Cisco Designing Cisco Security Infrastructure (SDSI, 300-745, CCNP Security, design-focused) (SDSI) SDSI Questions 151–225 | Page 3/4

151

MCQmedium

When designing for microsegmentation using Cisco Secure Workload, what is the significance of 'Flow Visibility'?

A.It allows for the modeling and validation of security policies before enforcement

B.It automates the patching of vulnerabilities

C.It is used to bill users for bandwidth usage

D.It is used to identify the physical location of servers

AnswerA

Flow Visibility collects actual workload-to-workload traffic, letting you build and simulate microsegmentation policy against observed flows before enforcement. This satisfies the requirement to validate that proposed rules permit legitimate communication and block unwanted paths, avoiding outages when policies are later applied in enforcement mode.

Why this answer

Flow Visibility in Cisco Secure Workload (formerly Tetration) continuously ingests and analyzes actual east-west traffic between workloads, building a dependency map of every conversation. This lets security teams model and simulate microsegmentation policies against real traffic before enforcing them, so they can validate that legitimate flows won't be blocked. It is the foundational 'observe before enforce' phase of the workload protection lifecycle.

Exam trap

The trap here is confusing 'visibility' with 'remediation' — candidates see a security-sounding term and pick patching or billing, when flow visibility is strictly about observing and modeling traffic to validate policy before enforcement.

How to eliminate wrong answers

Option B is wrong because vulnerability patching is handled by vulnerability management tools (e.g., Cisco Vulnerability Management/Kenna), not by flow visibility telemetry. Option C is wrong because bandwidth billing is a cloud provider cost-management function (e.g., AWS Cost Explorer), not a security workload feature. Option D is wrong because physical server location is tracked by asset management/CMDB systems; flow visibility maps logical communication dependencies, not physical rack coordinates.

Full explanation →

152

Multi-Selecthard

Which THREE technologies are used in Cisco's architecture for micro-segmentation?

Select 3 answers

A.Cisco ISE as the policy engine.

B.Scalable Group Tags (SGT).

C.Policy Enforcement Points (e.g., switches/firewalls).

D.Standard unmanaged switches.

E.Static IP ACLs on every port.

AnswersA, B, C

Cisco ISE supplies the central policy engine that maps endpoint identity and context into group assignments, enabling micro-segmentation decisions across the fabric. Without this authoritative identity-to-group mapping, enforcement devices would lack the policy basis the architecture requires.

Why this answer

Cisco's micro-segmentation architecture, implemented through technologies like Cisco TrustSec and Secure Workload, relies on Cisco ISE (Identity Services Engine) as the centralized policy engine that defines and distributes segmentation policies based on identity and context, making option A correct. Scalable Group Tags (SGTs) are the core tagging mechanism in TrustSec that embed group-based classification directly into the packet, enabling scalable segmentation without relying on IP-based rules, which validates option B. Policy Enforcement Points (PEPs) such as Cisco switches and firewalls enforce the SGT-based policies inline as traffic traverses the network, confirming option C as a required architectural component.

Option D is incorrect because standard unmanaged switches lack the capability to read SGT tags or enforce security group policies. Option E is incorrect because static IP ACLs on every port represent a traditional, manually maintained segmentation approach that does not scale and is not the technology behind Cisco's micro-segmentation architecture.

Exam trap

SDSI often tests whether candidates recognize that micro-segmentation requires all three pillars — policy engine (ISE), tagging mechanism (SGT), and enforcement points (PEPs) — and mistakenly select generic networking components like unmanaged switches or static ACLs as valid alternatives.

Full explanation →

153

Multi-Selectmedium

Which THREE capabilities are provided by Cisco Cloudlock to enhance SaaS security posture? (Choose THREE)

Select 3 answers

A.Real-time packet capture on the local network

B.Data Loss Prevention (DLP) for SaaS data

C.User and Entity Behavior Analytics (UEBA)

D.Hardening of physical server BIOS settings

E.Application auditing and vetting for third-party apps

AnswersB, C, E

Cloudlock's DLP engine classifies sensitive SaaS content in motion and at rest, enforcing policies that block sharing of regulated data. This directly satisfies the SaaS security posture requirement by preventing unauthorised exposure within sanctioned cloud applications.

Why this answer

Cisco Cloudlock is a cloud-native CASB (Cloud Access Security Broker) that enhances SaaS security posture through API-based monitoring rather than on-premises inspection. Option B is correct because Cloudlock provides Data Loss Prevention (DLP) for SaaS data, scanning content in sanctioned cloud apps such as Microsoft 365, Google Workspace, and Salesforce to detect and remediate exposure of sensitive data (PII, PCI, IP) via policies and regex/EDM classifiers. Option C is correct because Cloudlock includes User and Entity Behavior Analytics (UEBA), which baselines user activity across cloud apps and flags anomalous behavior such as impossible travel, mass downloads, or unusual sharing to detect compromised accounts and insider threats.

Option E is correct because Cloudlock performs application auditing and vetting for third-party apps, using its AppFirewall and app-risk scoring to identify OAuth-connected apps with excessive scopes or risky permissions and to block or revoke them. Option A is incorrect because real-time packet capture on the local network is a function of on-premises tools such as Cisco Stealthwatch or Firepower, not the API-based Cloudlock CASB. Option D is incorrect because hardening physical server BIOS settings is a data-center hardware security task unrelated to SaaS security posture management.

Exam trap

The trap is mixing CASB capabilities (DLP, UEBA, app vetting) with network or endpoint functions (packet capture, BIOS hardening) that Cloudlock does not perform.

Full explanation →

154

MCQmedium

Which design principle is essential when configuring Cisco Secure Firewall for SaaS application visibility?

A.Disable SSL decryption for all SaaS traffic to improve performance.

B.Enable Application Filtering policies using the cloud-delivered feed.

C.Install local agents on every endpoint.

D.Configure static IP-based rules for every SaaS provider.

AnswerB

Application Filtering policies driven by the cloud-delivered feed identify SaaS applications by signature and behaviour rather than port, giving the visibility the design requires. This satisfies the stem's SaaS visibility goal, since the feed continuously updates application identification as cloud services change.

Why this answer

Cisco Secure Firewall achieves SaaS application visibility by leveraging Application Filtering policies that use cloud-delivered application signatures and metadata feeds. These feeds are continuously updated by Cisco Talos to identify SaaS applications even when they use dynamic IPs, CDNs, or encrypted traffic. Enabling Application Filtering allows the firewall to classify traffic based on application characteristics rather than static IPs or ports, which is essential for accurate visibility and control.

Exam trap

SDSI often tests the misconception that static IP-based rules or endpoint agents are sufficient for SaaS visibility, when in fact dynamic cloud-delivered application feeds are required to keep up with the constantly changing nature of SaaS applications.

How to eliminate wrong answers

Option A is wrong because disabling SSL decryption for all SaaS traffic would prevent the firewall from inspecting encrypted payloads, severely limiting visibility into application usage and threats; while decryption can impact performance, it is often necessary for deep inspection. Option C is wrong because installing local agents on every endpoint is not a firewall configuration principle; it describes an endpoint-based solution, not a network security control, and does not leverage the firewall's capabilities. Option D is wrong because static IP-based rules are ineffective for SaaS applications, which frequently use dynamic IP addresses, shared CDNs, and multiple domains; such rules cannot reliably identify or control SaaS traffic and are not scalable.

Full explanation →

155

MCQeasy

What is the primary function of an 'API Gateway' in a secure automated environment?

A.Host static websites

B.Store user data

C.Compile application code

D.Enforce security and rate limits on APIs

AnswerD

An API Gateway sits inline on every request, authenticating callers and applying throttling thresholds before traffic reaches backend services. This centralised choke point enforces both security policy and rate limits, satisfying the requirement to protect APIs from abuse and unauthorised access.

Why this answer

An API Gateway sits between clients and backend services and is the enforcement point for authentication, authorization, rate limiting, throttling, and request validation. In secure automated environments it centralizes these controls so individual microservices don't each reimplement them. This makes it the primary security and traffic-control chokepoint for API traffic.

Exam trap

The trap here is conflating 'gateway' with 'server' — candidates may pick 'host static websites' because gateways do serve HTTP, but the exam wants the security/rate-limit enforcement role.

How to eliminate wrong answers

Option A is wrong because hosting static websites is the role of a web server, CDN, or object storage service (e.g., S3 static hosting), not an API Gateway. Option B is wrong because storing user data is the job of databases or data stores — API Gateways are stateless proxies and do not persist application data. Option C is wrong because compiling application code is a build-time function performed by compilers or CI/CD pipelines, not a runtime gateway.

Full explanation →

156

MCQmedium

Which design principle should be followed when implementing micro-segmentation in a data center?

A.Keep all servers in the same VLAN for simplicity.

B.Segment based only on IP addresses.

C.Disable all firewalls for maximum performance.

D.Implement identity-based segmentation at the workload level.

AnswerD

Identity-based segmentation ties policy to workload identity rather than static IP addresses, so rules follow the workload across environments and remain accurate as addresses change. This satisfies the design principle of granular, workload-level control central to effective microsegmentation.

Why this answer

Micro-segmentation is designed to enforce least-privilege east-west traffic controls at the granularity of individual workloads, not network topology. Identity-based segmentation at the workload level ties policy to the workload's identity (labels, tags, service accounts, or attributes) rather than to mutable network constructs like IP addresses or VLANs. This allows policies to follow the workload across hosts, clusters, and clouds, which is the core design principle behind Cisco Secure Workload, ACI, and zero-trust architectures.

Exam trap

The trap here is confusing network segmentation (VLANs, subnets, IP ranges) with micro-segmentation, which is workload-identity-based and enforced at the host or workload level.

How to eliminate wrong answers

Option A is wrong because keeping all servers in one VLAN recreates a flat Layer 2 broadcast domain, which is the exact opposite of micro-segmentation and enables unrestricted lateral movement. Option B is wrong because IP-based segmentation is brittle — IPs change with DHCP, autoscaling, and workload mobility, and it cannot express workload identity or role. Option C is wrong because disabling firewalls removes the enforcement point entirely; micro-segmentation depends on policy enforcement, not on removing it for performance.

Full explanation →

157

MCQeasy

A design requirement for a SOC environment is to have real-time visibility into who is on the network. Which Cisco tool is best for this?

A.Cisco SecureX.

B.Cisco Umbrella.

C.Cisco Firepower Management Center.

D.Cisco Identity Services Engine (ISE).

AnswerD

Cisco Identity Services Engine provides real-time contextual identity data by profiling and authenticating endpoints and users as they connect. This satisfies the visibility requirement, showing who and what is on the network at any moment, which Umbrella or Firepower alone cannot deliver.

Why this answer

Cisco Identity Services Engine (ISE) is the platform that provides real-time visibility into who is on the network by integrating with identity stores (Active Directory, LDAP), profiling endpoints, and enforcing 802.1X/MAB-based access. It continuously tracks authenticated users, device types, and posture, giving SOC teams live contextual awareness of network participants. This makes ISE the correct tool for the stated requirement.

Exam trap

SDSI often tests the confusion between visibility/identity tools (ISE) and threat detection/response tools (SecureX, Umbrella, FMC) — candidates pick a security operations platform when the requirement is specifically real-time identity visibility.

How to eliminate wrong answers

Option A is wrong because Cisco SecureX is a threat detection and response platform that aggregates telemetry and orchestrates security workflows; it does not provide real-time identity-based visibility into who is on the network. Option B is wrong because Cisco Umbrella is a cloud-delivered DNS-layer security and secure web gateway service focused on blocking malicious domains, not on identifying network users. Option C is wrong because Cisco Firepower Management Center manages Firepower NGFW/IPS devices and provides threat and traffic visibility, but it does not deliver identity-based network access visibility like ISE.

Full explanation →

158

MCQhard

When designing an API gateway strategy, why is it important to implement 'Rate Limiting' at the gateway level?

A.To ensure that all users have the same experience

B.To increase the speed of the backend services

C.To simplify the authentication process

D.To protect backend services from being overwhelmed

AnswerD

Rate limiting caps requests per client within a defined window, absorbing bursts and abusive volumes before they reach origin servers. This directly satisfies the constraint of preventing backend services from being overwhelmed, preserving availability and shielding upstream components from traffic floods or denial-of-service attempts.

Why this answer

Rate limiting at the API gateway caps the number of requests a client can make in a given time window, preventing a single client or botnet from overwhelming backend services. This protects availability, enforces fair usage, and mitigates brute-force and DDoS-style abuse before requests reach the backend.

Exam trap

The trap is assuming rate limiting is about performance or user experience — candidates pick 'increase speed' or 'same experience' instead of recognizing it as an availability and abuse-prevention control.

How to eliminate wrong answers

Option A is wrong because rate limiting does not guarantee identical user experience — it may throttle some users, and fairness is a side effect, not the primary security goal. Option B is wrong because rate limiting does not increase backend speed; it constrains traffic, which can reduce load but does not make services faster. Option C is wrong because rate limiting is independent of authentication — it can apply to authenticated and unauthenticated requests alike and does not simplify the auth process.

Full explanation →

159

MCQeasy

In the context of AI-driven security, what does 'False Positive Reduction' primarily achieve?

A.Increased hardware throughput

B.Improved analyst efficiency

C.Lower bandwidth consumption

D.Faster packet forwarding

AnswerB

False positive reduction filters out benign alerts that mimic malicious behaviour, so analysts spend less time triaging noise and more time on genuine threats. This directly delivers improved analyst efficiency, the outcome the question asks about in AI-driven security.

Why this answer

It minimizes unnecessary alerts, allowing security teams to focus on high-fidelity, real threats.

Full explanation →

160

MCQeasy

A design requirement specifies that all remote access must be verified through device health checks. Which Cisco tool allows for this posture assessment?

A.Cisco Identity Services Engine (ISE) pxGrid.

B.Cisco Umbrella roaming client.

C.Cisco AnyConnect Secure Client with Compliance Module.

D.Cisco Secure Firewall VPN portal.

AnswerC

The AnyConnect Secure Client Compliance Module performs posture assessment on the endpoint, checking antivirus, patch level and other health criteria before granting access. This satisfies the design requirement that all remote access be verified through device health checks.

Why this answer

Cisco AnyConnect Secure Client with the Compliance Module is the correct answer because it performs endpoint posture assessment before granting remote access. The Compliance Module checks device health attributes such as OS version, antivirus status, and patch level, and reports them to Cisco ISE for policy enforcement. This directly satisfies the requirement that all remote access must be verified through device health checks.

Exam trap

SDSI often tests the confusion between tools that provide security services (like Umbrella or Firewall) and those that perform endpoint posture assessment (like AnyConnect with Compliance Module), so candidates may incorrectly select a tool that sounds security-related but lacks posture capabilities.

How to eliminate wrong answers

Option A is wrong because Cisco ISE pxGrid is a platform for sharing contextual information between security tools, not a posture assessment agent itself; it does not perform device health checks on endpoints. Option B is wrong because Cisco Umbrella roaming client provides DNS-layer security and does not conduct posture assessment or device health verification. Option D is wrong because Cisco Secure Firewall VPN portal is a web-based portal for VPN access and does not include endpoint posture assessment capabilities; it relies on other tools for that function.

Full explanation →

161

Multi-Selectmedium

When designing security for SaaS applications using Cisco Cloudlock, which TWO capabilities are key to mitigating data exfiltration risks? (Choose TWO)

Select 2 answers

A.Monitoring for anomalous user behavior and account takeovers.

B.Enforcing consistent DLP policies across various SaaS platforms.

C.Replacing all SaaS applications with on-premises alternatives.

D.Blocking all outbound Internet traffic from the office network.

E.Hard-coding user credentials into the Cloudlock dashboard.

AnswersA, B

Cloudlock baselines each SaaS user's normal activity, then flags deviations such as impossible travel, mass downloads or new forwarding rules that indicate account takeover. Detecting these anomalies early interrupts exfiltration before bulk data leaves the tenant.

Why this answer

Option A is correct because Cisco Cloudlock's User and Entity Behavior Analytics (UEBA) continuously baselines normal SaaS activity and flags anomalies such as impossible travel, mass downloads, or compromised-account indicators, which are leading precursors to data exfiltration. Option B is correct because Cloudlock's Data Loss Prevention (DLP) engine applies consistent, API-based policies across sanctioned SaaS platforms (e.g., Microsoft 365, Google Workspace, Salesforce, Box), detecting and remediating sensitive data (PII, PCI, PHI) in files, posts, and sharing events before it leaves the organization. Option C is not part of Cloudlock's design, since it is a cloud-native CASB that secures SaaS rather than eliminating it.

Option D is unrelated and impractical, as Cloudlock governs SaaS data flows via APIs, not by blocking all outbound Internet traffic. Option E is a security anti-pattern; hard-coding credentials into any dashboard violates least-privilege and credential-management principles and is not a Cloudlock capability.

Exam trap

SDSI often tests whether candidates understand that SaaS security uses monitoring, analytics, and policy enforcement rather than network blocking or eliminating SaaS, so answers that 'block everything' or 'go back on-prem' are distractors.

Full explanation →

162

MCQmedium

When designing an endpoint security strategy, which Cisco tool provides visibility into fileless malware by monitoring system process behavior?

A.Cisco Umbrella

B.Cisco Stealthwatch

C.Cisco Secure Endpoint

D.Cisco Duo

AnswerC

Cisco Secure Endpoint's behavioural protection engine continuously monitors process ancestry, memory injection and script execution, detecting fileless attacks that never write a malicious binary to disk. Signature scanning alone misses these, so process-behaviour telemetry directly satisfies the stem's visibility requirement.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) uses behavioral analysis and process monitoring to detect fileless malware, which executes in memory and leaves no file on disk. Its endpoint agent observes process lineage, script execution, and memory activity, making it the correct tool for this visibility requirement.

Exam trap

SDSI often tests the distinction between network-layer visibility (Stealthwatch, Umbrella) and endpoint-layer behavioral visibility (Secure Endpoint); candidates who focus on 'malware' generically may pick Umbrella, missing that fileless malware requires process-level endpoint telemetry.

How to eliminate wrong answers

Option A is wrong because Umbrella is a DNS-layer and secure web gateway solution that blocks malicious domains and IPs but does not inspect endpoint process behavior. Option B is wrong because Stealthwatch is a network flow analytics platform (NetFlow/IPFIX) that detects anomalies in network traffic, not endpoint process execution. Option D is wrong because Duo is a multi-factor authentication and access policy platform, not an endpoint behavioral analysis tool.

Full explanation →

163

MCQeasy

Which capability is provided by Cisco Cloudlock's integration with the SaaS platform via API?

A.Hardening of the SaaS application code

B.Visibility and remediation of data sharing and user activity

C.Deep packet inspection of all physical network traffic

D.Blocking DNS requests at the ISP level

AnswerB

Cloudlock's API-based integration with the SaaS platform grants read access to all objects and activity, enabling discovery of overshared files and remediation such as revoking public links, satisfying the requirement for visibility and remediation of data sharing and user activity.

Why this answer

Cisco Cloudlock is a CASB that connects to SaaS platforms such as Google Workspace, Microsoft 365, and Salesforce via published APIs. Through that API integration it gains visibility into data-at-rest, sharing settings, and user activity, and can then remediate — for example, revoking public share links, quarantining files, or suspending risky accounts — all without inline traffic inspection.

Exam trap

SDSI often tests whether candidates confuse CASB API-mode capabilities with inline or network-layer functions (DPI, DNS blocking, code hardening) — the exam wants visibility and remediation of SaaS data and user activity.

How to eliminate wrong answers

Option A is wrong because Cloudlock does not modify or harden SaaS application source code; it monitors and remediates data and user behavior through the SaaS vendor's APIs. Option C is wrong because deep packet inspection of physical network traffic is a network security function (firewall/IPS), not something an API-based CASB performs — Cloudlock is explicitly out-of-band. Option D is wrong because blocking DNS at the ISP level is a DNS-layer control (Umbrella), not a Cloudlock capability, and Cloudlock operates at the application/API layer, not DNS.

Full explanation →

164

MCQhard

An organization experiences a surge in successful phishing attacks. The post-incident architecture adaptation requires automated email analysis. Which Cisco product provides the necessary API for integrating email sandboxing data into a SOAR platform?

A.Cisco Firepower Management Center REST API.

B.Cisco Defense Orchestrator API.

C.Cisco Secure Email API.

D.Cisco Identity Services Engine ERS API.

AnswerC

The Secure Email API exposes sandbox verdicts and message telemetry programmatically, letting the SOAR platform pull detonation results and automate response. This satisfies the requirement for automated email analysis following the phishing surge, which manual submission cannot scale to meet.

Why this answer

Cisco Secure Email (formerly Email Security Appliance) provides a dedicated API that exposes email sandboxing verdicts and threat intelligence, enabling SOAR platforms to automate response actions like quarantining malicious messages. The API specifically supports retrieving detailed analysis from Cisco Advanced Malware Protection (AMP) and Threat Grid sandboxing, which is exactly what's needed for post-incident phishing analysis. Other Cisco APIs focus on different security domains (network, policy orchestration, identity) and lack native email sandboxing data.

Exam trap

SDSI often tests the confusion between network security APIs (Firepower) and email security APIs, so candidates may incorrectly choose Firepower Management Center because it also offers sandboxing integration for files, but it does not handle email-specific sandboxing data.

How to eliminate wrong answers

Option A is wrong because the Firepower Management Center REST API manages network security policies, intrusion events, and firewall logs—not email sandboxing data. Option B is wrong because Cisco Defense Orchestrator is a cloud-based management platform for firewall and security device configuration, not an email security analysis tool. Option D is wrong because the Identity Services Engine ERS API is for identity and access control (e.g., endpoint profiling, guest management), not email threat analysis.

Full explanation →

165

MCQmedium

You are tasked with securing a SaaS application. The security policy requires that all documents containing credit card numbers be restricted from external sharing. Which Cloudlock feature is best suited to enforce this?

A.User activity monitoring

B.Identity and Access Management (IAM) integration

C.Data Loss Prevention (DLP) engine

D.DNS-layer security

AnswerC

The DLP engine inspects document content for credit card number patterns and applies policy actions, so it directly enforces the restriction on external sharing of files containing that regulated data. Content classification, not access control or anomaly detection, satisfies the stated requirement.

Why this answer

Cloudlock's DLP engine is the feature designed to inspect content (including regex-detectable patterns like credit card numbers) and enforce sharing restrictions on SaaS documents. It classifies data at rest and in motion within sanctioned SaaS apps, then applies policy to block or quarantine external sharing of files containing PCI data. This directly satisfies the requirement to restrict documents containing credit card numbers from external sharing.

Exam trap

The trap is confusing visibility features (user activity monitoring, IAM) with enforcement features (DLP) — candidates pick monitoring because it sounds security-relevant, but only DLP inspects content and enforces sharing restrictions.

How to eliminate wrong answers

Option A is wrong because user activity monitoring provides visibility into what users do (logins, downloads, sharing events) but does not inspect document content or enforce content-based sharing restrictions. Option B is wrong because IAM integration governs authentication and authorization (who can access the SaaS app) but does not inspect the data inside documents or control sharing based on content. Option D is wrong because DNS-layer security operates at the DNS resolution level and cannot see inside SaaS documents or enforce document-sharing policies — it blocks malicious domains, not sensitive-data sharing.

Full explanation →

166

MCQeasy

Which Cisco platform provides a centralized view of security threats across the entire enterprise?

A.Cisco SecureX.

B.Cisco Catalyst Center.

C.Cisco Webex Control Hub.

D.Cisco DNA Center.

AnswerA

Cisco SecureX aggregates telemetry from Cisco Security products and third-party sources into a single console, delivering the enterprise-wide threat visibility the scenario demands. Its integration fabric correlates detections across network, endpoint, cloud and email, satisfying the requirement for one centralised view rather than per-product dashboards.

Why this answer

Cisco SecureX is a cloud-native security platform that integrates with Cisco's security portfolio (e.g., Secure Firewall, Umbrella, AMP) and third-party tools to provide a unified, centralized view of threats across the enterprise. It aggregates and correlates security events, enabling security teams to detect, investigate, and respond to threats from a single dashboard. SecureX is specifically designed for security operations, offering threat hunting, incident response, and automation capabilities.

Exam trap

SDSI often tests the confusion between network management platforms (like Cisco DNA Center/Catalyst Center) and security platforms (like Cisco SecureX), so candidates must remember that SecureX is the dedicated security threat visibility solution.

How to eliminate wrong answers

Option B is wrong because Cisco Catalyst Center (formerly DNA Center) is a network management and automation platform for campus networks, not a security threat monitoring tool. Option C is wrong because Cisco Webex Control Hub is for managing Webex collaboration services (users, meetings, devices), not for enterprise-wide security threat visibility. Option D is wrong because Cisco DNA Center is the former name of Catalyst Center, and it focuses on network infrastructure management, assurance, and automation, not centralized security threat analysis.

Full explanation →

167

MCQmedium

A requirement for an incident response toolset is the ability to automatically contain a workstation upon detecting a specific malware threat. Which Cisco tool provides this 'isolate' capability?

A.Cisco AnyConnect.

B.Cisco Umbrella roaming client.

C.Cisco Secure Endpoint (AMP).

D.Cisco Secure Firewall.

AnswerC

Cisco Secure Endpoint enforces host isolation by severing all network traffic on the compromised workstation except the management channel to the cloud console, satisfying the automatic containment requirement. Its endpoint agent detects the malware threat and triggers isolation without manual intervention, directly delivering the 'isolate' capability the incident response toolset demands.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) provides endpoint detection and response (EDR) with the ability to isolate a compromised workstation from the network. This 'isolate' capability automatically contains threats upon detection, preventing lateral movement. It is specifically designed for endpoint containment.

Exam trap

SDSI often tests the specific capabilities of Cisco security products; candidates may confuse network-based containment (Firewall) with endpoint isolation (Secure Endpoint).

How to eliminate wrong answers

Option A is wrong because Cisco AnyConnect is a VPN client and does not provide endpoint isolation. Option B is wrong because Cisco Umbrella roaming client provides DNS-layer security but cannot isolate a workstation. Option D is wrong because Cisco Secure Firewall is a network security appliance that can block traffic but does not have direct endpoint isolation capabilities.

Full explanation →

168

MCQmedium

You are designing application security for a new customer-facing web application hosted on Cisco ACI with a Cisco Secure Firewall (formerly Firepower) cluster managed by Cisco Secure Firewall Management Center. The application uses a REST API that authenticates users via OAuth 2.0 bearer tokens. The security team wants to detect and block attacks that exploit business logic in the API, such as manipulating order quantities or bypassing approval steps, without breaking legitimate token-based traffic. Which design approach should you recommend?

A.Enable Cisco Secure Firewall's TLS decryption on the API server's traffic and apply a custom Snort 3 rule that inspects JSON payload fields for out-of-range quantity values.

B.Configure Cisco Application Centric Infrastructure (ACI) microsegmentation contracts to allow only HTTP POST methods to the API endpoint, blocking all other methods.

C.Use Cisco Identity Services Engine (ISE) to profile API clients and assign a downloadable ACL that limits each client to a fixed number of API calls per minute.

D.Deploy Cisco Umbrella SIG and configure a custom block page for any API request that contains a quantity parameter greater than 100.

AnswerA

Decrypting TLS at the firewall allows deep inspection of the JSON body, where business logic manipulation occurs. A custom Snort 3 rule can enforce value ranges and detect anomalies that signature-based rules miss. This directly addresses the scenario's need to inspect API payloads while preserving OAuth token traffic, because the rule targets only specific JSON fields rather than blocking all encrypted sessions.

Why this answer

Business logic attacks against APIs require visibility into the application payload, not just network metadata. TLS decryption on Cisco Secure Firewall enables inspection of the JSON body, and a custom Snort 3 rule can enforce semantic constraints such as allowed quantity ranges or approval sequences. This design targets the specific manipulation described while preserving legitimate OAuth 2.0 bearer token traffic, because the rule acts on payload fields rather than blocking encrypted sessions wholesale.

Exam trap

The trap here is assuming that network-layer segmentation or rate limiting can detect business logic abuse, when such controls cannot inspect encrypted API payloads for semantic manipulation.

Full explanation →

169

MCQeasy

Which Cisco feature is used to prevent unauthorized devices from connecting to the wired network by enforcing identity-based access control at the access switch port?

A.MAC Authentication Bypass

B.Port Security

C.DHCP Snooping

D.802.1X

AnswerD

802.1X performs port-based authentication, requiring the supplicant to present credentials via EAP before the access switch opens the port. This directly satisfies the stem's constraint of blocking unauthorised wired devices through identity-based control at the switch port.

Why this answer

802.1X is an IEEE standard for port-based network access control (PNAC) that authenticates devices/users before granting access to the wired or wireless LAN. It uses EAP over LAN (EAPOL) between the supplicant and the authenticator (switch), with RADIUS to the authentication server (e.g., Cisco ISE), enforcing identity-based access at the switch port. This directly matches the requirement of preventing unauthorized devices via identity-based control.

Exam trap

SDSI often tests the distinction between identity-based access control (802.1X) and MAC-based filtering (Port Security/MAB); candidates may incorrectly choose Port Security because it sounds like it prevents unauthorized devices, but it lacks identity verification.

How to eliminate wrong answers

Option A is wrong because MAC Authentication Bypass (MAB) authenticates based on the device's MAC address, which is not an identity-based method and is easily spoofed; it is a fallback for devices that do not support 802.1X. Option B is wrong because Port Security limits the number of MAC addresses per port and can restrict access by MAC, but it does not perform identity-based authentication or involve a RADIUS server. Option C is wrong because DHCP Snooping is a Layer 2 security feature that prevents rogue DHCP servers and DHCP starvation attacks; it does not authenticate users or devices.

Full explanation →

170

Multi-Selecthard

During a risk assessment, which THREE factors are considered critical for determining the design requirements of a secure infrastructure? (Choose three)

Select 3 answers

A.Regulatory and compliance requirements

B.Office physical location and square footage

C.Current threat intelligence and landscape

D.Employee headcount and department budget

E.Criticality of business data and assets

AnswersA, C, E

Regulatory and compliance requirements dictate mandatory controls, data residency, retention, and audit obligations the infrastructure must satisfy. Treating them as a critical factor ensures the design meets legally binding mandates, directly shaping the security requirements derived during risk assessment.

Why this answer

Option A (Regulatory and compliance requirements) is correct because laws and standards such as GDPR, HIPAA, PCI DSS, or ISO 27001 impose mandatory controls (encryption, access logging, retention) that directly shape the architecture and security baselines of the infrastructure. Option C (Current threat intelligence and landscape) is correct because knowing the active threat actors, TTPs, and emerging vulnerabilities (e.g., from MITRE ATT&CK or CVE feeds) determines which defensive controls, segmentation, and monitoring capabilities must be designed in. Option E (Criticality of business data and assets) is correct because classifying data and assets by business impact drives the required protection level, such as tiered controls, redundancy, and recovery objectives (RTO/RPO) for the most critical systems.

Option B is not a security design driver, since office location and square footage are facilities-planning details rather than risk factors affecting control selection. Option D is also not relevant, as headcount and department budget are organizational and financial inputs, not determinants of the technical security requirements themselves.

Exam trap

SDSI often tests the distinction between business operational factors (like office size or headcount) and true security design drivers, tempting candidates to select logistical or budgetary items that feel relevant but do not determine technical security requirements.

Full explanation →

171

MCQmedium

When gathering requirements for a security design, a customer specifies they need to automate the containment of infected endpoints discovered by Cisco Secure Endpoint. Which API integration should the architect document?

A.Cisco Umbrella Investigate API

B.Cisco Secure Endpoint API

C.Cisco Secure Firewall API

D.Cisco ISE REST API

AnswerB

The Cisco Secure Endpoint API exposes endpoints for isolating and unisolating compromised hosts, enabling automated containment. This satisfies the requirement to automate containment of infected endpoints discovered by Secure Endpoint, which manual console action cannot scale to deliver.

Why this answer

The Cisco Secure Endpoint API (formerly AMP for Endpoints) provides programmatic access to endpoint detection and response (EDR) capabilities, including the ability to isolate (contain) an infected endpoint. Since the requirement is to automate containment of endpoints discovered by Cisco Secure Endpoint, the architect must document the Cisco Secure Endpoint API. This API allows security teams to integrate with SIEM/SOAR platforms to trigger isolation actions automatically.

Exam trap

SDSI often tests the confusion between endpoint security APIs and network security APIs, so candidates might mistakenly choose Cisco Umbrella or Cisco ISE for endpoint containment.

How to eliminate wrong answers

Option A is wrong because the Cisco Umbrella Investigate API provides threat intelligence and DNS-layer security insights, not endpoint containment. Option C is wrong because the Cisco Secure Firewall API manages firewall policies and configurations, not endpoint isolation. Option D is wrong because the Cisco ISE REST API is used for network access control and identity management, not for containing endpoints.

Full explanation →

172

MCQhard

An organization is deploying APIs on AWS and using Cisco API Security to protect them. The security team needs to detect 'Shadow APIs' that are being called but are not registered in the API documentation. How should the solution be configured?

A.Integrate API Security with the cloud traffic logs to perform behavior analysis and discovery

B.Manually add every route to the Swagger documentation file

C.Configure OAuth scopes to restrict access to the API Gateway

D.Enable WAF block mode for all undefined routes

AnswerA

Feeding cloud traffic logs into Cisco API Security lets behaviour analysis identify endpoints receiving calls that appear in no registered API documentation. This satisfies the Shadow API detection requirement, since unregistered but actively used endpoints surface through observed traffic rather than declared specifications.

Why this answer

Cisco API Security discovers shadow APIs by ingesting traffic data (cloud load balancer logs, API gateway logs, VPC flow logs, or agent-based telemetry) and performing behavioral analysis to identify endpoints that are actually being invoked but do not appear in the registered API documentation. This traffic-based discovery is the only way to surface unregistered/undocumented routes, since documentation alone cannot reveal what is truly being called. Integrating with cloud traffic logs enables continuous discovery and comparison against the known API inventory.

Exam trap

The trap here is confusing documentation hygiene (updating Swagger) or authorization controls (OAuth scopes) with active discovery — the exam wants you to recognize that shadow APIs can only be found by analyzing real traffic, not by improving documentation or adding access controls.

How to eliminate wrong answers

Option B is wrong because manually adding routes to Swagger only documents APIs you already know about — it cannot detect shadow APIs that were never documented in the first place, which is the entire point of the requirement. Option C is wrong because OAuth scopes control authorization for known, registered clients and APIs; they do not perform discovery of unregistered endpoints and would not reveal shadow APIs. Option D is wrong because WAF block mode on undefined routes is a reactive enforcement control, not a discovery mechanism — and blocking undefined routes without first discovering them would break legitimate traffic and still not identify what the shadow APIs are.

Full explanation →

173

MCQmedium

Which design component is necessary for implementing Cisco TrustSec across a multi-switch campus?

A.VLAN Trunking Protocol (VTP).

B.LLDP.

C.SXP (SGT Exchange Protocol).

D.802.1Q.

AnswerC

SXP propagates IP-to-SGT bindings between network devices that cannot natively exchange Security Group Tags, such as older switches or non-TrustSec platforms. It satisfies the requirement by enabling consistent SGT enforcement across a multi-switch campus fabric.

Why this answer

SXP (SGT Exchange Protocol) is the protocol used to propagate Security Group Tags (SGTs) and the IP-to-SGT bindings from a TrustSec-capable device to devices that cannot natively tag traffic, such as older switches or non-TrustSec network elements. In a multi-switch campus where not every device supports inline tagging, SXP is the necessary design component to carry SGT information across the topology. Without SXP, SGTs cannot be shared with legacy or non-capable devices.

Exam trap

SDSI often tests whether candidates confuse Layer 2 protocols (VTP, LLDP, 802.1Q) with the SGT-specific propagation protocol, so the trap is selecting a familiar switching protocol instead of SXP for TrustSec SGT exchange.

How to eliminate wrong answers

Option A is wrong because VTP is a Layer 2 VLAN management protocol for propagating VLAN databases between switches; it has nothing to do with TrustSec SGT propagation. Option B is wrong because LLDP is a neighbor discovery protocol used for topology and, in some cases, to carry SGT via LLDP-MED or Cisco-specific TLVs, but it is not the primary mechanism for exchanging SGT bindings across a multi-switch campus. Option D is wrong because 802.1Q is the VLAN tagging standard for trunk links; it does not carry SGT information or enable TrustSec propagation.

Full explanation →

174

MCQmedium

You are designing a SaaS security strategy using Cisco Cloudlock. A user reports that they are seeing alerts for 'unusual geo-location' on their Salesforce account. How does Cloudlock detect this?

A.By using UEBA to baseline and identify anomalous login activity

B.By blocking all international traffic

C.By analyzing the user's browser history

D.By tracking the user's GPS coordinates on their phone

AnswerA

Cloudlock applies UEBA, building behavioural baselines per user from historical login patterns, then scoring deviations. A login from an atypical geography exceeds the learned threshold, generating the alert. This satisfies the scenario's requirement to detect unusual geo-location without static rule definitions.

Why this answer

Cloudlock uses User and Entity Behavior Analytics (UEBA) to establish a baseline of each user's normal login behavior — typical locations, times, devices, and IP ranges — and then flags deviations such as logins from new or unusual geographies as 'unusual geo-location' alerts. This is behavioral anomaly detection, not blanket geo-blocking or device tracking.

Exam trap

SDSI often tests whether candidates understand that CASB geo-anomaly detection is UEBA-based behavioral analysis of login telemetry, not GPS tracking or blanket geo-blocking.

How to eliminate wrong answers

Option B is wrong because blocking all international traffic is a blunt network control that would break legitimate global business and is not how Cloudlock detects anomalies — it detects, it doesn't blanket-block by geography. Option C is wrong because Cloudlock does not read the user's browser history; it analyzes SaaS activity events via API, not endpoint browsing data. Option D is wrong because Cloudlock does not track GPS coordinates from a user's phone; it infers location from login IP addresses and SaaS audit logs, not device GPS.

Full explanation →

175

MCQeasy

When designing a secure remote access solution for a hybrid workforce, which Cisco AnyConnect feature should be prioritized to reduce the attack surface by verifying the posture of the device before granting access?

A.IKEv2 protocol support.

B.AnyConnect Posture Module.

C.Split-tunneling.

D.Dynamic Access Policies (DAP).

AnswerB

The AnyConnect Posture Module collects host attributes such as antivirus, patch and firewall state, and returns them for evaluation before access is granted. This satisfies the requirement to verify device posture and thereby reduce the attack surface for hybrid workers.

Why this answer

The AnyConnect Posture Module is the component that performs endpoint posture assessment (hostscan) before or during VPN session establishment, checking for antivirus, firewall, OS patches, and other compliance criteria. It is the mechanism that reduces attack surface by ensuring only compliant devices are granted access, feeding results into DAP for enforcement.

Exam trap

SDSI often tests the confusion between the component that collects posture data (Posture Module) and the component that enforces policy based on it (DAP/ISE), so candidates who pick DAP for 'verifying posture' fall for the enforcement-versus-collection distinction.

How to eliminate wrong answers

Option A is wrong because IKEv2 is a VPN tunneling protocol used for session negotiation and mobility, not a posture verification mechanism. Option C is wrong because split-tunneling is a traffic-routing decision that determines which traffic bypasses the tunnel; it does not verify device compliance and can actually increase attack surface. Option D is wrong because DAP is the policy engine that enforces decisions based on posture results — it consumes posture data but does not itself perform the verification.

Full explanation →

176

Multi-Selecthard

Which TWO of the following identify risks associated with using AI for security automation?

Select 2 answers

A.Faster network throughput

B.Too many security updates

C.Adversarial machine learning / poisoning

D.Increased hardware cost

E.Model drift (loss of accuracy over time)

AnswersC, E

Adversarial machine learning and poisoning directly threaten AI-driven security automation: attackers corrupt training data or craft evasive inputs, degrading detection models. This satisfies the stem's risk-identification requirement, since manipulated models produce false negatives, letting threats bypass automated defences that Microsoft Entra ID and similar tooling rely on.

Why this answer

Option C is correct because adversarial machine learning and data poisoning directly target AI models used in security automation: attackers can inject malicious or mislabeled training data or craft adversarial inputs that cause the model to misclassify threats, evade detection, or generate false alerts, undermining the automation's reliability. Option E is correct because model drift occurs when the statistical patterns in production data change over time and diverge from the training distribution, causing the model's accuracy and detection performance to degrade, which is a recognized ongoing risk for deployed AI security systems that requires monitoring and retraining. The unmarked options do not belong: faster network throughput (A) is a performance benefit, not a risk; too many security updates (B) is an operational patch-management concern unrelated to AI-specific risks; and increased hardware cost (D) is a general infrastructure expense, not a risk inherent to using AI for security automation.

Exam trap

The trap is selecting generic IT concerns (throughput, hardware cost, update volume) as AI risks, when the question targets AI-specific risks like adversarial ML, poisoning, and model drift.

Full explanation →

177

MCQmedium

A design requirement for risk mitigation in a data center requires micro-segmentation. Which Cisco technology is specifically designed to provide workload-level segmentation based on identity and policy?

A.Cisco Secure Workload.

B.Cisco Firepower NGFW.

C.Cisco AnyConnect.

D.Cisco TrustSec/SGTs.

AnswerA

Cisco Secure Workload enforces micro-segmentation at the workload level, using identity-based policies and process-level telemetry rather than network topology. This satisfies the stem's requirement for workload-level segmentation, delivering granular east-west control inside the data centre where IP-based rules cannot distinguish individual workloads.

Why this answer

Cisco Secure Workload (formerly Tetration) is specifically designed for micro-segmentation at the workload level, using identity-based policies derived from software agents on servers or agentless methods. It provides visibility into application dependencies and enforces granular segmentation based on workload attributes (e.g., process, user, labels) rather than just network addresses. This makes it the correct choice for a requirement that explicitly calls for workload-level segmentation based on identity and policy.

Exam trap

SDSI often tests the distinction between network-level segmentation (TrustSec/SGTs) and workload-level segmentation (Secure Workload), so candidates may incorrectly choose TrustSec because they associate segmentation with SGTs, missing the workload-specific requirement.

How to eliminate wrong answers

Option B is wrong because Cisco Firepower NGFW is a perimeter-focused next-generation firewall that enforces policy at network boundaries, not at the individual workload level inside the data center. Option C is wrong because Cisco AnyConnect is a VPN client for remote access, providing secure connectivity but not micro-segmentation of workloads. Option D is wrong because Cisco TrustSec/SGTs provide group-based segmentation using tags in the network fabric, but they operate at the network layer and do not offer the workload-level identity and policy granularity that Secure Workload provides.

Full explanation →

178

Multi-Selectmedium

When designing a SaaS integration security plan, which THREE types of activities should be regularly reviewed in Cisco Cloudlock? (Choose THREE)

Select 3 answers

A.User login patterns and anomalies

B.Physical building security logs

C.External file sharing activities

D.Local printer configuration

E.Third-party application integration permissions

AnswersA, C, E

Reviewing user login patterns and anomalies in Cisco Cloudlock satisfies the requirement to monitor SaaS user behaviour continuously. Cloudlock's User and Entity Behavior Analytics baselines each user's normal activity, then flags deviations such as impossible travel, unusual access times or suspicious IP addresses, surfacing compromised credentials and insider threats for regular review.

Why this answer

Option A (User login patterns and anomalies) is correct because Cisco Cloudlock continuously monitors SaaS user behavior and applies User and Entity Behavior Analytics (UEBA) to detect anomalous logins such as impossible travel, brute-force attempts, or compromised credentials. Option C (External file sharing activities) is correct because Cloudlock's Data Loss Prevention (DLP) and sharing-exposure policies flag files shared publicly or with external domains via links, which is a core SaaS data-exfiltration risk that must be reviewed regularly. Option E (Third-party application integration permissions) is correct because Cloudlock's Cloud Security Assessment and app-governance features audit OAuth scopes granted to third-party apps, identifying over-permissioned or risky integrations that could access SaaS data.

Option B (Physical building security logs) does not belong because Cloudlock is a cloud-access security broker (CASB) focused on SaaS API activity, not physical access control systems. Option D (Local printer configuration) does not belong because printer settings are endpoint/peripheral concerns outside Cloudlock's SaaS visibility and policy scope.

Exam trap

SDSI often tests whether candidates can distinguish SaaS-layer CASB monitoring (logins, file sharing, app permissions) from unrelated physical or endpoint concerns that are inserted as obvious distractors.

Full explanation →

179

MCQhard

Which design pattern best mitigates 'Broken Object Level Authorization' (BOLA) in a RESTful API?

A.Explicit authorization check at every endpoint that accepts an object ID

B.Implementing a strong API rate limit

C.Using random, non-sequential UUIDs for objects

D.Encrypting all API responses

AnswerA

BOLA occurs when an endpoint trusts a supplied object ID without verifying the caller owns or may access that object. An explicit authorization check per endpoint validates the requesting principal against the object before returning data, closing the vulnerability at its source.

Why this answer

BOLA occurs when an API endpoint accepts an object ID and returns or modifies the object without verifying that the authenticated user is authorized to access that specific object. The definitive mitigation is an explicit authorization check at every endpoint that accepts an object ID, verifying the caller's ownership or permission on that object before any data is returned or changed. This closes the vulnerability at its root rather than obscuring it.

Exam trap

The trap is choosing UUIDs or rate limiting as the fix because they sound like security controls — the exam wants you to recognize that BOLA is an authorization logic flaw and only an explicit per-object authorization check actually fixes it.

How to eliminate wrong answers

Option B is wrong because rate limiting controls request volume and mitigates abuse/DoS, but it does nothing to prevent an authenticated user from accessing another user's object — the attacker's requests are legitimate in volume. Option C is wrong because random UUIDs make IDs harder to guess but do not fix the underlying flaw: if an attacker obtains a valid ID (via logs, referrer headers, sharing, or enumeration of other endpoints), the API still fails to check authorization. This is security through obscurity, not a fix.

Option D is wrong because encrypting responses protects data in transit but does not prevent an authorized-but-wrong user from receiving another user's data — the API still returns it, just encrypted.

Full explanation →

180

MCQhard

A design architect is selecting a tool to monitor the security of a hybrid cloud environment. Which Cisco tool provides visibility into both on-premises and cloud (AWS/Azure) traffic flows?

A.Cisco ISE.

B.Cisco Secure Email.

C.Cisco Secure Network Analytics.

D.Cisco Secure Firewall.

AnswerC

Cisco Secure Network Analytics uses flow telemetry from physical and virtual probes, plus cloud connectors, to correlate on-premises and AWS/Azure traffic in one view. This satisfies the stem's hybrid visibility constraint, unlike tools limited to either the data centre or public cloud alone.

Why this answer

Cisco Secure Network Analytics (formerly Stealthwatch) provides network traffic visibility and threat detection across on-premises and hybrid cloud environments, including AWS and Azure. It uses flow telemetry (NetFlow, IPFIX) and behavioral analytics to detect anomalies in both data center and cloud traffic, making it the correct tool for hybrid cloud security monitoring.

Exam trap

SDSI often tests tool-role confusion, and candidates may pick Secure Firewall because it 'sees traffic,' missing that the question asks for visibility and analytics across hybrid cloud, which is Secure Network Analytics' specialty.

How to eliminate wrong answers

Option A is wrong because Cisco ISE is a network access control and identity policy platform for wired, wireless, and VPN access; it does not provide traffic flow visibility into cloud environments. Option B is wrong because Cisco Secure Email focuses on email security (phishing, malware, spam) and does not monitor network traffic flows in hybrid cloud. Option D is wrong because Cisco Secure Firewall enforces policy and inspects traffic at the perimeter or in the cloud, but its primary role is enforcement and inspection, not the broad flow-based visibility and analytics across hybrid environments that Secure Network Analytics provides.

Full explanation →

181

MCQhard

When designing a VPN for a multi-tenant cloud environment, which technology allows for the separation of routing tables to ensure traffic isolation between tenants?

A.VLAN tagging

B.VRF-Lite

C.Access Control Lists

D.IPsec Tunnels

AnswerB

VRF-Lite maintains separate routing and forwarding tables on the same device, so each tenant's prefixes remain isolated even where address space overlaps. This delivers the routing-table separation the multi-tenant VPN design requires without full MPLS VPN complexity.

Why this answer

VRF-Lite (Virtual Routing and Forwarding Lite) allows multiple independent routing tables to coexist on a single router or Layer 3 switch, providing logical separation of traffic between tenants without requiring MPLS. In a multi-tenant cloud VPN design, VRF-Lite ensures each tenant's routes are isolated, preventing cross-tenant traffic leakage.

Exam trap

SDSI often tests whether candidates confuse Layer 2 segmentation (VLANs) or security filtering (ACLs) with Layer 3 routing table separation (VRF-Lite), which is the actual requirement for tenant isolation.

How to eliminate wrong answers

Option A is wrong because VLAN tagging operates at Layer 2 and segments broadcast domains but does not separate Layer 3 routing tables, so tenants could still route between each other if interfaces share a routing table. Option C is wrong because ACLs filter traffic based on rules but do not create separate routing tables; they are a security control, not a routing isolation mechanism. Option D is wrong because IPsec tunnels encrypt traffic between endpoints but do not inherently separate routing tables on a shared device; without VRF, multiple tunnels can still share the same global routing table.

Full explanation →

182

Multi-Selectmedium

Which TWO features are essential for securing the management plane of a Cisco network device?

Select 2 answers

A.Using public IP addresses for management interfaces.

B.Access Control Lists (ACLs) applied to VTY lines.

C.Disabling all physical console ports.

D.Enabling Telnet for remote management.

E.Implementing SSH for encrypted remote access.

AnswersB, E

ACLs applied to VTY lines restrict which source IP addresses may establish remote management sessions, directly enforcing the management-plane access constraint in the stem. Unlike data-plane ACLs, this filters traffic destined to the device's own management interfaces, blocking unauthorised Telnet, SSH or SNMP attempts before authentication occurs.

Why this answer

Option B is correct because applying Access Control Lists (ACLs) to VTY lines restricts which source IP addresses can establish remote management sessions (Telnet/SSH) to the device, directly protecting the management plane from unauthorized access. Option E is correct because SSH provides encrypted, authenticated remote management, replacing insecure cleartext protocols like Telnet and protecting credentials and configuration data in transit. Options A, C, and D are not essential management-plane protections: public IP addresses on management interfaces increase exposure rather than secure them, disabling all physical console ports is impractical and unnecessary for management-plane hardening (console access is typically protected by physical controls and authentication), and enabling Telnet is insecure because it transmits credentials and data in cleartext.

Exam trap

SDSI often tests the misconception that using public IP addresses or enabling Telnet is acceptable for management access, when in fact these practices introduce significant security risks.

Full explanation →

183

MCQeasy

Which design factor is most important when deploying a large-scale Cisco Secure Firewall cluster?

A.Ensuring all firewalls have the same firmware version.

B.Ensuring adequate load balancing and capacity planning.

C.The color of the patch cables used.

D.The physical location of the firewalls.

AnswerB

A large-scale cluster concentrates enormous concurrent connection volumes, so throughput must be distributed evenly across nodes; without adequate load balancing and capacity planning, individual firewalls saturate, causing asymmetric flows and dropped sessions. This directly satisfies the stem's scale constraint.

Why this answer

In a large-scale Cisco Secure Firewall cluster, the most important design factor is ensuring adequate load balancing and capacity planning, because cluster throughput, session distribution, and failover behavior depend on how traffic is balanced across nodes and whether each node has sufficient CPU, memory, and interface bandwidth. Without proper capacity planning and load distribution, the cluster becomes a bottleneck or experiences asymmetric flows and failover issues. This directly determines whether the cluster meets performance and availability requirements.

Exam trap

SDSI often tests the tendency to pick operational hygiene items (like matching firmware) over architectural factors (load balancing and capacity planning) when asked about the most important design consideration for a large-scale cluster.

How to eliminate wrong answers

Option A is wrong because while consistent firmware across cluster nodes is a best practice for compatibility, it is not the most important design factor for large-scale performance and availability — it is an operational hygiene item, not a capacity/architecture decision. Option C is wrong because patch cable color is irrelevant to firewall cluster design and performance. Option D is wrong because while physical location matters for latency and redundancy (e.g., across data centers), it is secondary to ensuring the cluster has adequate load balancing and capacity to handle traffic; location alone does not determine cluster scalability.

Full explanation →

184

MCQmedium

A company requires a control plane security design for their campus network. Which feature prevents unauthorized devices from claiming to be the default gateway?

A.Dynamic ARP Inspection (DAI).

B.Port Security.

C.IP Source Guard.

D.Control Plane Policing (CoPP).

AnswerA

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table, dropping replies with spoofed IP-to-MAC mappings. This prevents a rogue host from impersonating the default gateway's IP address, satisfying the control plane security requirement.

Why this answer

Dynamic ARP Inspection (DAI) is correct because it validates ARP packets on untrusted ports against a trusted binding table (built by DHCP snooping or static entries). If a rogue device tries to claim the default gateway's IP by sending gratuitous ARP or ARP replies, DAI drops those packets because the MAC-IP pair does not match the binding. This directly prevents ARP spoofing of the gateway, a common man-in-the-middle attack on campus networks.

Exam trap

SDSI often tests the distinction between ARP spoofing prevention (DAI) and IP spoofing prevention (IP Source Guard), so candidates must remember that DAI inspects ARP packets while IP Source Guard inspects IP packets.

How to eliminate wrong answers

Option B is wrong because Port Security only limits the number of MAC addresses per switch port and can restrict which MACs are allowed, but it does not inspect ARP payloads and cannot stop a device from sending ARP replies claiming to be the gateway. Option C is wrong because IP Source Guard prevents IP spoofing by filtering based on source IP and MAC bindings, but it operates on IP packets, not ARP, so it does not stop a device from claiming the gateway's IP in an ARP reply. Option D is wrong because Control Plane Policing (CoPP) rate-limits traffic destined to the router's control plane (e.g., routing protocols, management access) but does not validate ARP messages or prevent a host from spoofing the gateway's IP to other hosts.

Full explanation →

185

MCQmedium

Which Cisco feature is designed to protect the control plane of a router from being overwhelmed by traffic?

A.Access Control Lists (ACLs).

B.Traffic Shaping.

C.Control Plane Policing (CoPP).

D.NetFlow.

AnswerC

Control Plane Policing enforces rate limits on traffic destined for the route processor, filtering and policing packets before they reach the control plane. This directly satisfies the stem's constraint: preventing excessive traffic from overwhelming the router's control plane, unlike data plane or management plane protections.

Why this answer

Control Plane Policing (CoPP) is a Cisco IOS feature that allows you to rate-limit traffic destined to the route processor (control plane) of a router. It uses a modular QoS CLI (MQC) policy to classify and police traffic, ensuring that excessive or malicious traffic does not overwhelm the control plane and cause a denial of service. CoPP is specifically designed to protect the control plane, unlike ACLs which filter data plane traffic, or traffic shaping which manages outbound data plane traffic.

Exam trap

SDSI often tests the distinction between control plane and data plane protection mechanisms, and candidates may incorrectly choose ACLs because they are familiar with filtering, but ACLs alone do not provide the rate-limiting necessary to protect the control plane.

How to eliminate wrong answers

Option A is wrong because Access Control Lists (ACLs) are used to filter data plane traffic based on packet headers, but they do not provide rate-limiting or policing capabilities for control plane traffic; they can be used as part of CoPP for classification but are not the feature itself. Option B is wrong because Traffic Shaping is a QoS mechanism that delays outbound data plane traffic to conform to a contracted rate; it does not protect the control plane from being overwhelmed. Option D is wrong because NetFlow is a network monitoring and accounting feature that collects IP traffic information, not a protection mechanism for the control plane.

Full explanation →

186

MCQmedium

In a DevSecOps pipeline, what is the benefit of 'Static Application Security Testing' (SAST)?

A.Managing user passwords

B.Identifying vulnerabilities in source code

C.Encrypting data in transit

D.Monitoring live production traffic

AnswerB

SAST examines application source code without executing it, scanning for insecure patterns such as injection flaws and hardcoded secrets early in the pipeline. This identifies vulnerabilities in source code before deployment, the specific benefit the question asks about in a DevSecOps context.

Why this answer

Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing the application, looking for vulnerabilities such as SQL injection, buffer overflows, hardcoded secrets, and insecure API usage. In a DevSecOps pipeline, SAST is typically run early in the CI stage so developers get immediate feedback and can fix issues before code is merged. This shifts security left and reduces the cost of remediation compared to finding flaws in production.

Exam trap

The trap is confusing SAST (static, code-level, pre-deployment) with DAST (dynamic, runtime, black-box) or with runtime monitoring tools, leading candidates to pick 'monitoring live production traffic.'

How to eliminate wrong answers

Option A is wrong because managing user passwords is an identity and access management function, not a code analysis function; SAST does not manage credentials. Option C is wrong because encrypting data in transit is a network security control (TLS/IPsec), not a static code analysis activity. Option D is wrong because monitoring live production traffic is the domain of runtime application self-protection (RASP), WAFs, or APM tools, not SAST, which operates on code before deployment.

Full explanation →

187

Multi-Selectmedium

Which THREE of the following are essential components of a robust DevSecOps security architecture for Cisco infrastructure?

Select 3 answers

A.Infrastructure as Code (IaC)

B.Manual Review Committees

C.Continuous Monitoring

D.Automated Testing

E.Isolated air-gapped networks

AnswersA, C, D

Infrastructure as Code defines Cisco devices and policies in version-controlled templates, so every change is peer-reviewed, tested and auditable before deployment. This directly satisfies the stem's demand for a robust DevSecOps architecture by eliminating undocumented manual configuration drift across the estate.

Why this answer

Infrastructure as Code (IaC) (A) is essential because it lets Cisco device configurations, policies, and cloud/network resources be defined declaratively in version-controlled templates, enabling repeatable, auditable, and peer-reviewed deployments instead of error-prone manual CLI changes. Continuous Monitoring (C) is required to detect drift, unauthorized configuration changes, and threats in real time across Cisco infrastructure, feeding telemetry into SIEM/SOAR and compliance dashboards so issues are caught and remediated quickly. Automated Testing (D) is essential to validate IaC templates and security controls in CI/CD pipelines (e.g., unit, integration, and policy-as-code checks) before changes reach production, preventing misconfigurations from being deployed.

Manual Review Committees (B) are not a core DevSecOps component because they introduce slow, human-gated approvals that contradict the automation and continuous-delivery principles of DevSecOps, even if some review may still occur. Isolated air-gapped networks (E) are not essential to a DevSecOps architecture; while useful in specific high-security environments, they prevent the continuous integration, delivery, and monitoring that DevSecOps depends on.

Exam trap

SDSI often tests whether candidates pick manual or isolation-based controls (review committees, air-gapped networks) as DevSecOps components — the exam wants automation, testing, and continuous monitoring, not human gates or network segregation.

Full explanation →

188

Multi-Selecthard

Which TWO Cisco technologies should be used to protect a data center against lateral movement of threats?

Select 2 answers

A.Cisco Umbrella.

B.Cisco Secure Network Analytics (Stealthwatch).

C.Cisco Secure Email.

D.Cisco AnyConnect.

E.Cisco Secure Workload (Tetration).

AnswersB, E

Cisco Secure Network Analytics applies behavioural analytics and flow telemetry to detect anomalous east-west traffic inside the data centre. It satisfies the lateral-movement constraint by identifying compromised hosts communicating unusually, enabling rapid containment before threats spread across segmented workloads.

Why this answer

Cisco Secure Network Analytics (Stealthwatch) (B) is correct because it uses NetFlow/IPFIX telemetry and behavioral analytics to detect anomalous east-west traffic inside the data center, which is exactly how lateral movement between workloads appears. Cisco Secure Workload (Tetration) (E) is correct because it provides microsegmentation and workload-level policy enforcement based on application dependencies, allowing you to block unauthorized host-to-host communication that lateral movement relies on. Together these two address detection and prevention of lateral threat movement within the data center.

Cisco Umbrella (A) is DNS-layer security focused on internet-bound resolution, not internal east-west traffic. Cisco Secure Email (C) protects against email-borne threats at the gateway, unrelated to lateral movement. Cisco AnyConnect (D) is a VPN/remote-access client for securing user connectivity, not for containing internal data center threats.

Exam trap

The trap is picking edge or user-focused tools (Umbrella, AnyConnect, Secure Email) for an internal east-west problem — candidates forget that lateral movement happens inside the data center, where flow analytics and workload micro-segmentation are the right controls.

Full explanation →

189

MCQeasy

Which Cisco product would you choose to gain visibility into your SaaS applications and enforce data security policies?

A.Cisco Umbrella

B.Cisco Secure Workload

C.Cisco Secure Firewall

D.Cisco Cloudlock

AnswerD

Cisco Cloudlock is the cloud access security broker that discovers sanctioned and unsanctioned SaaS usage, classifies stored data, and enforces DLP and sharing policies via APIs. It provides both the visibility and policy enforcement the scenario requires.

Why this answer

Cisco Cloudlock (part of Cisco Cloud Security/Umbrella CASB) is the SaaS security product that provides API-based visibility into sanctioned and unsanctioned SaaS apps and enforces DLP policies on data at rest and in motion. It discovers SaaS usage, classifies sensitive data, and applies granular controls. The other options address network, workload, or firewall layers, not SaaS application governance.

Exam trap

The trap is selecting Umbrella because it's Cisco's flagship cloud security brand — but Umbrella is DNS/web-layer, while Cloudlock is the CASB that actually governs SaaS data and apps.

How to eliminate wrong answers

Option A is wrong because Cisco Umbrella is a DNS-layer security and secure web gateway — it can block access to risky domains but does not provide deep API-based SaaS data governance or DLP within applications like M365 or Salesforce. Option B is wrong because Cisco Secure Workload protects data center and cloud workloads (servers, containers), not SaaS application tenants. Option C is wrong because Cisco Secure Firewall is a network firewall (NGFW) that inspects traffic at the perimeter; it lacks the API integrations needed to scan SaaS data at rest or govern OAuth apps.

Full explanation →

190

Multi-Selectmedium

Which TWO of the following capabilities does Cisco Secure Firewall (FMC) provide to support automated security workflows?

Select 2 answers

A.Integration with external Threat Intel feeds

B.Native container orchestration

C.Automated code refactoring

D.On-board AI training engine

E.REST API for object and rule management

AnswersA, E

Ingesting external threat intelligence feeds lets FMC consume indicators from third-party sources and act on them automatically, so newly published malicious IPs and domains are enforced without manual rule authoring. This satisfies the automated workflow requirement by removing human latency from threat response.

Why this answer

Option A is correct because FMC supports integration with external Threat Intelligence feeds (e.g., via STIX/TAXII or custom feeds) to automatically ingest and apply indicators of compromise, enabling dynamic, automated blocking and detection workflows. Option E is correct because FMC exposes a REST API that allows programmatic management of objects, access control policies, and rules, which is the foundation for automation and orchestration with tools like Ansible, Python scripts, or SOAR platforms. The unmarked options do not belong: FMC is not a container orchestration platform (B), does not perform automated code refactoring (C), and does not include an on-board AI training engine for model development (D); its AI/ML capabilities are for detection, not user-driven model training.

Exam trap

SDSI often tests the distinction between native FMC capabilities and features that belong to other Cisco products or are not supported at all — candidates may confuse container orchestration or AI training with firewall functions.

Full explanation →

191

MCQmedium

Which Cisco technology should be included in an automated design to ensure 'Zero Trust' access for remote developers accessing internal development servers?

A.Cisco Secure Access

B.Cisco Catalyst Center

C.Cisco IOS-XE

D.Cisco Webex

AnswerA

Cisco Secure Access enforces Zero Trust network access by verifying identity and device posture per session before granting reachability to internal development servers, rather than trusting the network perimeter. This satisfies the remote-developer access constraint.

Why this answer

Cisco Secure Access is Cisco's cloud-delivered Security Service Edge (SSE) platform that enforces Zero Trust Network Access (ZTNA) for remote users, verifying identity and device posture before granting access to internal applications. It replaces implicit network trust with per-session, least-privilege authorization, which is exactly what remote developers need when reaching internal dev servers. The other options are networking, OS, or collaboration products that do not deliver ZTNA.

Exam trap

SDSI often tests the distinction between network infrastructure products (Catalyst Center, IOS-XE) and identity-centric security services (Secure Access) — candidates pick the familiar networking brand instead of the Zero Trust access platform.

How to eliminate wrong answers

Option B is wrong because Cisco Catalyst Center is a network automation and assurance controller for campus/WAN infrastructure, not a Zero Trust access broker for remote users. Option C is wrong because Cisco IOS-XE is a network operating system for switches and routers; it provides transport and some security features but not identity-based ZTNA for remote developers. Option D is wrong because Cisco Webex is a collaboration suite (meetings, messaging, calling) with no role in brokering Zero Trust access to internal servers.

Full explanation →

192

MCQmedium

Which Cisco feature is used to ensure that only authorized devices can connect to the network?

A.Cisco Umbrella.

B.Cisco ISE (802.1X).

C.Cisco Firepower IPS.

D.Cisco Stealthwatch.

AnswerB

Cisco ISE with 802.1X authenticates each device before granting network access, enforcing identity-based admission control at the port or wireless layer. This directly satisfies the requirement that only authorised devices connect, since unauthenticated endpoints are denied access rather than merely monitored.

Why this answer

Cisco ISE with 802.1X provides port-based network access control that authenticates devices and users before granting network access. It enforces identity-based policies so only authorized devices (validated via certificates, credentials, or MAB) can connect, making it the correct feature for ensuring only authorized devices join the network.

Exam trap

SDSI often tests the difference between visibility/detection tools (Stealthwatch, Umbrella, Firepower IPS) and access-control tools (ISE 802.1X) — candidates pick a security product that sounds comprehensive but does not actually authorize devices at the access layer.

How to eliminate wrong answers

Option A is wrong because Cisco Umbrella is a DNS-layer security and secure web gateway service — it blocks malicious domains but does not control which devices can connect to the network. Option C is wrong because Cisco Firepower IPS inspects traffic for threats and can block exploits, but it does not perform network admission control or device authentication at the access layer. Option D is wrong because Cisco Stealthwatch (Secure Network Analytics) is a network traffic analysis and anomaly detection tool — it provides visibility and threat detection, not access control or device authorization.

Full explanation →

193

MCQeasy

Which of the following is a key requirement for implementing successful DevSecOps in a large organization?

A.Manual approval for every commit

B.Cultural alignment between teams

C.Removing all open-source code

D.Restricting code access to security only

AnswerB

DevSecOps depends on shared ownership of security across development, operations and security teams. Cultural alignment removes the siloed hand-offs that block automation and continuous feedback, which is the foundational requirement for successful DevSecOps at scale.

Why this answer

Cultural alignment between developers and security teams is the foundational requirement for successful DevSecOps.

Full explanation →

194

Multi-Selecthard

When designing a secure API lifecycle, which THREE activities should be automated in the CI/CD pipeline? (Choose THREE)

Select 3 answers

A.Disabling all logging for production performance

B.API contract/schema testing

C.Static Analysis Security Testing (SAST) for API code

D.Automated security policy provisioning for the API gateway

E.Manual code review of every commit by the CISO

AnswersB, C, D

Contract/schema testing validates each API build against its OpenAPI definition, catching breaking changes and specification drift before deployment. This satisfies the pipeline automation requirement by failing the build automatically when request or response structures deviate, preventing non-conformant APIs reaching production.

Why this answer

Option B (API contract/schema testing) is correct because validating the OpenAPI/Swagger contract against the implementation in CI/CD catches breaking changes, missing fields, and type mismatches early, ensuring consumers and producers stay in sync. Option C (SAST for API code) is correct because static analysis scans source code for vulnerabilities such as injection flaws, hardcoded secrets, and insecure deserialization before deployment, shifting security left. Option D (Automated security policy provisioning for the API gateway) is correct because codifying gateway policies (rate limiting, authentication, WAF rules, TLS enforcement) as infrastructure-as-code ensures consistent, repeatable, and auditable security controls across environments.

Option A is wrong because disabling logging harms security monitoring, incident response, and compliance rather than improving security. Option E is wrong because manual CISO review of every commit does not scale and contradicts the goal of automating security activities in the pipeline.

Exam trap

SDSI often tests whether candidates recognize that 'automated' is the key qualifier — manual reviews and disabling logging are distractors that sound plausible but contradict CI/CD and security best practices.

Full explanation →

195

MCQeasy

You are designing an application security architecture for a web application that will be published to the internet through a Cisco Application Centric Infrastructure (ACI) fabric with a Cisco Secure Firewall cluster. The application uses a monolithic architecture and stores session state in a database. The security team wants to ensure that only valid HTTP methods and headers are accepted, and that malformed requests are dropped before reaching the application servers. Which design element should you include?

A.Cisco Identity Services Engine (ISE) posture assessment for all external users to verify their devices meet security policies.

B.A Cisco Secure Firewall access control policy with URL filtering to block requests to known malicious domains.

C.Cisco Umbrella DNS-layer security to block requests to the application's domain if the request contains a suspicious User-Agent header.

D.A Cisco ACI service graph that inserts a Cisco Secure Firewall between the web and application tiers with a custom Snort rule validating HTTP methods and headers.

AnswerD

A service graph in Cisco ACI programmatically redirects traffic through the Cisco Secure Firewall, allowing deep inspection of HTTP requests. A custom Snort rule can enforce allowed methods and header formats, dropping malformed requests before they reach the application servers. This directly satisfies the design requirement and leverages ACI's integration with the firewall for automated policy insertion.

Why this answer

To validate HTTP methods and headers before traffic reaches application servers, you need a Layer 7 inspection point. A Cisco ACI service graph can steer traffic through a Cisco Secure Firewall, where a custom Snort rule enforces the allowed methods and header formats. This design integrates network segmentation with deep packet inspection, ensuring malformed requests are dropped at the firewall rather than consuming application resources.

Exam trap

The trap here is assuming that DNS-layer or URL-reputation security can validate HTTP request semantics, when those controls operate at lower layers and cannot inspect methods or headers.

Full explanation →

196

Multi-Selecthard

You are performing a security assessment of a containerized application architecture. Which TWO of the following configurations are critical for ensuring secure communication between pods in a Cisco ACI-managed Kubernetes environment? (Choose TWO)

Select 2 answers

A.Defining Contracts between EPGs to permit specific traffic types.

B.Disabling the ACI CNI plugin to allow native Kubernetes network policies.

C.Assigning pods to appropriate EPGs based on their function.

D.Configuring all pods to reside in a single flat, non-segmented network.

E.Using physical cabling to separate traffic by VLAN.

AnswersA, C

Defining Contracts between EPGs enforces Cisco ACI's whitelist security model, permitting only explicitly specified protocols and ports between endpoint groups. This satisfies the stem's requirement for secure pod-to-pod communication by replacing default any-to-any traffic with granular, policy-driven segmentation across the fabric.

Why this answer

Option A is correct because in Cisco ACI, Contracts define the permitted protocols, ports, and directions of traffic between EPGs, so defining Contracts between EPGs enforces microsegmentation and only allows the specific traffic types required between pods. Option C is correct because pods must be mapped to the appropriate EPGs based on their function; the EPG is the policy enforcement boundary in ACI, so without correct pod-to-EPG assignment, Contracts cannot be applied to the right workloads. Option B is incorrect because disabling the ACI CNI plugin removes ACI's native integration with Kubernetes networking and policy enforcement, undermining rather than improving secure pod communication.

Option D is incorrect because a single flat, non-segmented network eliminates the segmentation that ACI EPGs and Contracts rely on to isolate and control pod traffic. Option E is incorrect because physical cabling and VLAN separation are not the mechanism for securing pod-to-pod communication in an ACI-managed Kubernetes environment, where policy is enforced logically through EPGs and Contracts.

Exam trap

The trap is thinking that native Kubernetes NetworkPolicies are sufficient in an ACI environment, when ACI requires its CNI plugin and Contracts to enforce fabric-level segmentation.

Full explanation →

197

MCQeasy

In the context of Cisco Cloudlock, what is a 'Shadow IT' application?

A.An application that is blocked by the firewall

B.A backup tool for the data center

C.A SaaS application connected to the enterprise environment without official IT authorization

D.A malicious script running on an endpoint

AnswerC

Shadow IT denotes SaaS applications users adopt and connect to corporate data without IT review or approval. Cloudlock discovers these unsanctioned apps via API inspection, flagging them because they bypass official security assessment and authorisation.

Why this answer

In Cisco Cloudlock, a 'Shadow IT' application is any SaaS application that is being used within the enterprise environment without explicit IT approval or oversight. Cloudlock discovers these by analyzing traffic and OAuth grants to sanctioned cloud services, revealing unsanctioned apps that may pose data-loss or compliance risks. The defining characteristic is unauthorized SaaS usage, not malicious code or firewall blocking.

Exam trap

The trap here is confusing 'unauthorized SaaS usage' with 'malicious software' or 'blocked traffic' — candidates who equate Shadow IT with malware or firewall rules pick the wrong option.

How to eliminate wrong answers

Option A is wrong because a firewall-blocked application is the opposite of Shadow IT — Shadow IT is typically not blocked and is often invisible to traditional perimeter controls. Option B is wrong because a backup tool for the data center is an on-premises infrastructure utility, not a SaaS application, and has no relation to the Shadow IT concept. Option D is wrong because a malicious script on an endpoint is malware, which is a threat detection concern, whereas Shadow IT refers to unsanctioned but often legitimate SaaS apps.

Full explanation →

198

Multi-Selectmedium

Which THREE services does Cisco Umbrella provide to secure remote workers? (Select 3)

Select 3 answers

A.Host-based Antivirus

B.Local network DHCP service

C.Cloud Access Security Broker (CASB)

D.Secure Web Gateway (SWG)

E.DNS-layer security

AnswersC, D, E

Umbrella's CASB discovers and controls sanctioned and unsanctioned SaaS usage, applying inline policies and shadow-IT reporting for remote users regardless of location. This satisfies the stem's requirement for a cloud-delivered service securing remote workers without backhauling traffic through headquarters.

Why this answer

Cisco Umbrella delivers DNS-layer security (E), which blocks malicious domains and IPs before a connection is established by resolving DNS requests through Umbrella's global resolvers, protecting remote workers regardless of their location. It also provides Secure Web Gateway (SWG) (D) functionality, including URL filtering, SSL inspection, and file inspection to enforce acceptable-use and block risky web content. Additionally, Umbrella offers Cloud Access Security Broker (CASB) (C) capabilities to discover and control sanctioned and unsanctioned SaaS applications and protect cloud data.

Host-based Antivirus (A) is not an Umbrella service, as endpoint antivirus is provided by products such as Cisco Secure Endpoint, not Umbrella. Local network DHCP service (B) is also not offered by Umbrella; DHCP is a network infrastructure function handled by routers, switches, or dedicated DHCP servers, not a cloud security service.

Exam trap

SDSI often tests whether candidates confuse Umbrella's cloud-delivered network security services with endpoint-based protections like antivirus, so host-based options are the classic distractor.

Full explanation →

199

Multi-Selecthard

Which TWO Cisco products are used to monitor and detect threats in a network environment?

Select 2 answers

A.Cisco Secure Network Analytics (Stealthwatch).

B.Cisco Secure Email.

C.Cisco ISE.

D.Cisco AnyConnect.

E.Cisco Secure Firewall (IPS).

AnswersA, E

Secure Network Analytics (Stealthwatch) uses NetFlow and telemetry to baseline traffic and detect anomalies such as beaconing, exfiltration, and lateral movement across the network. This satisfies the requirement to monitor and detect threats in the environment.

Why this answer

Cisco Secure Network Analytics (Stealthwatch) (A) is correct because it uses NetFlow and flow telemetry with behavioral analytics and machine learning to continuously monitor network traffic and detect anomalies, insider threats, and malware command-and-control activity. Cisco Secure Firewall (IPS) (E) is correct because its Intrusion Prevention System inspects traffic inline against signatures and behavioral policies to detect and block exploits, malicious payloads, and known attack patterns. Cisco Secure Email (B) is not a network monitoring/detection product in this context; it focuses on securing email communications (spam, phishing, malware filtering) rather than monitoring network traffic for threats.

Cisco ISE (C) is a policy and identity/access-control platform (802.1X, profiling, posture, guest access), not a threat monitoring/detection tool. Cisco AnyConnect (D) is a VPN/remote-access client providing secure connectivity, not network threat monitoring or detection.

Exam trap

SDSI often tests whether candidates can distinguish detection/monitoring products (Stealthwatch, IPS) from access control (ISE), email security (Secure Email), and endpoint VPN (AnyConnect) — the trap is selecting any Cisco security product as a 'threat detection' tool without checking its actual function.

Full explanation →

200

MCQhard

You are designing a management plane security strategy for Cisco networking devices. Which protocol is recommended to replace Telnet to ensure encrypted administrative sessions?

A.Netconf

B.SSH

C.SNMPv2c

D.HTTPS

AnswerB

SSH encrypts the entire administrative session, including credentials and configuration commands, using strong ciphers and host-key authentication. Telnet transmits everything in cleartext, exposing passwords to interception. SSH therefore satisfies the stem's requirement for encrypted management-plane access to Cisco devices, replacing Telnet for all remote administrative connections.

Why this answer

SSH (Secure Shell) is the standard replacement for Telnet because it provides encrypted, authenticated administrative sessions. Telnet transmits credentials and commands in cleartext, while SSH uses strong encryption (AES, ChaCha20) and integrity checking to protect the management plane.

Exam trap

SDSI often tests whether candidates confuse protocols that run over SSH (NETCONF) or secure web management (HTTPS) with the direct encrypted replacement for Telnet — the answer is SSH for CLI sessions.

How to eliminate wrong answers

Option A is wrong because NETCONF is a configuration-management protocol that typically runs over SSH but is not itself a general-purpose interactive admin session replacement for Telnet. Option C is wrong because SNMPv2c is a monitoring protocol that uses cleartext community strings and provides no encrypted interactive session — it's actually less secure than Telnet in some respects. Option D is wrong because HTTPS secures web-based management (GUI) but does not replace Telnet for CLI administrative sessions.

Full explanation →

201

MCQmedium

A security architect is reviewing the risk register for a financial services network. A new risk has been identified: unmanaged IoT devices on the corporate LAN could be used as pivot points to reach PCI-scoped servers. The business has mandated that the design must prevent any communication between IoT endpoints and PCI zones, even if the IoT devices are compromised. Which Cisco ISE design element should the architect include to enforce this segmentation requirement?

A.Security Group Tags (SGTs) with enforcement on Cisco Catalyst switches using SGACL policies

B.802.1X with MAC Authentication Bypass (MAB) to profile and authorize IoT devices

C.Cisco TrustSec policy with Security Group ACLs applied on the Cisco Secure Firewall

D.Change of Authorization (CoA) to dynamically reassign IoT devices to a quarantine VLAN

AnswerA

SGTs assign a tag to IoT endpoints via ISE and enforce SGACLs on network devices, blocking traffic to PCI-tagged resources. This provides scalable, identity-based micro-segmentation without relying on IP addresses, directly meeting the requirement to prevent any communication between IoT and PCI zones.

Why this answer

The requirement is to prevent any communication between IoT and PCI zones, even if IoT devices are compromised. Security Group Tags (SGTs) with SGACL enforcement on Cisco Catalyst switches provide identity-based micro-segmentation directly on the network fabric, ensuring that traffic from IoT-tagged devices to PCI-tagged resources is blocked regardless of IP address changes. This is a core Cisco TrustSec design pattern for regulatory compliance and least-privilege access.

Exam trap

The trap here is assuming that authentication or quarantine alone provides segmentation, when in fact only a policy enforcement mechanism like SGACLs can block specific group-to-group traffic.

Full explanation →

202

MCQmedium

A DevSecOps team is designing an automated vulnerability remediation workflow for Cisco Secure Workload. When a new workload with a critical CVE is detected, the workflow must isolate the workload and create a ServiceNow incident without manual intervention. Which Cisco Secure Workload capability should be the foundational integration point for this design?

A.REST API with role-based access control and webhook subscriptions

B.Syslog forwarding to a SIEM with automated correlation rules

C.SNMP traps for event notification and automated action triggering

D.Cisco Secure Workload agent CLI for local script execution

AnswerA

Cisco Secure Workload provides a comprehensive REST API that supports role-based access control and webhook subscriptions. These allow the DevSecOps pipeline to programmatically query workload vulnerabilities, trigger isolation policies, and push incident details to ServiceNow. The API is the primary automation interface, enabling the workflow to act without human intervention while maintaining security boundaries.

Why this answer

The REST API with role-based access control and webhook subscriptions is the correct foundational integration point because it enables programmatic, secure, and event-driven automation. It allows the DevSecOps pipeline to detect vulnerabilities, enforce isolation policies, and create ServiceNow incidents without manual steps. Other options are either monitoring-only or local mechanisms that cannot orchestrate cross-system remediation.

Exam trap

The trap here is assuming that any event notification method, such as syslog or SNMP, can serve as the primary automation interface, when true orchestration requires an authenticated API that can enforce policy changes.

Full explanation →

203

Multi-Selecthard

When designing the architecture for a highly secure API ecosystem, which THREE security layers should be implemented? (Choose THREE)

Select 3 answers

A.Open-access policies for all internal microservices

B.Service Mesh for internal mTLS and authorization

C.Physical air-gapping of all servers

D.Centralized API security and observability platform

E.API Gateway/Ingress Controller for edge security

AnswersB, D, E

A service mesh enforces mutual TLS and fine-grained authorisation between internal workloads, satisfying the requirement for east-west traffic protection without application code changes. It secures service-to-service calls inside the ecosystem, complementing perimeter controls and identity-based access for a defence-in-depth API architecture.

Why this answer

Option B is correct because a service mesh provides mutual TLS (mTLS) between internal microservices, giving strong workload identity and encryption in transit plus fine-grained authorization policies (e.g., via Istio or Linkerd) without changing application code. Option D is correct because a centralized API security and observability platform aggregates API discovery, schema validation, threat detection, and logging/metrics/tracing, enabling consistent policy enforcement and rapid incident response across the ecosystem. Option E is correct because an API Gateway or Ingress Controller terminates external traffic at the edge, enforcing TLS, authentication/authorization, rate limiting, WAF rules, and request validation before traffic reaches backend services.

Option A is not appropriate because open-access policies for internal microservices eliminate authentication and authorization, violating zero-trust and least-privilege principles. Option C is not appropriate because physically air-gapping all servers is impractical for a connected API ecosystem and does not address application-layer API threats such as injection, broken object-level authorization, or token abuse.

Exam trap

SDSI often tests whether candidates pick extreme or impractical controls (air-gapping, open internal access) instead of the layered, zero-trust-aligned trio of gateway, mesh, and centralized observability.

Full explanation →

204

Multi-Selectmedium

Which TWO factors are vital for an effective firewall policy design?

Select 2 answers

A.Logical organization and rule documentation.

B.Disabling all logging.

C.Least privilege principle.

D.Using only IP addresses.

E.Permit all traffic by default.

AnswersA, C

Grouping rules by function and documenting each rule's purpose, owner and intent keeps the policy set auditable and maintainable. This satisfies the design requirement for clarity, reducing shadowed or redundant rules and enabling safe change control as the estate grows.

Why this answer

Option A (Logical organization and rule documentation) is correct because an effective firewall policy must be structured in a readable, top-down order (most specific rules first) and documented so that each rule's purpose, owner, and review date are known, which prevents rule sprawl and makes troubleshooting and audits feasible. Option C (Least privilege principle) is correct because firewall rules should permit only the specific traffic required for a business function—defined by source/destination, port, and protocol—and deny everything else, minimizing the attack surface. The unmarked options do not belong: disabling all logging (B) removes the audit trail needed to detect and investigate denied or permitted traffic, using only IP addresses (D) ignores ports, protocols, and applications and is insufficient for granular control, and permitting all traffic by default (E) is an implicit allow-any rule that defeats the purpose of a firewall.

Exam trap

The trap is selecting operational shortcuts like disabling logging or permit-all defaults; the exam expects recognition that documentation, logical structure, and least privilege are the foundational design factors.

Full explanation →

205

MCQhard

An organization experiences a breach where a malicious file was downloaded. Which Cisco product can be used to perform 'retrospective' analysis on that file's history across the organization?

A.Cisco Stealthwatch.

B.Cisco Secure Endpoint (AMP).

C.Cisco Secure Email.

D.Cisco Umbrella.

AnswerB

Cisco Secure Endpoint retains file trajectory and prevalence data, letting analysts retrospectively trace a malicious file's history and affected hosts across the organisation. This retrospective hunting capability directly matches the stem's requirement after the download breach.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) maintains a cloud-based file reputation and retrospective analysis capability. When a file is later determined to be malicious, Secure Endpoint can retroactively query its telemetry to identify every endpoint where that file was seen, enabling retrospective detection and response. Stealthwatch is network flow analytics, Secure Email handles email-borne threats, and Umbrella is DNS-layer security — none provide endpoint file-history retrospective analysis.

Exam trap

The trap is confusing network-layer visibility (Stealthwatch, Umbrella) with endpoint file-history retrospective analysis; the exam wants you to associate 'retrospective' with Secure Endpoint/AMP.

How to eliminate wrong answers

Option A is wrong because Cisco Stealthwatch is a network traffic and flow analytics platform (NetFlow/IPFIX) that detects anomalies, not a file-history retrospective analysis tool. Option C is wrong because Cisco Secure Email inspects email messages and attachments at the gateway, but does not maintain endpoint file execution history for retrospective queries. Option D is wrong because Cisco Umbrella provides DNS-layer security and secure web gateway functions, not endpoint file retrospective analysis.

Full explanation →

206

MCQhard

Which Cisco API Security feature is used to prevent attackers from using automated scripts to brute-force API endpoints?

A.DNS-layer filtering

B.API rate limiting and behavioral analytics

C.JWT token encryption

D.Schema validation

AnswerB

Rate limiting caps request volume per client, defeating high-frequency brute-force attempts, while behavioural analytics baselines normal API usage and flags anomalous patterns such as credential-stuffing bursts. Together they satisfy the stem's constraint of stopping automated scripted attacks against API endpoints.

Why this answer

API rate limiting caps the number of requests a client can make per time window, which directly throttles brute-force scripts, while behavioral analytics detects patterns like credential stuffing, sequential ID enumeration, and abnormal request velocity that indicate automation. Together they address OWASP API4 (Unrestricted Resource Consumption) and API2 (Broken Authentication) in the API context.

Exam trap

SDSI often tests whether candidates conflate network-layer defenses (DNS filtering) or cryptographic controls (JWT encryption) with application-layer abuse prevention — the trap is picking a control that protects data but does not stop automated request floods.

How to eliminate wrong answers

Option A is wrong because DNS-layer filtering blocks resolution of known malicious domains but does nothing against an attacker hitting a legitimate API endpoint directly by IP or hostname. Option C is wrong because JWT encryption protects token confidentiality in transit but does not slow or detect repeated authentication attempts — an attacker can still replay or brute-force credentials. Option D is wrong because schema validation only rejects malformed payloads; a brute-force request with a valid schema and wrong password passes validation cleanly.

Full explanation →

207

MCQhard

You are designing a secure infrastructure for a SaaS-heavy office. What strategy best minimizes the impact on user experience while maintaining security?

A.Backhauling all traffic to the data center.

B.Implementing DIA with localized SASE security.

C.Using a client-based proxy for everything.

D.Bypassing all security for trusted SaaS apps.

AnswerB

Direct Internet Access routes SaaS traffic straight from the branch to the provider, and localised SASE points of presence apply DNS-layer security, SWG and CASB inline. This removes backhauling through the data centre, cutting latency while keeping enforcement.

Why this answer

Direct Internet Access (DIA) with localized SASE security allows users to connect directly to SaaS applications from the nearest point of presence, reducing latency and improving performance. Security is enforced in the cloud through SASE, which applies consistent policies without backhauling traffic. This approach balances user experience with robust security, as it avoids unnecessary traffic detours while still inspecting and protecting all sessions.

Exam trap

SDSI often tests the misconception that backhauling traffic is necessary for security, when in fact modern SASE architectures provide better security with DIA by enforcing policies at the edge.

How to eliminate wrong answers

Option A is wrong because backhauling all traffic to the data center introduces significant latency and bottlenecks, degrading user experience for cloud services. Option C is wrong because a client-based proxy for everything adds overhead, can be bypassed, and often leads to performance issues and complex management. Option D is wrong because bypassing all security for trusted SaaS apps creates blind spots and exposes the organization to data leaks and threats, violating zero-trust principles.

Full explanation →

208

MCQmedium

You are designing an IoT security strategy for a manufacturing site. Which approach best isolates unmanaged IoT devices from the enterprise network?

A.Deploy a transparent firewall in bridge mode at the distribution layer.

B.Implement Cisco ISE with SGT-based micro-segmentation.

C.Enable PortFast on all IoT switch ports.

D.Assign static VLANs to all IoT ports on access switches.

AnswerB

ISE with SGT-based micro-segmentation assigns security group tags to profiled IoT devices and enforces group-to-group policy on the fabric, so unmanaged devices reach only permitted destinations. This satisfies the stem's isolation requirement without relying on endpoint agents the devices cannot run.

Why this answer

Cisco ISE with SGT-based micro-segmentation (TrustSec) provides granular isolation of IoT devices by assigning Security Group Tags and enforcing policies across the network, even within the same VLAN. This approach best isolates unmanaged IoT devices from the enterprise network because it enables dynamic segmentation and policy enforcement based on device identity and context, not just network topology.

Exam trap

SDSI often tests the difference between network segmentation (VLANs) and micro-segmentation (SGT); candidates may choose VLANs for isolation, but VLANs alone do not provide identity-based policy enforcement or prevent intra-VLAN attacks.

How to eliminate wrong answers

Option A is wrong because a transparent firewall in bridge mode at the distribution layer can filter traffic but does not provide identity-based micro-segmentation and may not scale for many IoT devices; it also lacks integration with ISE for dynamic policy. Option C is wrong because PortFast is a spanning-tree enhancement that speeds up port transition to forwarding; it has no security or isolation function and can actually be risky on ports connected to switches. Option D is wrong because static VLANs provide only coarse isolation at Layer 2 and do not prevent lateral movement within the same VLAN or enforce identity-based policies; they also require manual configuration and are not dynamic.

Full explanation →

209

Multi-Selectmedium

Which TWO design considerations are critical for a secure SD-WAN edge deployment?

Select 2 answers

A.Using local breakout for all internet traffic without inspection.

B.Deploying devices with default passwords.

C.Centralized security policy enforcement via vManage.

D.Automated IPsec tunnel encryption.

E.Disabling the control plane firewall.

AnswersC, D

Centralised policy enforcement through vManage pushes consistent security rules to every edge device, satisfying the requirement for uniform protection across distributed sites. vManage's single-pane management eliminates per-device configuration drift, ensuring firewall, intrusion prevention and segmentation policies remain identical network-wide without manual intervention at each branch.

Why this answer

Option C is correct because Cisco SD-WAN's vManage controller provides centralized policy management, allowing consistent security and application-aware policies to be pushed to all edge devices, which is essential for maintaining a uniform security posture across a distributed SD-WAN fabric. Option D is correct because automated IPsec tunnel encryption secures the data plane by encrypting traffic between WAN edge devices, protecting data in transit across untrusted transports such as the internet. Option A is incorrect because local breakout without inspection bypasses security controls and exposes traffic to threats, undermining a secure edge design.

Option B is incorrect because deploying devices with default passwords creates a serious vulnerability that attackers can easily exploit. Option E is incorrect because disabling the control plane firewall removes protection for the SD-WAN control plane, leaving it exposed to unauthorized access and attacks.

Exam trap

SDSI often tests the misconception that local internet breakout is inherently secure or that default configurations are acceptable, when in fact centralized policy and encryption are non-negotiable for a secure SD-WAN edge.

Full explanation →

210

Multi-Selectmedium

Which THREE factors influence the design of a SOC incident response plan?

Select 3 answers

A.Regulatory compliance requirements (e.g., GDPR).

B.The personal hobbies of the SOC analysts.

C.The price of the office furniture.

D.The technical capabilities of the security product stack.

E.The business impact of downtime for critical services.

AnswersA, D, E

Regulatory compliance requirements such as GDPR dictate mandated breach notification timelines, evidence retention and reporting obligations. These legal constraints directly shape incident response plan design, forcing defined escalation paths and documentation standards that the SOC must follow during and after an incident.

Why this answer

Option A is correct because regulatory compliance requirements such as GDPR, HIPAA, or PCI DSS impose mandatory breach notification timelines, data-handling rules, and documentation duties that the incident response plan must explicitly address. Option D is correct because the technical capabilities of the security product stack — for example, whether the SOC has EDR, SIEM correlation, SOAR playbook automation, or network forensics — directly determine which detection, containment, and eradication actions the plan can realistically execute. Option E is correct because the business impact of downtime for critical services drives incident severity classification, prioritization, and recovery time objectives (RTOs), ensuring response efforts protect the most vital business functions first.

Option B does not belong because analysts' personal hobbies are irrelevant to professional incident response design, and Option C does not belong because office furniture pricing has no bearing on security, compliance, or business continuity considerations in a SOC plan.

Exam trap

SDSI often tests which factors are relevant to SOC design, so candidates may pick distractors that sound plausible but are unrelated to security, compliance, or business impact.

Full explanation →

211

MCQhard

During a post-incident review, an architect identifies that Cisco Stealthwatch (Secure Network Analytics) failed to alert on lateral movement due to lack of visibility. Which design modification is required to ensure visibility into internal east-west traffic?

A.Update the Cisco Secure Endpoint policy to scan memory more frequently on all endpoints.

B.Enable NetFlow export from core and distribution layer switches to the Stealthwatch Flow Collector.

C.Increase the logging interval on the perimeter Cisco Firepower Management Center.

D.Integrate the Cisco ISE platform via pxGrid to force all internal hosts to re-authenticate.

AnswerB

Stealthwatch derives its analytics from flow telemetry, so east-west visibility depends on NetFlow exported from core and distribution switches to the Flow Collector. Without that export, internal lateral movement generates no flow records, leaving the gap identified in the review unaddressed.

Why this answer

Stealthwatch (Cisco Secure Network Analytics) relies on flow telemetry—primarily NetFlow/IPFIX—to build its behavioral baselines and detect anomalies such as lateral movement. Without flow export from internal Layer 3 boundaries (core and distribution switches), the Flow Collector only sees perimeter traffic and cannot observe east-west conversations between internal hosts. Enabling NetFlow export from those switches feeds the Flow Collector the internal flow records needed to detect anomalous host-to-host behavior.

Exam trap

SDSI often tests the misconception that endpoint agents or identity platforms (ISE/pxGrid) provide network flow visibility—candidates must remember Stealthwatch is a flow-based NDR tool that depends on NetFlow/IPFIX from network devices, not endpoint or identity telemetry.

How to eliminate wrong answers

Option A is wrong because Secure Endpoint is an endpoint detection and response (EDR) agent that inspects files, processes, and memory on hosts—it does not provide network flow visibility into east-west traffic and cannot feed Stealthwatch's flow analytics. Option C is wrong because increasing logging on the perimeter Firepower Management Center only enriches perimeter firewall logs; it does nothing to expose internal switch-to-switch or host-to-host traffic flows. Option D is wrong because ISE pxGrid integration provides identity, posture, and SGT context for policy enforcement, not the raw flow telemetry Stealthwatch needs to detect lateral movement.

Full explanation →

212

MCQmedium

You are designing a microsegmentation strategy using Cisco Secure Workload (formerly Tetration) for a multi-tier application. Which mechanism allows you to enforce fine-grained security policies between application tiers while maintaining visibility across the hybrid cloud?

A.Applying static ACLs on the core switch

B.Using policy-based agents on endpoints to enforce segmentation

C.Implementing Cisco ASA zone-based firewalling

D.Configuring VRF-Lite on the distribution layer

AnswerB

Policy-based agents installed on endpoints enforce fine-grained segmentation by applying allow/deny rules at the workload itself, regardless of network topology. This maintains visibility and consistent enforcement across on-premises and hybrid cloud environments, which host-based firewalls alone cannot achieve.

Why this answer

Cisco Secure Workload uses lightweight software agents installed on workloads (servers, VMs, containers) that enforce microsegmentation policies at the workload level, independent of the underlying network. These agents provide visibility into all flows (including east-west traffic within the same subnet) and enforce fine-grained allow/deny policies between application tiers. Because enforcement is host-based, the same policy model works across on-premises, private cloud, and public cloud environments, which is essential for hybrid cloud visibility and control.

Exam trap

The trap is choosing traditional network-based segmentation (ACLs, ASA zones, VRF-Lite) when the question asks for workload-level, hybrid-cloud-capable microsegmentation, which requires host-based agents.

How to eliminate wrong answers

Option A is wrong because static ACLs on the core switch are coarse, manually maintained, and cannot express workload-level identity or adapt to dynamic workloads; they also do not provide visibility into intra-subnet traffic. Option C is wrong because Cisco ASA zone-based firewalling is a perimeter/edge control that segments by zone, not by individual workload, and does not scale to the granularity of microsegmentation between application tiers. Option D is wrong because VRF-Lite on the distribution layer provides network-level isolation (separate routing tables) but is a Layer 3 topology construct, not a workload-level policy enforcement mechanism, and it does not deliver flow visibility.

Full explanation →

213

Multi-Selectmedium

Which THREE items should be included in a 'Security Design Requirements' document?

Select 3 answers

A.The preferred color scheme for the SOC monitors.

B.List of all potential threat actors and their motivations.

C.Latency requirements for critical business applications.

D.The salary information of the security team.

E.Regulatory compliance requirements (e.g., GDPR, HIPAA).

AnswersB, C, E

Documenting potential threat actors and their motivations scopes the design against realistic adversaries, such as insiders, organised crime or nation-states. This satisfies the requirements document's purpose by tying controls to the threats the organisation actually faces.

Why this answer

Option B is correct because a Security Design Requirements document must identify the threat landscape it is designed to defend against, so enumerating potential threat actors (e.g., nation-state APTs, insider threats, hacktivists) and their motivations (financial gain, espionage, disruption) directly informs the selection of controls, monitoring use cases, and risk prioritization. Option C is correct because latency requirements for critical business applications are a functional constraint that security controls (such as TLS inspection, WAF, DLP, or zero-trust proxies) must respect; documenting acceptable thresholds (e.g., sub-50 ms response time) ensures security architecture does not break business performance SLAs. Option E is correct because regulatory compliance requirements such as GDPR, HIPAA, PCI DSS, or SOX define mandatory legal and contractual controls (data residency, encryption, breach notification timelines, access logging) that the security design must satisfy, making them a core input to the requirements baseline.

Option A is not correct because monitor color schemes are a facilities or ergonomics preference, not a security design requirement. Option D is not correct because security team salary information is an HR and payroll matter and has no bearing on the technical or procedural design of security controls.

Exam trap

SDSI often tests whether candidates can distinguish genuine design requirements from operational or HR trivia, so distractors like monitor colors or salaries are included to see if you apply the right criteria.

Full explanation →

214

MCQeasy

What is the primary role of Cisco Secure Firewall in a network design?

A.To act as a core network switch.

B.To manage user credentials.

C.To provide internet access for all users.

D.To provide traffic inspection, filtering, and access control.

AnswerD

Traffic inspection, filtering and access control are the firewall's core enforcement functions, satisfying the design requirement for stateful segmentation between trust zones. It examines flows against policy and permits or denies them, which is the primary role a Secure Firewall plays in any network design.

Why this answer

Cisco Secure Firewall (formerly Firepower) is a next-generation firewall whose primary role is to inspect traffic, enforce access control policies, and filter based on L3/L4/L7 attributes, application identity, and threat intelligence. It provides stateful inspection, IPS, URL filtering, and application control, making it the enforcement point for network security policy.

Exam trap

SDSI often tests whether candidates confuse the firewall's security enforcement role with connectivity or management functions — candidates pick 'provide internet access' because firewalls are at the edge, but the exam expects you to identify inspection, filtering, and access control as the primary role.

How to eliminate wrong answers

Option A is wrong because a firewall is not a switch — core network switching is handled by Catalyst/Nexus switches; firewalls operate at the network edge or between zones and do not provide high-density L2 switching. Option B is wrong because managing user credentials is the role of identity systems like ISE or Active Directory, not the firewall (though the firewall can consume identity data for policy). Option C is wrong because providing internet access is a routing/NAT function that may involve the firewall, but it is not the primary role — the primary role is security inspection and control, not connectivity.

Full explanation →

215

MCQmedium

A security architect is adapting a design post-incident after a credential theft event. Which Cisco ISE feature should be integrated into the architecture to mitigate the risk of compromised static credentials?

A.Deploying Cisco pxGrid to share user identity info with the firewall.

B.Configuring Cisco TrustSec to segment user traffic based on IP address.

C.Implementing Cisco AnyConnect Device Posture assessment.

D.Enabling MFA integration with Cisco Duo via RADIUS.

AnswerD

Integrating Cisco Duo MFA via RADIUS into Cisco ISE adds a possession or biometric factor at authentication, so a stolen static password alone cannot grant access. This directly mitigates the credential-theft risk described in the post-incident scenario.

Why this answer

Credential theft of static passwords is best mitigated by adding a second authentication factor that cannot be replayed or stolen alongside the password. Integrating Cisco Duo MFA with ISE via RADIUS enforces a second factor (push, TOTP, biometric) at authentication time, so a stolen password alone is insufficient to gain access. This directly addresses the post-incident risk described.

Exam trap

SDSI often tests whether candidates confuse identity sharing (pxGrid), segmentation (TrustSec), or posture (AnyConnect) with actual MFA — the trap is picking a feature that sounds security-related but does not add a second authentication factor.

How to eliminate wrong answers

Option A is wrong because pxGrid shares identity/context information with ecosystem partners (e.g., firewalls) for policy enforcement — it does not add an authentication factor and would not stop a stolen password from being used. Option B is wrong because TrustSec segmentation based on IP address is about micro-segmentation and policy enforcement, not credential protection; moreover, TrustSec uses SGTs, not IP addresses, as its primary construct. Option C is wrong because AnyConnect Device Posture assesses the endpoint's compliance (AV, patches, etc.) — it does not add a second authentication factor and would not mitigate stolen static credentials by itself.

Full explanation →

216

MCQhard

Which tool provides visibility into encrypted traffic without full decryption in a Cisco network design?

A.Cisco Encrypted Traffic Analytics (ETA).

B.Cisco Firepower IPS.

C.Cisco Identity Services Engine (ISE).

D.Cisco Stealthwatch.

AnswerA

Cisco Encrypted Traffic Analytics satisfies the visibility-without-decryption constraint by analysing packet metadata, sequence patterns and initial handshake fields to detect malware in TLS flows. It identifies threats without terminating or decrypting sessions, preserving privacy and performance where full inspection is impractical.

Why this answer

Cisco Encrypted Traffic Analytics (ETA) is designed to identify malware and threats in encrypted traffic without full decryption by using flow metadata, sequence of packet lengths and times (SPLT), and machine learning. It leverages Cisco's Talos threat intelligence and can run on Catalyst switches and ISR/ASR routers. Firepower IPS, ISE, and Stealthwatch do not provide ETA's decryption-free encrypted traffic analysis.

Exam trap

The trap is assuming deep inspection requires decryption; the exam tests that ETA provides encrypted traffic visibility without decryption, and candidates often pick Firepower IPS by default.

How to eliminate wrong answers

Option B is wrong because Cisco Firepower IPS typically requires decryption (SSL/TLS inspection) to inspect encrypted payloads deeply; it does not natively provide decryption-free encrypted traffic analytics. Option C is wrong because Cisco ISE is an identity and access control platform, not an encrypted traffic analysis tool. Option D is wrong because Cisco Stealthwatch analyzes network flows for anomalies but does not perform ETA-style decryption-free malware detection in encrypted traffic.

Full explanation →

217

MCQhard

You are designing a secure API architecture where services are deployed in Kubernetes. You need to enforce authentication and rate limiting at the ingress. Which tool should be used for centralized policy enforcement?

A.An API Gateway integrated into the Ingress Controller

B.Using IP-based ACLs on the Kubernetes node

C.Hard-coding auth logic into every microservice

D.Cisco Secure Firewall running in transparent mode

AnswerA

An API Gateway embedded in the Ingress Controller terminates inbound traffic at the cluster edge, applying authentication and rate-limiting policies centrally before requests reach Kubernetes services. This satisfies the requirement for centralised enforcement at ingress rather than per-service duplication.

Why this answer

An API Gateway integrated into the Ingress Controller is the correct choice because it centralizes authentication, rate limiting, and other cross-cutting concerns at the ingress layer before traffic reaches microservices. This offloads security logic from individual services and provides a single enforcement point for policies like JWT validation, API key checks, and quota management. Tools like Kong, NGINX Ingress with auth plugins, or Istio Gateway with Envoy filters implement this pattern.

Exam trap

The trap is assuming that network-layer controls (ACLs, firewalls) can enforce API-layer policy — candidates pick the firewall or node ACL because they think 'security = network', missing that authentication and rate limiting require L7 awareness.

How to eliminate wrong answers

Option B is wrong because IP-based ACLs on the Kubernetes node operate at L3/L4 and cannot enforce API-level authentication (JWT, OAuth) or per-consumer rate limiting; they also break in dynamic pod environments where IPs change. Option C is wrong because hard-coding auth logic into every microservice duplicates code, increases attack surface, and violates the DRY principle — it also makes consistent policy enforcement impossible across polyglot services. Option D is wrong because a transparent-mode firewall sees traffic but cannot perform API-aware authentication or rate limiting based on HTTP headers, paths, or tokens.

Full explanation →

218

MCQeasy

What is the primary goal of implementing microsegmentation in an enterprise data center?

A.To prevent lateral movement of attackers

B.To increase bandwidth capacity

C.To simplify the network topology

D.To reduce the number of servers required

AnswerA

Microsegmentation applies granular, workload-level policy between east-west flows, so a compromised host cannot freely reach other systems. This containment directly restricts lateral movement, satisfying the stem's goal of limiting an attacker's ability to pivot deeper into the data centre.

Why this answer

Microsegmentation creates granular, workload-level security zones (often down to individual VMs or containers) so that east-west traffic must be explicitly authorized. Its primary security goal is to prevent lateral movement — if an attacker compromises one workload, they cannot freely pivot to others because inter-segment traffic is denied by default. Bandwidth, topology simplification, and server reduction are operational side effects at best, not the goal.

Exam trap

The trap here is confusing the security purpose (containment of lateral movement) with operational benefits (bandwidth, simplification), so candidates who focus on network efficiency rather than breach containment pick the wrong answer.

How to eliminate wrong answers

Option B is wrong because microsegmentation does not increase bandwidth capacity — it enforces policy on east-west flows and may even add inspection overhead; bandwidth is a capacity/design concern, not a segmentation outcome. Option C is wrong because microsegmentation typically adds policy complexity rather than simplifying topology; it overlays logical policy on existing physical networks. Option D is wrong because microsegmentation has no bearing on reducing server count — it is a security control applied to existing workloads, not a consolidation technology.

Full explanation →

219

MCQmedium

A design architect is updating an incident response strategy. What is the role of the 'Post-Incident Architecture Adaptation' phase?

A.To document the costs of the incident.

B.To update the network documentation for the next annual audit.

C.To discipline employees who caused the incident.

D.To identify and implement changes to prevent recurrence of the incident.

AnswerD

This phase reviews root cause and control gaps exposed during the incident, then feeds architectural changes back into the design so the same attack path cannot be exploited again. It closes the response loop by preventing recurrence.

Why this answer

The Post-Incident Architecture Adaptation phase is where lessons learned from an incident are translated into concrete architectural and policy changes to prevent recurrence. It is not about cost accounting, audit documentation, or HR discipline — it is about feeding findings back into the design so the same class of incident is mitigated or eliminated. This aligns with the NIST IR lifecycle 'lessons learned' and continuous improvement stages.

Exam trap

The trap is treating post-incident activities as administrative (cost, audit, discipline) rather than architectural; the exam wants you to recognize that this phase is about design changes to prevent recurrence.

How to eliminate wrong answers

Option A is wrong because documenting incident costs is a financial/after-action reporting activity, not an architectural adaptation phase. Option B is wrong because updating network documentation for an annual audit is a compliance housekeeping task, not the purpose of adapting architecture post-incident. Option C is wrong because disciplining employees is an HR/management function and has nothing to do with architectural change; the phase is about technical and procedural improvements.

Full explanation →

220

MCQhard

You are designing security for a SaaS application integrated via Cisco Cloudlock. Which mechanism allows you to detect anomalous data sharing behavior within Google Workspace?

A.Cisco Umbrella roaming client

B.Cisco ISE Profiling

C.Cloudlock API-based CASB integration

D.Cisco Secure Firewall NAT

AnswerC

Cloudlock's API-based CASB integration scans Google Workspace data at rest via Google's APIs, applying user behaviour analytics to flag anomalous sharing patterns such as sudden external sharing spikes. This satisfies the stem's requirement to detect anomalous data sharing behaviour, which inline proxies cannot inspect retrospectively.

Why this answer

Cisco Cloudlock integrates with Google Workspace through its API-based CASB connection, using OAuth to read Drive, Gmail, and audit logs. That API access gives Cloudlock visibility into file sharing settings, external collaborators, and user activity, and its behavioral analytics baseline normal user behavior to flag anomalies such as mass external sharing or unusual download volumes. Remediation is then performed through the same APIs.

Exam trap

SDSI often tests whether candidates pick network or endpoint tools (Umbrella, ISE, firewall NAT) for SaaS data-sharing detection — the exam wants the API-based CASB integration that actually sees Google Workspace activity.

How to eliminate wrong answers

Option A is wrong because the Umbrella roaming client provides DNS-layer security for endpoints — it has no visibility into Google Workspace sharing settings or user activity. Option B is wrong because ISE Profiling identifies and classifies devices on the network for access control; it does not inspect SaaS application data or sharing behavior. Option D is wrong because Secure Firewall NAT translates addresses at the network layer and has no awareness of SaaS data sharing or user activity within Google Workspace.

Full explanation →

221

MCQhard

Following a major data exfiltration incident, the design team needs to adapt the architecture to prevent lateral movement. Which Cisco Secure Firewall design modification is most effective for mitigating this risk while maintaining operational performance?

A.Enable all IPS signatures in blocking mode

B.Transition to transparent mode

C.Increase firewall inspection timeouts

D.Implement SGT-based micro-segmentation

AnswerD

Security Group Tag-based micro-segmentation enforces least-privilege flows between internal workloads, so a compromised host cannot reach unrelated segments. This directly limits lateral movement after exfiltration while preserving performance, since policy is applied by tag rather than by costly full traffic inspection.

Why this answer

SGT-based micro-segmentation using Cisco TrustSec assigns Security Group Tags to workloads and enforces policy based on those tags rather than IP addresses. This allows the firewall to apply granular east-west controls that prevent lateral movement between compromised and target systems, while keeping policy scalable and operationally efficient. It directly addresses lateral movement risk without the performance penalty of inspecting every signature.

Exam trap

SDSI often tests the confusion between IPS signature tuning (which addresses known threats) and micro-segmentation (which addresses lateral movement), tempting candidates to pick the 'more security' option rather than the architecturally correct one.

How to eliminate wrong answers

Option A is wrong because enabling all IPS signatures in blocking mode increases false positives and CPU load, and IPS signatures do not provide the identity-based east-west segmentation needed to stop lateral movement. Option B is wrong because transparent mode is a Layer 2 deployment mode that changes how the firewall is inserted, not how policy is enforced, so it does not mitigate lateral movement. Option C is wrong because increasing inspection timeouts only affects how long sessions are tracked; it does nothing to restrict traffic between internal segments.

Full explanation →

222

MCQmedium

An organization is updating its SOC incident response toolset. Which Cisco technology provides the ability to perform 'retrospective security' by tracking files that have entered the network in the past?

A.Cisco Secure Network Analytics (Stealthwatch).

B.Cisco Firepower IPS.

C.Cisco Secure Endpoint (AMP).

D.Cisco Umbrella.

AnswerC

Cisco Secure Endpoint continuously records file trajectory and prevalence data, letting analysts retrospectively query files that traversed the network previously and retroactively quarantine them. This satisfies the stem's requirement to track files that entered the network in the past.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) is built on a continuous file-tracking and retrospective-analysis model: every file that enters an endpoint is fingerprinted (SHA-256) and recorded in the cloud, so when new threat intelligence arrives, the system can retroactively query its historical file database and flag files that were previously deemed clean. This 'retrospective security' capability is the defining feature of the AMP/Secure Endpoint architecture and is what allows the SOC to identify past compromises without re-scanning every host.

Exam trap

The trap here is confusing network-visibility tools (Stealthwatch, Umbrella, Firepower) with endpoint file-tracking tools; candidates who equate 'tracking files' with 'inspecting network traffic' will pick Firepower or Stealthwatch instead of Secure Endpoint.

How to eliminate wrong answers

Option A is wrong because Cisco Secure Network Analytics (Stealthwatch) performs network-flow-based anomaly detection and behavioral analytics using NetFlow/IPFIX, but it does not maintain a historical file reputation database capable of retroactively reclassifying files that already entered the network. Option B is wrong because Cisco Firepower IPS is an inline prevention/detection engine that inspects traffic in real time; it does not store file trajectory records for retrospective lookup. Option D is wrong because Cisco Umbrella provides DNS-layer security and secure web gateway functions, blocking malicious domains at resolution time, but it has no file-tracking or retrospective file-reputation capability.

Full explanation →

223

Multi-Selectmedium

Which THREE design components are required for a successful implementation of Cisco TrustSec? (Select 3)

Select 3 answers

A.Cisco ISE

B.Scalable Group Tags (SGTs)

C.DHCP Snooping

D.Cisco Umbrella

E.Network Access Devices (NADs)

AnswersA, B, E

Cisco ISE is the policy decision point that authenticates endpoints, assigns Security Group Tags and publishes the Security Group Access Control List matrix. Without it, TrustSec has no identity-to-tag mapping, so the architecture cannot enforce segmentation.

Why this answer

Cisco ISE (A) is required because it serves as the centralized policy and identity engine for TrustSec, defining and distributing security group tags (SGTs) and policies to network devices. Scalable Group Tags (B) are required because TrustSec uses SGTs as the classification mechanism embedded in packets to enforce role-based access control without relying on IP addresses or subnets. Network Access Devices (E) are required because switches, routers, and wireless controllers must act as NADs to authenticate endpoints, apply SGTs, and enforce Security Group ACLs (SGACLs) in the TrustSec domain.

DHCP Snooping (C) is not a TrustSec design component; it is a Layer 2 security feature used to prevent rogue DHCP servers and does not provide group-based policy enforcement. Cisco Umbrella (D) is a cloud-delivered DNS-layer security service and is unrelated to the TrustSec architecture, which relies on ISE, SGTs, and NADs.

Exam trap

SDSI often tests the core components of TrustSec, and candidates may confuse it with other Cisco security products like Umbrella or include unrelated features like DHCP Snooping.

Full explanation →

224

MCQmedium

A security design requires that all outbound traffic be inspected for malware. Which Cisco solution feature should be included to achieve this at the DNS layer?

A.Cisco AnyConnect VPN tunnel.

B.Cisco Identity Services Engine.

C.Cisco Secure Firewall IPS.

D.Cisco Umbrella DNS-layer security.

AnswerD

Cisco Umbrella resolves DNS requests through its cloud infrastructure, blocking malicious domains before any connection is established, so outbound traffic is inspected at the DNS layer rather than only at the perimeter. This satisfies the stem's requirement to inspect all outbound traffic for malware.

Why this answer

Cisco Umbrella DNS-layer security is specifically designed to block malicious domains and IPs at the DNS resolution stage, before a connection is even established. It inspects DNS queries from all users and devices, regardless of location, and enforces security policies by redirecting malicious requests to a block page. This directly satisfies the requirement to inspect outbound traffic for malware at the DNS layer, as it stops threats like malware callbacks, phishing, and command-and-control communications early in the kill chain.

Exam trap

SDSI often tests the distinction between network-layer inspection (firewall/IPS) and DNS-layer security, causing candidates to overlook that DNS-layer blocking occurs before any connection is made and is not provided by traditional firewalls or VPNs.

How to eliminate wrong answers

Option A is wrong because Cisco AnyConnect VPN tunnel provides encrypted remote access but does not inherently inspect DNS traffic for malware; it secures the transport, not the content. Option B is wrong because Cisco Identity Services Engine is a network access control and policy platform for authentication and authorization, not a DNS-layer security inspection tool. Option C is wrong because Cisco Secure Firewall IPS inspects traffic at the network layer (IP/port/protocol) and application layer, but it does not operate at the DNS layer to block malicious domain resolutions before a connection is made.

Full explanation →

225

Multi-Selecthard

A security architect is designing a risk mitigation strategy for a multinational enterprise that uses Cisco Secure Firewall, Cisco ISE, and Cisco Secure Endpoint. The business requires that the design must detect and block advanced threats that evade traditional signature-based defenses, and must also provide detailed forensics for post-incident analysis. Which two Cisco design components should be included to meet these requirements? (Choose two.)

Select 2 answers

A.Cisco Identity Services Engine (ISE) with posture assessment and profiling

B.Cisco Secure Network Analytics (Stealthwatch) for network traffic analysis and anomaly detection

C.Cisco Secure Firewall with Snort 3 IPS and file policy for malware detection

D.Cisco Umbrella with DNS-layer security and intelligent proxy

E.Cisco Secure Endpoint with Exploit Prevention and Cisco SecureX threat response integration

AnswersB, E

Cisco Secure Network Analytics uses NetFlow and advanced analytics to detect anomalies and advanced threats that bypass signature-based defenses. It provides detailed flow records and forensic data, enabling post-incident analysis. This directly addresses the need for detection of evasive threats and forensics.

Why this answer

To detect and block advanced threats that evade signature-based defenses and provide detailed forensics, the design must include network traffic analysis and endpoint detection and response. Cisco Secure Network Analytics delivers network-wide anomaly detection and forensic flow data, while Cisco Secure Endpoint with Exploit Prevention and SecureX integration blocks endpoint threats and enriches forensics. Together they cover network and endpoint vectors, meeting both requirements.

Exam trap

The trap here is selecting a firewall or DNS security component as the primary advanced threat detection solution, overlooking the need for network traffic analytics and endpoint forensics to catch evasive threats.

Full explanation →

Cisco Designing Cisco Security Infrastructure (SDSI, 300-745, CCNP Security, design-focused) (SDSI) (SDSI) — Questions 151–225