials are a classic anti-pattern the exam expects you to reject.

Full explanation →

Cisco Designing Cisco Security Infrastructure (SDSI, 300-745, CCNP Security, design-focused) (SDSI) (SDSI) — Questions 76–150