Cisco Designing Cisco Security Infrastructure (SDSI, 300-745, CCNP Security, design-focused) (SDSI) SDSI Questions 226–284 | Page 4/4

226

MCQmedium

Following a ransomware incident, an architect must modify the network segmentation strategy. What is the most effective approach to mitigate lateral movement using Cisco TrustSec?

A.Deploy extended ACLs on every core switch port to block peer-to-peer traffic.

B.Configure static port-security across the entire enterprise to prevent unauthorized devices.

C.Implement SGT-based micro-segmentation at the access layer to enforce policies based on identity rather than IP.

D.Transition all physical cabling to private VLANs without leveraging SGTs.

AnswerC

Security Group Tags decouple policy from IP addressing, letting TrustSec enforce least-privilege segmentation between workloads based on identity and role. Applied at the access layer, this contains compromised hosts and blocks the east-west lateral movement ransomware relies on.

Why this answer

Implementing SGT-based micro-segmentation at the access layer with Cisco TrustSec enforces policies based on identity (security group tags) rather than IP addresses, which effectively mitigates lateral movement by restricting communication between groups even within the same VLAN. This approach is dynamic and scalable, allowing granular control that follows the workload or user, not the IP.

Exam trap

The trap is opting for traditional segmentation methods like ACLs or private VLANs; candidates may overlook that TrustSec's SGT-based approach provides identity-based, scalable micro-segmentation that is specifically designed to stop lateral movement.

How to eliminate wrong answers

Option A is wrong because extended ACLs on core switch ports are static, IP-based, and difficult to manage at scale; they do not provide identity-based segmentation and can be bypassed by IP changes. Option B is wrong because static port-security prevents unauthorized devices but does not segment traffic between authorized devices, so lateral movement is still possible. Option D is wrong because private VLANs without SGTs provide Layer 2 isolation but lack the identity-based policy enforcement and scalability of TrustSec; they also require manual configuration and do not integrate with dynamic environments.

Full explanation →

227

Multi-Selectmedium

Which THREE of the following are key features of Cisco XDR (formerly SecureX) in an automated pipeline?

Select 3 answers

A.Workflow orchestration

B.Incident management and response

C.Threat intelligence aggregation

D.Automated server patching

E.Network packet capture hardware

AnswersA, B, C

Workflow orchestration chains discrete automated actions into a defined sequence, passing outputs between steps. In an automated pipeline this satisfies the need to coordinate multiple security tools without manual intervention, executing the end-to-end process reliably and repeatably.

Why this answer

Cisco XDR (formerly SecureX) is built around an automation pipeline in which Workflow orchestration (A) is a core feature, allowing security teams to design, trigger, and chain automated response actions across integrated Cisco and third-party tools. Incident management and response (B) is also central, since XDR correlates detections into incidents, enriches them, and drives response actions from a single console. Threat intelligence aggregation (C) is likewise a key capability, as XDR ingests and normalizes threat intel from multiple sources (e.g., Cisco Talos, third-party feeds) to enrich detections and inform automated workflows.

Automated server patching (D) is not a Cisco XDR function; patching is handled by endpoint management or vulnerability/patch management tools, not by the XDR platform itself. Network packet capture hardware (E) is a physical appliance concern (e.g., dedicated capture devices or switches with SPAN/TAP), not a feature of the Cisco XDR software platform.

Exam trap

SDSI often tests whether candidates can separate XDR's detection/orchestration role from adjacent operational tasks like patching or packet capture — the trap is picking a plausible-sounding security function that XDR does not actually perform.

Full explanation →

228

MCQmedium

Which risk assessment methodology is best suited to guide a design modification for a cloud-native architecture relying on Cisco Secure Cloud Analytics?

A.ISO 27002 implementation guide.

B.OWASP Top 10 for all infrastructure components.

C.PCI-DSS compliance checklist.

D.NIST SP 800-30 for conducting the assessment.

AnswerD

NIST SP 800-30 provides a structured risk assessment process covering threat identification, likelihood, impact and risk determination, which suits evaluating a design modification for cloud-native architecture monitored by Secure Cloud Analytics. Its qualitative and quantitative approaches accommodate cloud-specific threat sources and vulnerabilities.

Why this answer

NIST SP 800-30 is a risk assessment methodology specifically designed to guide the assessment process, including identifying threats, vulnerabilities, likelihood, and impact. For a cloud-native architecture using Cisco Secure Cloud Analytics, it provides a structured approach to evaluate risks and inform design modifications. It is vendor-neutral and applicable to cloud environments.

Exam trap

SDSI often tests the difference between compliance checklists and risk assessment methodologies, so candidates who pick ISO 27002 or PCI-DSS confuse control frameworks with the actual assessment process.

How to eliminate wrong answers

Option A is wrong because ISO 27002 is an implementation guide for security controls, not a risk assessment methodology; it tells you what controls to consider, not how to conduct the assessment. Option B is wrong because OWASP Top 10 is a list of common web application vulnerabilities, not a comprehensive risk assessment methodology for infrastructure. Option C is wrong because PCI-DSS is a compliance checklist for payment card data, not a general risk assessment framework, and it may not apply to all cloud-native architectures.

Full explanation →

229

MCQeasy

Which Cisco solution provides DNS-layer security to prevent users from connecting to malicious domains?

A.Cisco Stealthwatch.

B.Cisco Umbrella.

C.Cisco ASA Firewall.

D.Cisco Secure Endpoint.

AnswerB

Cisco Umbrella resolves DNS queries through its global network, blocking requests to malicious domains before any connection is established. This satisfies the stem's DNS-layer requirement directly, unlike endpoint or email-based controls. Umbrella enforces policy at resolution time, preventing users from reaching malicious infrastructure regardless of application or port.

Why this answer

Cisco Umbrella is a cloud-delivered security platform that enforces DNS-layer security by resolving DNS queries through its global network. It blocks requests to malicious domains before a connection is established, preventing users from reaching phishing, malware, or command-and-control sites. This proactive blocking at the DNS layer is Umbrella's core function, making it the correct answer.

Exam trap

SDSI often tests the difference between DNS-layer security (Umbrella) and endpoint protection (Secure Endpoint) or flow analytics (Stealthwatch). Candidates may think any security tool can block malicious domains, but only Umbrella specifically operates at the DNS layer.

How to eliminate wrong answers

Option A is wrong because Cisco Stealthwatch (Secure Network Analytics) analyzes network flows for behavioral anomalies but does not provide DNS-layer security or block domain resolution. Option C is wrong because Cisco ASA Firewall is a traditional stateful firewall that filters traffic based on IP, port, and protocol, but it does not natively provide DNS-layer security or domain reputation blocking. Option D is wrong because Cisco Secure Endpoint is an endpoint detection and response (EDR) tool that protects endpoints from malware, but it does not block malicious domains at the DNS resolution stage.

Full explanation →

230

MCQmedium

A security architect is designing a SOC response workflow using Cisco SecureX Orchestration. Which mechanism is most effective for automated remediation of an endpoint identified as compromised via Cisco Secure Endpoint?

A.Triggering a workflow that executes the isolate endpoint action in Cisco Secure Endpoint via API.

B.Deploying an umbrella policy change to redirect the host traffic to a sinkhole.

C.Configuring a local script on the Cisco ASA to block the host IP address.

D.Using Cisco Defense Orchestrator to push a new access control policy to the endpoint.

AnswerA

SecureX Orchestration calls the Cisco Secure Endpoint API to run the isolate endpoint action, immediately cutting the host off from the network while preserving forensic state. This satisfies the requirement for automated remediation of a compromised endpoint.

Why this answer

Cisco SecureX Orchestration is designed to automate security workflows across Cisco and third-party products. The most direct and effective remediation for a compromised endpoint identified by Cisco Secure Endpoint is to isolate the endpoint using its native API. The isolate endpoint action in Secure Endpoint cuts off all network communication except for the management connection to the Secure Endpoint cloud, preventing lateral movement and data exfiltration while allowing further investigation.

This is a built-in, automated response that can be triggered via SecureX Orchestration, making it the correct choice.

Exam trap

SDSI often tests the distinction between endpoint-level remediation (native to Secure Endpoint) and network-level controls (Umbrella, ASA, CDO), so candidates may incorrectly choose a network-based solution when the question specifically asks for automated remediation of an endpoint identified via Cisco Secure Endpoint.

How to eliminate wrong answers

Option B is wrong because deploying an Umbrella policy change to redirect host traffic to a sinkhole is a network-level DNS or web proxy control, not an endpoint isolation mechanism; it does not prevent the compromised host from communicating over non-DNS protocols or to IP addresses directly, and it requires the host to use Umbrella for DNS resolution, which may not be the case. Option C is wrong because configuring a local script on the Cisco ASA to block the host IP address is a manual, perimeter-based mitigation that only blocks traffic at the firewall, not on the endpoint itself; the endpoint can still communicate laterally within the same network segment or via other paths, and this approach is not automated through SecureX Orchestration. Option D is wrong because Cisco Defense Orchestrator is a cloud-based management platform for firewall and security policies, not an endpoint remediation tool; pushing an access control policy to an endpoint is not a native capability of CDO, and it does not provide the immediate isolation that Secure Endpoint's isolate action does.

Full explanation →

231

MCQmedium

Why is 'Behavioral Analysis' a critical component of Cisco API Security?

A.To speed up the API processing

B.To reduce API storage requirements

C.To replace the need for API documentation

D.To detect anomalous and signature-less threats

AnswerD

Behavioural analysis baselines normal API traffic and flags deviations, catching zero-day and polymorphic attacks that lack known signatures. This satisfies the requirement to detect anomalous and signature-less threats, which static signature matching alone cannot identify.

Why this answer

Behavioral analysis is critical in Cisco API Security because it establishes a baseline of normal API call patterns (frequency, payload size, sequence, source, timing) and then flags deviations that indicate attacks. Signature-based detection fails against novel or polymorphic API attacks, so behavioral analysis is what catches zero-day and signature-less threats such as credential stuffing, data scraping, and business-logic abuse. This is the core value proposition of the capability.

Exam trap

The trap is assuming API security is only about signatures and known attack patterns — candidates pick options about performance or documentation because they misunderstand that behavioral analysis addresses unknown, signature-less threats.

How to eliminate wrong answers

Option A is wrong because behavioral analysis does not speed up API processing — it adds inspection overhead, not performance optimization. Option B is wrong because behavioral analysis does not reduce storage requirements; if anything, it requires storing baseline and event data for comparison. Option C is wrong because behavioral analysis does not replace API documentation — documentation (OpenAPI/Swagger) is still needed for schema validation and developer enablement; behavioral analysis complements, not replaces, it.

Full explanation →

232

Multi-Selectmedium

Which TWO of the following are true about 'Policy as Code' in Cisco security infrastructure?

Select 2 answers

A.Policies are stored in version control systems

B.Policies are always written in assembly language

C.Policies are automatically applied without review

D.Policies are only for cloud-native apps

E.Policies can be validated with automated tests

AnswersA, E

Storing policies in version control gives each change a commit history, reviewable diffs and rollback, which is the defining property of Policy as Code: policy definitions are treated as source artefacts rather than manual device configuration.

Why this answer

Option A is correct because Policy as Code treats policy definitions as source artifacts, so they are stored in version control systems such as Git, enabling history, branching, peer review, and rollback. Option E is correct because Policy as Code supports automated testing and validation pipelines (for example, unit tests, linting, and CI checks) that verify policies before deployment, catching errors early. Option B is incorrect because policies are expressed in high-level declarative languages or DSLs (for example, HashiCorp Sentinel, OPA/Rego, or YAML), not assembly language.

Option C is incorrect because automated application does not mean unreviewed application; Policy as Code typically includes review and approval gates in the CI/CD pipeline. Option D is incorrect because Policy as Code applies broadly to cloud, on-premises, and hybrid Cisco security infrastructure, not only cloud-native apps.

Exam trap

SDSI often tests the misconception that Policy as Code means policies are auto-applied without human review, confusing automation with lack of governance.

Full explanation →

233

MCQeasy

What is the primary goal of the 'Requirement Gathering' phase in the Cisco security design process?

A.To install the hardware.

B.To define the business and technical requirements for the security system.

C.To document the budget only.

D.To troubleshoot existing issues.

AnswerB

Requirement Gathering captures what the business needs and what the technical environment must support before any design work begins. This defines the scope, constraints and success criteria that every later phase — architecture, design and implementation — is measured against, ensuring the security system addresses real organisational needs rather than assumed ones.

Why this answer

The Requirement Gathering phase in the Cisco security design process is the foundational step where the security team collaborates with stakeholders to identify and document both business and technical requirements. This includes understanding business objectives, regulatory compliance needs, risk tolerance, and operational constraints, which then inform the technical specifications for the security system. Without this phase, the design lacks alignment with organizational goals and may fail to address critical security gaps.

Exam trap

SDSI often tests the distinction between phases of the Cisco security design process, and candidates may confuse Requirement Gathering with implementation or troubleshooting tasks, leading them to select options that describe later phases.

How to eliminate wrong answers

Option A is wrong because installing hardware occurs during the implementation or deployment phase, not during requirement gathering. Option C is wrong because documenting the budget is only one small part of requirement gathering; the phase encompasses a broader set of business and technical requirements, not just financial aspects. Option D is wrong because troubleshooting existing issues is part of operations and maintenance, not the initial design phase where the goal is to define requirements for a new or updated security system.

Full explanation →

234

MCQeasy

A security designer is choosing a firewall architecture for a high-throughput data center core. Which Cisco Firewall platform is purpose-built for this requirement?

A.Cisco Firepower 4100/9300 Series

B.Cisco Meraki MX

C.Cisco Firepower 1010

D.Cisco ASA 5506-X

AnswerA

The Firepower 4100/9300 Series delivers high-throughput, low-latency inspection purpose-built for data centre core deployments, scaling to hundreds of Gbps. Its chassis-based architecture and clustering satisfy the stem's high-throughput core constraint, unlike branch-focused appliances such as the 1000 Series.

Why this answer

The Cisco Firepower 4100 and 9300 Series are purpose-built high-throughput data center firewall appliances, designed for the core with multi-hundred-Gbps throughput, high connection rates, and clustering/HA capabilities. They run FTD (Firepower Threat Defense) and integrate with FMC for centralized management, making them the correct choice for a high-throughput data center core.

Exam trap

SDSI often tests whether candidates can distinguish branch/SMB firewalls (Meraki MX, Firepower 1010, ASA 5506-X) from true data center core platforms (Firepower 4100/9300), catching those who pick a familiar name without checking throughput class.

How to eliminate wrong answers

Option B is wrong because Cisco Meraki MX is a cloud-managed branch/SMB appliance with limited throughput and no data center core-class performance or clustering. Option C is wrong because the Firepower 1010 is a small desktop branch appliance with roughly 1-2 Gbps throughput, far below data center core requirements. Option D is wrong because the ASA 5506-X is an end-of-life small branch firewall with low throughput and no modern FTD feature set for a data center core.

Full explanation →

235

MCQhard

When designing a multi-cloud CI/CD security architecture, how should secrets (API keys for Cisco FMC) be managed to ensure compliance?

A.Embed as environment variables in the build runner

B.Encrypt with base64 and store in Git

C.Use a dedicated Secret Management service

D.Hardcode in the Terraform provider block

AnswerC

A dedicated Secret Management service stores API keys centrally and injects them at runtime, so credentials never persist in pipeline code, repositories or build logs. This satisfies the compliance constraint by enforcing rotation, auditing and least-privilege access across every cloud in the multi-cloud CI/CD architecture.

Why this answer

A dedicated Secret Management service (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) provides centralized, auditable, and policy-driven storage for sensitive credentials like Cisco FMC API keys. It enforces encryption at rest and in transit, supports dynamic secrets and rotation, and integrates with CI/CD pipelines via short-lived tokens, ensuring compliance with standards such as PCI DSS, HIPAA, and SOC 2. This approach eliminates hardcoded secrets and reduces the blast radius of a compromise.

Exam trap

SDSI often tests the misconception that encoding (base64) or environment variables provide sufficient security for secrets, when in fact only a dedicated secret management service with encryption, rotation, and auditing meets compliance requirements.

How to eliminate wrong answers

Option A is wrong because environment variables are often exposed in process listings, logs, or crash dumps, and they lack encryption, rotation, and audit trails. Option B is wrong because base64 is an encoding, not encryption—it provides zero confidentiality and secrets in Git are permanently exposed in history. Option D is wrong because hardcoding secrets in Terraform provider blocks stores them in plaintext in state files and version control, violating compliance and security best practices.

Full explanation →

236

Multi-Selecthard

Which TWO design considerations are critical for a secure management plane for Cisco networking devices? (Select 2)

Select 2 answers

A.Enabling HTTP for the Web GUI

B.Implementing ACLs on VTY lines

C.Disabling the console port

D.Using SNMPv1

E.Using SSH instead of Telnet

AnswersB, E

Applying ACLs to VTY lines restricts which source addresses may attempt remote management sessions, satisfying the requirement to harden the management plane. Combined with protocols such as SSH, this prevents unauthorised hosts reaching the device's administrative interfaces.

Why this answer

Option B is correct because implementing ACLs on VTY lines restricts which source IP addresses can establish remote management sessions to the device, blocking unauthorized hosts from attempting to reach the management plane over Telnet or SSH. Option E is correct because SSH encrypts management traffic and provides authenticated, integrity-protected sessions, whereas Telnet sends credentials and commands in cleartext, making it unsuitable for a secure management plane. The remaining options do not belong: enabling HTTP for the Web GUI (A) exposes management access without encryption, disabling the console port (C) is not a standard secure-management requirement and can hinder out-of-band recovery, and using SNMPv1 (D) is insecure because it relies on cleartext community strings and lacks strong authentication and encryption.

Exam trap

SDSI often tests whether candidates can identify secure management plane practices (SSH, VTY ACLs, SNMPv3, HTTPS) versus insecure ones (Telnet, HTTP, SNMPv1) and whether they mistakenly treat disabling the console port as a security best practice rather than an availability risk.

Full explanation →

237

Multi-Selecthard

A security architect is designing a DevSecOps pipeline that integrates Cisco Identity Services Engine (ISE) with a CI/CD system to enforce dynamic network access for build agents. The pipeline must ensure that only compliant build agents can access production deployment targets. Which two design considerations are critical for this integration? (Choose two.)

Select 2 answers

A.Use static MAC address filtering on switches to identify build agents, and manually update the filter list when new agents are added.

B.Configure Cisco ISE to use RADIUS Change of Authorization (CoA) to terminate sessions of non-compliant build agents.

C.Rely on the CI/CD orchestrator's built-in secrets management to authenticate build agents, and use network ACLs to restrict access to production.

D.Deploy Cisco ISE in monitor mode to log all build agent traffic without enforcing policies, allowing the CI/CD system to make its own access decisions.

E.Use Cisco ISE pxGrid to publish build agent compliance posture to the CI/CD orchestrator for dynamic authorization decisions.

AnswersB, E

RADIUS CoA allows Cisco ISE to dynamically change the authorization of an active session, such as disconnecting a build agent that fails a compliance check. In a DevSecOps pipeline, this ensures that if an agent becomes non-compliant during a build, its network access is revoked immediately. This is critical for preventing compromised or misconfigured agents from reaching production targets.

Why this answer

The critical design considerations are using Cisco ISE pxGrid to share compliance posture with the CI/CD orchestrator and configuring RADIUS CoA to revoke access for non-compliant agents. Together, they enable dynamic, real-time enforcement that adapts to build agent compliance states, which is essential for secure DevSecOps pipelines. Monitor mode, static MAC filtering, and reliance on orchestrator secrets do not provide the necessary dynamic network enforcement.

Exam trap

The trap here is assuming that logging or static network controls can substitute for dynamic, posture-based enforcement, when true DevSecOps integration requires real-time context sharing and session revocation.

Full explanation →

238

Multi-Selecthard

When designing a secure API environment, which THREE threat categories should be prioritized for detection by Cisco API Security? (Choose THREE)

Select 3 answers

A.Broken Object Level Authorization (BOLA)

B.Excessive Data Exposure

C.Broken Authentication

D.Local fiber optic cable breaks

E.Standard server hardware failures

AnswersA, B, C

BOLA occurs when an API fails to verify that the requesting user owns the object referenced by an identifier, letting attackers access other users' data by manipulating IDs. It is the top API risk because object-level checks are frequently omitted, making it a priority detection category.

Why this answer

Cisco API Security prioritizes the OWASP API Security Top 10 threats, which include Broken Object Level Authorization (BOLA) (A), Excessive Data Exposure (B), and Broken Authentication (C). BOLA is critical because attackers manipulate object identifiers in API calls to access resources belonging to other users, making it the most prevalent API vulnerability. Excessive Data Exposure is prioritized because APIs often return full data objects and rely on the client to filter sensitive fields, leaking PII or confidential data.

Broken Authentication is a core API threat since weak token handling, credential stuffing, or flawed JWT validation lets attackers impersonate legitimate users. Options D and E are incorrect because local fiber optic cable breaks and standard server hardware failures are physical infrastructure availability issues handled by redundancy and disaster recovery, not API-layer threat detection.

Exam trap

SDSI often tests whether candidates can distinguish API-layer threats from generic infrastructure failures, so the distractor options are physical/hardware events that sound like 'threats' but aren't API security categories.

Full explanation →

239

MCQmedium

You are designing microsegmentation for a Kubernetes cluster using Cisco Tetration (Secure Workload). Which specific architectural component must be deployed within the Kubernetes worker nodes to enforce policy without relying on external firewall hairpining?

A.Cisco ASA Virtual Appliance

B.Secure Workload Software Agent

C.Cisco Nexus Dashboard Orchestrator

D.Cisco Firepower Management Center

AnswerB

The Secure Workload software agent runs inside each Kubernetes worker node, applying policy enforcement locally at the workload's network namespace. This avoids hairpinning traffic to external firewalls, satisfying the requirement for in-node enforcement without external detours.

Why this answer

The Secure Workload Software Agent must be deployed on Kubernetes worker nodes to enforce microsegmentation policy locally at the workload level. The agent intercepts traffic at the host's network stack (via iptables/eBPF or similar) and applies Tetration's policy without hairpinning traffic to an external firewall. This distributed enforcement model is the core of Cisco Secure Workload's architecture for container and VM environments.

Exam trap

SDSI often tests the distinction between centralized firewall enforcement (hairpinning) and distributed agent-based enforcement — candidates pick a firewall appliance because it sounds 'more secure', missing that the question explicitly rules out external hairpinning.

How to eliminate wrong answers

Option A is wrong because a Cisco ASA Virtual Appliance is a perimeter firewall that would require traffic to be routed through it (hairpinning), which is exactly what the question says to avoid, and it has no native Kubernetes pod-level policy integration. Option C is wrong because Cisco Nexus Dashboard Orchestrator manages ACI/Multisite fabric policy, not workload-level microsegmentation inside Kubernetes nodes. Option D is wrong because Cisco Firepower Management Center manages Firepower threat defense devices, which are external enforcement points, not in-node agents.

Full explanation →

240

MCQhard

A security design architect needs to ensure that all endpoints have the latest malware signatures. Which tool provides continuous, automated updates?

A.Cisco Secure Firewall.

B.Cisco ISE.

C.Cisco Secure Endpoint.

D.Cisco Umbrella.

AnswerC

Cisco Secure Endpoint cloud console continuously pushes signature and engine updates to enrolled endpoints without manual intervention, ensuring every agent holds current malware detection content, which satisfies the requirement for continuous automated signature updating across all endpoints.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) is the endpoint detection and response (EDR) agent that continuously updates malware signatures and cloud-based threat intelligence on managed endpoints. Its cloud reputation engine and signature sets are pushed automatically without administrator intervention, satisfying the requirement for continuous, automated updates.

Exam trap

SDSI often tests the distinction between network-layer security products (Firewall, Umbrella) and host-layer endpoint agents (Secure Endpoint), so candidates who see 'malware' and reflexively pick a firewall or DNS security tool get burned.

How to eliminate wrong answers

Option A is wrong because Cisco Secure Firewall is a network perimeter/inspection platform (NGFW/IPS) that does not install endpoint agents or manage host-based malware signatures. Option B is wrong because Cisco ISE is a network access control and policy platform for identity/802.1X, not an endpoint malware-signature distribution tool. Option D is wrong because Cisco Umbrella is a DNS-layer and secure web gateway service that blocks malicious domains but does not push malware signatures to endpoint operating systems.

Full explanation →

241

MCQmedium

A security architect is developing a requirements document for a SOC. Which Cisco capability allows the SOC to prioritize alerts by correlating threats across network, endpoint, and cloud?

A.Cisco SecureX cross-product correlation.

B.Cisco Stealthwatch alert grouping.

C.Cisco Secure Firewall management center alert correlation.

D.Cisco Identity Services Engine monitoring.

AnswerA

SecureX ingests telemetry from Cisco Secure Firewall, Secure Endpoint and Umbrella, then applies cross-product correlation to surface a single prioritised alert, satisfying the SOC's requirement to correlate threats across network, endpoint and cloud rather than triaging each console separately.

Why this answer

Cisco SecureX is the platform that aggregates and correlates threat intelligence and events across Cisco's portfolio — network (Secure Firewall, Umbrella), endpoint (Secure Endpoint), and cloud (Umbrella, cloud security) — into a single ribbon and threat response view. Its cross-product correlation is what lets a SOC prioritize alerts by seeing that an endpoint detection, a network flow, and a cloud log all relate to the same threat. The other options are single-domain tools that lack cross-domain correlation.

Exam trap

The trap is selecting a domain-specific tool (Stealthwatch, FMC, ISE) that correlates within its own silo, when the question explicitly requires cross-domain (network + endpoint + cloud) correlation.

How to eliminate wrong answers

Option B is wrong because Stealthwatch (now Secure Network Analytics) groups network flow alerts but does not correlate endpoint or cloud telemetry. Option C is wrong because Secure Firewall Management Center correlates events only within the firewall/IPS domain, not across endpoint and cloud. Option D is wrong because ISE monitors identity and network access events, not threats across network, endpoint, and cloud.

Full explanation →

242

MCQmedium

Which Cisco product is best for enforcing security policy based on the user's AD group membership?

A.Cisco Umbrella.

B.Cisco Secure Firewall.

C.Cisco Identity Services Engine (ISE).

D.Cisco Stealthwatch.

AnswerC

Cisco Identity Services Engine integrates with Active Directory, importing user and group attributes, then applies those groups within authorisation policies for wired, wireless and VPN access. This satisfies the requirement to enforce network policy based on AD group membership rather than IP address alone.

Why this answer

Cisco Identity Services Engine (ISE) is the product designed to enforce security policy based on user identity and AD group membership. ISE integrates with Active Directory to retrieve group memberships and uses that information in authorization policies, which can then be enforced on network devices via RADIUS, TrustSec, or pxGrid. This makes ISE the correct choice for identity-based policy enforcement tied to AD groups.

Exam trap

The trap is confusing enforcement with visibility — candidates pick Secure Firewall or Stealthwatch because they enforce or monitor traffic, but only ISE natively maps AD group membership to authorization policy.

How to eliminate wrong answers

Option A is wrong because Cisco Umbrella provides DNS-layer security and secure web gateway functions, not AD group-based policy enforcement. Option B is wrong because Cisco Secure Firewall enforces firewall and IPS policy but relies on ISE or AD Agent for identity context; it does not natively enforce AD group membership by itself. Option D is wrong because Cisco Stealthwatch is a network traffic analysis and anomaly detection tool, not a policy enforcement engine for AD group membership.

Full explanation →

243

MCQmedium

What is the primary design benefit of deploying Cisco Secure Workload as a 'software-only' solution in a public cloud environment?

A.It reduces the need for VPC configuration

B.It guarantees 100% protection against all malware

C.It provides consistent security enforcement without relying on physical network appliances

D.It automates the creation of virtual machines

AnswerC

Software-only deployment removes dependence on physical appliances, so enforcement travels with the workload across public cloud regions and availability zones. This satisfies the stem's design constraint: consistent policy application where hardware cannot be inserted, including east-west traffic between cloud-native workloads.

Why this answer

A software-only deployment of Cisco Secure Workload runs as agents or virtual appliances within the cloud environment, so it enforces policy consistently across workloads without depending on physical network appliances that cannot be inserted into cloud traffic paths. This preserves microsegmentation and visibility even as workloads scale and migrate.

Exam trap

SDSI often tests whether candidates recognize that cloud security requires software-defined enforcement because physical appliances cannot see intra-cloud traffic — the trap is assuming a hardware appliance or VPC configuration alone provides equivalent protection.

How to eliminate wrong answers

Option A is wrong because Secure Workload still requires proper VPC, subnet, and security group configuration — it augments, not replaces, cloud network design. Option B is wrong because no security product guarantees 100% protection against all malware; Secure Workload focuses on workload behavior and microsegmentation, not signature-based malware blocking. Option D is wrong because Secure Workload does not automate VM creation; it discovers and protects existing workloads, and VM lifecycle is handled by cloud-native or orchestration tools.

Full explanation →

244

MCQmedium

Which risk assessment technique involves evaluating the impact of an attack on the confidentiality, integrity, and availability of an asset?

A.CIA Triad Impact Assessment.

B.SWOT Analysis.

C.Network Penetration Testing.

D.Cost-Benefit Analysis.

AnswerA

The CIA Triad Impact Assessment maps each identified threat against confidentiality, integrity and availability, quantifying business harm per asset. This directly satisfies the stem's requirement to evaluate attack impact across those three security objectives, producing the risk ratings that drive subsequent control selection.

Why this answer

The CIA Triad Impact Assessment evaluates how an attack would degrade Confidentiality, Integrity, and Availability of a specific asset, which is the standard qualitative/quantitative risk technique for scoring asset-level impact. It directly maps threat events to business impact on the three core security pillars, producing the impact half of a risk calculation (Risk = Likelihood × Impact).

Exam trap

The trap here is confusing broad strategic or testing frameworks (SWOT, pen testing, cost-benefit) with the specific CIA-impact scoring technique that risk assessments use to quantify asset damage.

How to eliminate wrong answers

Option B is wrong because SWOT Analysis is a strategic business planning framework (Strengths, Weaknesses, Opportunities, Threats) that assesses organizational positioning, not the CIA impact of an attack on an asset. Option C is wrong because Network Penetration Testing is an active technical validation exercise that discovers and exploits vulnerabilities — it identifies weaknesses but does not itself quantify CIA impact on an asset. Option D is wrong because Cost-Benefit Analysis compares the monetary cost of a control against its expected benefit; it is a financial justification tool, not an impact-assessment technique for confidentiality, integrity, and availability.

Full explanation →

245

MCQmedium

You are designing security for a SaaS application integrated with Cisco Cloudlock. A user is persistently attempting to share sensitive documents with external parties. Which Cloudlock feature should be applied to remediate this?

A.Implement MFA for the SaaS login portal

B.Enable Cisco Umbrella DNS-layer protection

C.Create a policy to automatically unshare files containing PII with external collaborators

D.Configure an API Key for the SaaS platform

AnswerC

Automated unsharing directly enforces the remediation constraint: Cloudlock's policy engine detects PII-classified files shared externally and revokes those permissions without analyst intervention. Because the user shares persistently, only an automatic corrective action stops the exposure at the moment of violation, rather than merely alerting after the fact.

Why this answer

Cisco Cloudlock is a cloud access security broker (CASB) that provides data loss prevention (DLP) and user behavior analytics for SaaS applications. The scenario describes a user persistently sharing sensitive documents externally, which is a data exfiltration risk. The correct remediation is to create a Cloudlock policy that automatically unshares files containing PII when shared with external collaborators.

This directly addresses the behavior by enforcing a data-centric control that revokes unauthorized sharing, aligning with Cloudlock's core policy enforcement capabilities.

Exam trap

SDSI often tests the confusion between authentication controls (like MFA) and data-centric remediation, leading candidates to choose MFA when the issue is data exfiltration rather than unauthorized access.

How to eliminate wrong answers

Option A is wrong because MFA strengthens authentication but does not prevent an already authenticated user from sharing files externally; it addresses access, not data exfiltration. Option B is wrong because Cisco Umbrella provides DNS-layer security to block malicious domains, not to control file-sharing actions within SaaS applications. Option D is wrong because configuring an API key is an integration step for Cloudlock to access the SaaS platform, not a remediation feature for stopping data leaks.

Full explanation →

246

MCQhard

When conducting a risk assessment, what is the best way to determine the value of an asset to the organization?

A.Perform a Business Impact Analysis (BIA).

B.Check the manufacturer's list price.

C.Ask the IT department for their opinion.

D.Check the hardware replacement cost.

AnswerA

A Business Impact Analysis quantifies how disruption to each asset affects critical business processes, translating technical assets into financial and operational terms. This gives the risk assessment an objective, business-driven asset value rather than relying on subjective technical judgement, satisfying the stem's requirement for determining organisational value.

Why this answer

A Business Impact Analysis (BIA) is the formal process for determining the criticality and value of assets by assessing the operational, financial, legal, and reputational impact of their loss or disruption. It identifies critical business functions, dependencies, and recovery objectives (RTO/RPO), which directly translate into asset value for risk assessment. Manufacturer price, IT opinion, and hardware replacement cost reflect only acquisition cost, not business value.

Exam trap

The trap is equating asset value with acquisition or replacement cost, when risk assessment requires business impact — candidates pick the tangible cost option instead of the BIA.

How to eliminate wrong answers

Option B is wrong because manufacturer list price reflects purchase cost, not the business impact of losing the asset; a cheap server hosting a critical database is far more valuable than its price. Option C is wrong because IT opinion is subjective and may not reflect business priorities or regulatory impact. Option D is wrong because hardware replacement cost ignores downtime, data loss, and reputational damage, which are often the dominant components of asset value.

Full explanation →

247

MCQmedium

What is the primary architectural benefit of deploying an API Gateway in a microservices environment?

A.It centralizes security and policy enforcement for all services

B.It makes all internal services public-facing

C.It eliminates the need for service-to-service security

D.It provides data storage for the microservices

AnswerA

The gateway intercepts all north-south traffic, so authentication, authorisation, rate limiting and threat inspection are enforced once at a single choke point rather than duplicated per microservice. This satisfies the microservices requirement by decoupling cross-cutting security policy from individual service code.

Why this answer

An API Gateway acts as a single entry point for all client requests, centralizing cross-cutting concerns such as authentication, authorization, rate limiting, and logging. This offloads these responsibilities from individual microservices, ensuring consistent policy enforcement and reducing duplication. By handling security at the edge, services can focus on business logic, and internal services remain protected behind the gateway.

Exam trap

SDSI often tests the misconception that an API Gateway eliminates all security concerns, leading candidates to overlook the need for service-to-service security and choose option C.

How to eliminate wrong answers

Option B is wrong because an API Gateway does not make internal services public-facing; it actually shields them by exposing only the gateway's endpoints and keeping services private. Option C is wrong because service-to-service security is still necessary; the gateway secures north-south traffic (client-to-service), but east-west traffic (service-to-service) requires separate mechanisms like mutual TLS or service meshes. Option D is wrong because an API Gateway is not a data storage component; it routes requests and enforces policies but does not persist data.

Full explanation →

248

Multi-Selecthard

Which TWO identity-based design considerations are critical for secure endpoint access? (Select 2)

Select 2 answers

A.Device posture validation

B.Port security configuration

C.Disabling DHCP

D.Physical cabling security

E.Multi-factor authentication

AnswersA, E

Device posture validation satisfies the requirement for identity-based endpoint access by feeding compliance signals—encryption status, patch level, EDR health—into Conditional Access, so Microsoft Entra ID grants tokens only to healthy devices. This enforces zero-trust least privilege at the endpoint rather than trusting credentials alone.

Why this answer

Device posture validation (A) is critical because identity-based endpoint access must verify the endpoint's health and compliance state—such as OS patch level, disk encryption, and EDR agent status—before granting access, typically enforced via NAC or Zero Trust policy engines. Multi-factor authentication (E) is also critical because it strengthens identity assurance by requiring a second factor (e.g., TOTP, FIDO2 security key, or push notification) beyond a password, mitigating credential theft and replay attacks. Port security configuration (B) is a Layer 2 switch feature that limits MAC addresses per port and is not an identity-based access consideration.

Disabling DHCP (C) is not an identity control and would break normal IP address assignment rather than secure endpoint access. Physical cabling security (D) addresses physical-layer protection and does not validate user or device identity for endpoint access.

Exam trap

SDSI often tests the distinction between identity-based controls (user/device authentication and authorization) and network-based controls (port security, DHCP, physical security), so candidates may mistakenly select network hardening options as identity considerations.

Full explanation →

249

MCQeasy

Which Cisco solution is best suited to prevent data exfiltration from a cloud-native Kubernetes cluster?

A.Cisco Secure Workload

B.Cisco DNA Center

C.Cisco Umbrella

D.Cisco Meraki Dashboard

AnswerA

Cisco Secure Workload maps workload dependencies and enforces microsegmentation at the process and container level, restricting lateral movement and outbound flows from Kubernetes pods. This satisfies the data exfiltration constraint by denying unauthorised egress from cloud-native clusters, even when workloads are ephemeral and dynamically scheduled.

Why this answer

Cisco Secure Workload is purpose-built for workload-level protection, including containerized and Kubernetes environments, using agents and flow telemetry to enforce microsegmentation and detect anomalous behavior that could indicate exfiltration. It understands pod-to-pod communication and can apply policies at the container level. The other options are network, wireless, or DNS-layer tools without Kubernetes workload context.

Exam trap

The trap is picking Umbrella because it's a well-known Cisco security product — but Umbrella operates at DNS/web layer, not inside Kubernetes clusters, so it cannot see or stop pod-level exfiltration.

How to eliminate wrong answers

Option B is wrong because Cisco DNA Center is a campus/enterprise network controller for switches, wireless, and SD-Access — it has no visibility into Kubernetes pod traffic or container workloads. Option C is wrong because Cisco Umbrella is a DNS-layer security and secure web gateway service; it can block malicious domains but cannot inspect or segment east-west pod traffic inside a cluster. Option D is wrong because Cisco Meraki Dashboard manages Meraki cloud-managed networking hardware (switches, APs, MX appliances) and does not provide workload-level container security.

Full explanation →

250

Multi-Selectmedium

Which TWO design considerations are essential when implementing a Zero Trust architecture for IoT devices in a campus environment using Cisco ISE and TrustSec?

Select 2 answers

A.Using static IP addresses for every IoT device to ensure consistency.

B.Utilizing Cisco ISE to profile and categorize IoT endpoints.

C.Applying Scalable Group Tags (SGTs) to enforce micro-segmentation.

D.Ensuring all IoT devices are placed in the same VLAN for easier management.

E.Disabling 802.1X for all non-PC devices.

AnswersB, C

Cisco ISE profiling discovers IoT endpoints and assigns them to logical groups based on fingerprinting attributes, giving the identity foundation Zero Trust requires. Without accurate classification, no meaningful authorisation policy can be applied to unmanaged campus devices.

Why this answer

Option B is correct because Cisco ISE's profiling and endpoint categorization is foundational to Zero Trust for IoT: ISE uses probes (RADIUS, SNMP, DHCP, NMAP, etc.) and profiling policies to identify device types, which then drives authorization and policy decisions rather than trusting the device by default. Option C is correct because TrustSec Scalable Group Tags (SGTs) applied to IoT endpoints enable micro-segmentation via Security Group ACLs (SGACLs) enforced on network devices, so traffic between IoT groups and other segments is restricted based on group membership rather than IP addresses or VLANs. Static IP addressing (A) is not essential and actually complicates profiling and dynamic policy, since DHCP-based profiling and identity context are commonly leveraged.

Placing all IoT devices in one VLAN (D) contradicts Zero Trust micro-segmentation by creating a flat, overly permissive broadcast domain. Disabling 802.1X for all non-PC devices (E) weakens identity-based access control and is not a Zero Trust design principle; IoT devices should be authenticated where possible (e.g., MAB, 802.1X with certificates) and then authorized through ISE.

Exam trap

SDSI often tests the misconception that static IPs or flat VLANs simplify IoT management, when Zero Trust actually requires profiling and SGT-based micro-segmentation rather than network-layer shortcuts.

Full explanation →

251

Multi-Selecthard

Which TWO of the following steps are required to integrate a security tool (like Cisco Secure Firewall) into a CI/CD pipeline?

Select 2 answers

A.Replace the existing firewall hardware

B.Hardcode credentials in the pipeline build file

C.Configure API authentication credentials

D.Disable all firewall rules for testing

E.Use an infrastructure provisioning tool

AnswersC, E

Automated pipeline integration requires the security tool to accept programmatic calls, so API authentication credentials (tokens or keys) must be provisioned and stored securely. Without them, the CI/CD orchestrator cannot authenticate to Cisco Secure Firewall and trigger policy or scan actions.

Why this answer

Option C is correct because integrating a security tool such as Cisco Secure Firewall into a CI/CD pipeline requires configuring API authentication credentials so the pipeline can programmatically authenticate to the firewall's REST API and push policy or configuration changes. Option E is correct because an infrastructure provisioning tool (e.g., Terraform, Ansible, or similar IaC tooling) is needed to declaratively deploy and manage the firewall configuration as part of the automated pipeline stages. Option A is not required, since integration is a software/API-level task and does not mandate replacing existing firewall hardware.

Option B is wrong because hardcoding credentials in the build file is an insecure anti-pattern; secrets should be stored in a vault or secret manager. Option D is wrong because disabling all firewall rules for testing would remove the very security controls being validated and is not a legitimate integration step.

Exam trap

SDSI often tests the misconception that CI/CD integration requires hardware changes or disabling security; the exam expects you to know that API credentials and infrastructure-as-code tools are the correct enablers.

Full explanation →

252

Multi-Selecthard

To ensure effective post-incident architecture adaptation, which THREE items must be included in the design documentation for future reference? (Choose three)

Select 3 answers

A.User password policies

B.Modified security policy logic

C.Log correlation and alert rules

D.Hardware rack elevation diagrams

E.Automated response orchestration workflows

AnswersB, C, E

Recording modified security policy logic preserves the reasoning behind post-incident changes, letting architects trace which rules were altered, why, and how they affect future designs, which is essential for adapting the architecture after subsequent incidents.

Why this answer

Option B (Modified security policy logic) is correct because post-incident architecture adaptation requires documenting how security policies were changed in response to the incident, so future teams understand the rationale and can maintain or evolve those controls. Option C (Log correlation and alert rules) is correct because the detection engineering artifacts—correlation rules, thresholds, and alert logic—must be captured to preserve the improved detection capability and enable tuning after the incident. Option E (Automated response orchestration workflows) is correct because SOAR/automation playbooks encode the validated response actions and must be documented so the orchestration can be reused, audited, and updated as the architecture changes.

Option A (User password policies) is not a post-incident architecture adaptation artifact; password policy is a standing access-control baseline, not incident-derived design documentation. Option D (Hardware rack elevation diagrams) is physical infrastructure documentation unrelated to adapting the architecture based on incident lessons.

Exam trap

The trap is selecting generic IT documentation (password policies, rack diagrams) that sounds like 'documentation' but has no relationship to incident-driven architecture adaptation; the exam tests whether you understand that only detection, policy, and response artifacts are relevant.

Full explanation →

253

Multi-Selectmedium

A SOC manager requests a design that simplifies the incident investigation process. Which TWO Cisco tools should the design include for improved correlation of network traffic and endpoint events? (Choose two)

Select 2 answers

A.Cisco DNA Spaces

B.Cisco Secure Network Analytics

C.Cisco Smart Licensing

D.Cisco Nexus Dashboard

E.Cisco Secure Endpoint

AnswersB, E

Secure Network Analytics supplies the network side of the correlation: flow telemetry from NetFlow and IPFIX, behavioural analytics and detections that reveal anomalous traffic and command-and-control activity. Combined with endpoint telemetry, it lets investigators pivot between network and host evidence, satisfying the stem's correlation requirement.

Why this answer

Cisco Secure Network Analytics (formerly Stealthwatch) is correct because it provides network traffic visibility and behavioral analytics, using flow telemetry (NetFlow/IPFIX) and entity modeling to detect and correlate suspicious network activity across the infrastructure, which directly supports incident investigation. Cisco Secure Endpoint (formerly AMP for Endpoints) is correct because it delivers endpoint detection and response telemetry—file trajectory, process lineage, and threat verdicts—that can be correlated with network events to reconstruct an incident's scope and root cause. Together these two tools give the SOC the network-plus-endpoint correlation the manager requested.

Cisco DNA Spaces is a location analytics and indoor positioning platform, not a security correlation tool, so it does not belong. Cisco Smart Licensing is a license management framework and Cisco Nexus Dashboard is a data center operations and automation console, neither of which correlates network traffic with endpoint events.

Exam trap

SDSI often tests which Cisco tools are used for security correlation versus other purposes (e.g., location analytics, licensing, data center management). Candidates may pick tools that sound relevant but lack security correlation capabilities.

Full explanation →

254

Multi-Selectmedium

Which THREE components in Cisco Secure Workload are essential for building a Zero Trust segmentation policy? (Choose THREE)

Select 3 answers

A.Policy enforcement agents

B.Manual IP address manual entry

C.Flow telemetry analysis

D.Physical cable management

E.Workload discovery and profiling

AnswersA, C, E

Policy enforcement agents apply segmentation rules directly on workloads, translating the intended Zero Trust policy into enforced allow or deny decisions at the workload level. Without enforcement, segmentation policy remains theoretical, so agents are essential to building it.

Why this answer

Option A (Policy enforcement agents) is correct because Cisco Secure Workload relies on agents installed on workloads (or agentless integrations) to enforce the microsegmentation policies at the workload level, translating the intent-based policy into actual allow/deny rules on the host. Option C (Flow telemetry analysis) is correct because Secure Workload continuously ingests flow data from the agents and network devices to map actual workload-to-workload communication, which is the foundation for defining least-privilege segmentation rules. Option E (Workload discovery and profiling) is correct because before any Zero Trust policy can be built, Secure Workload must discover workloads, label them by attributes (e.g., environment, role, application), and profile their behavior to create accurate policy scopes.

Option B (Manual IP address manual entry) is not part of the Zero Trust segmentation workflow in Secure Workload, which uses dynamic labels and policy constructs rather than static IP lists. Option D (Physical cable management) is a Layer 1 cabling task unrelated to building segmentation policy in Cisco Secure Workload.

Exam trap

The trap here is confusing physical or manual infrastructure tasks (cabling, manual IP entry) with the software-defined components that actually drive Zero Trust policy in Secure Workload.

Full explanation →

255

MCQeasy

When selecting a security approach for email threats, which Cisco technology provides automated sandboxing to protect against zero-day phishing?

A.Cisco Duo MFA.

B.Cisco Secure Malware Analytics.

C.Cisco Umbrella DNS layer security.

D.Cisco Secure Endpoint protection.

AnswerB

Cisco Secure Malware Analytics (formerly Threat Grid) performs automated sandbox detonation of suspicious attachments and URLs, analysing behaviour to catch zero-day phishing that signature-based filters miss. This directly satisfies the stem's requirement for automated sandboxing against previously unknown email threats.

Why this answer

Cisco Secure Malware Analytics (formerly Threat Grid) is Cisco's automated malware analysis and sandboxing platform. It detonates suspicious files and URLs in an isolated environment, observes behavior, and produces threat scores and indicators, which is exactly the automated sandboxing needed to catch zero-day phishing payloads that signature-based filters miss. It integrates with email security (ESA) to submit attachments and links for analysis.

Exam trap

SDSI often tests product-to-function mapping, so the trap is confusing DNS-layer blocking (Umbrella), endpoint AV (Secure Endpoint), or MFA (Duo) with the actual sandboxing engine (Secure Malware Analytics).

How to eliminate wrong answers

Option A is wrong because Duo MFA is an identity/access-control solution for authentication, not a malware sandbox. Option C is wrong because Umbrella DNS-layer security blocks malicious domains at resolution time but does not detonate and analyze file behavior in a sandbox. Option D is wrong because Secure Endpoint is endpoint protection (AV/EDR) on the host, not the email-focused automated sandboxing service.

Full explanation →

256

MCQhard

When designing an API security architecture, what is the primary purpose of 'API Discovery' in the context of Cisco API Security?

A.To replace the need for API gateways

B.To inventory all API endpoints and identify shadow or undocumented APIs

C.To increase the API's performance

D.To automatically generate API documentation for developers

AnswerB

API Discovery continuously scans network traffic and cloud environments to build an inventory of every API endpoint, including undocumented and shadow APIs. This visibility is the prerequisite for enforcing policy, since you cannot protect endpoints you have not identified or classified within the API security architecture.

Why this answer

API Discovery in Cisco API Security is fundamentally an inventory and visibility function: it enumerates all API endpoints actually in use across the environment and compares them against documented/registered APIs to surface shadow (undocumented) and orphaned (unused) APIs. This gives security teams the complete attack surface picture needed before they can apply any protection. It is a prerequisite for policy enforcement, not a replacement for gateways or a performance feature.

Exam trap

The trap is conflating discovery with documentation generation or gateway replacement — candidates pick 'generate documentation' because discovery produces an API catalog, but the exam wants the security purpose: inventory and shadow API identification.

How to eliminate wrong answers

Option A is wrong because API Discovery is a visibility/inventory capability that complements API gateways — gateways enforce policy on known APIs, while discovery finds the unknown ones the gateway may not even be fronting. Option C is wrong because discovery has no bearing on API performance; it is a security posture and asset management function. Option D is wrong because while discovery can inform documentation efforts, its primary purpose is security inventory and shadow API identification, not developer-facing documentation generation — that is a side benefit, not the core purpose.

Full explanation →

257

MCQeasy

Which Cisco product provides visibility into traffic within the cloud, helping to identify potential microsegmentation policies?

A.Cisco DNA Center

B.Cisco Secure Workload

C.Cisco Meraki

D.Cisco Umbrella

AnswerB

Cisco Secure Workload maps workload dependencies and east-west traffic flows across cloud environments, revealing which assets communicate. That visibility lets architects draft accurate microsegmentation policies rather than guessing, satisfying the stem's requirement for cloud traffic insight.

Why this answer

Cisco Secure Workload (formerly Tetration) provides deep visibility into workload-to-workload traffic in data centers and cloud environments, using flow telemetry to map dependencies and recommend microsegmentation policies. It is the Cisco product explicitly designed to discover traffic patterns and then generate and enforce microsegmentation policy. This matches the question's requirement for cloud traffic visibility to inform microsegmentation.

Exam trap

SDSI often tests product-to-function mapping, and candidates confuse Secure Workload (data center/cloud workload microsegmentation) with Umbrella (DNS/internet security) or DNA Center (campus fabric), so they pick the wrong visibility tool.

How to eliminate wrong answers

Option A is wrong because Cisco DNA Center is a campus/branch network controller and assurance platform (SD-Access, fabric provisioning), not a cloud workload traffic visibility or microsegmentation tool. Option C is wrong because Cisco Meraki is a cloud-managed networking portfolio (switches, APs, MX security appliances) for branch/campus, not a data center microsegmentation analytics engine. Option D is wrong because Cisco Umbrella is a DNS-layer security and secure web gateway (SIG) service for internet-bound traffic, not east-west cloud workload flow analysis.

Full explanation →

258

MCQmedium

A design team is implementing Cisco ISE for a hybrid work environment. Which Cisco ISE architectural component is responsible for processing RADIUS and TACACS+ requests while offloading policy decision logic from the Administration node?

A.Primary Administration Node (PAN)

B.Policy Service Node (PSN)

C.Monitoring Node (MnT)

D.Policy Information Point (PIP)

AnswerB

The Policy Service Node processes RADIUS and TACACS+ authentication, authorisation and accounting requests, evaluating policy and returning decisions to network devices. This offloads policy decision logic from the Administration node, which handles configuration and management rather than live request processing.

Why this answer

The Policy Service Node (PSN) is the Cisco ISE persona that receives and processes RADIUS and TACACS+ authentication, authorization, and accounting requests from network devices. PSNs run the policy engine locally, evaluating identity and posture against policy sets, so the PAN does not have to handle every live authentication. This offloads policy decision logic and provides horizontal scalability and redundancy for access requests.

Exam trap

SDSI often tests whether candidates confuse the control plane (PAN) with the data plane (PSN), so the trap is assuming the Administration node processes authentication requests simply because it 'manages' ISE.

How to eliminate wrong answers

Option A is wrong because the Primary Administration Node (PAN) is the configuration and management plane — it hosts the admin UI, stores configuration, and replicates it to other nodes, but it does not process live RADIUS/TACACS+ requests in a properly designed deployment. Option C is wrong because the Monitoring Node (MnT) handles logging, reporting, and troubleshooting data (RADIUS accounting, alarms, dashboards), not authentication or authorization decisions. Option D is wrong because Policy Information Point (PIP) is a conceptual component in the policy architecture that supplies attributes to the policy decision process — it is not a deployable ISE node persona that terminates RADIUS/TACACS+ traffic.

Full explanation →

259

MCQeasy

A security designer is choosing a tool for DNS-layer security. Which Cisco product is the standard choice?

A.Cisco Secure Endpoint.

B.Cisco Umbrella.

C.Cisco ISE.

D.Cisco Secure Firewall.

AnswerB

Cisco Umbrella resolves DNS requests through its global cloud infrastructure, blocking malicious domains and IPs before a connection is established. This satisfies the DNS-layer security requirement by enforcing policy at resolution time, covering roaming users and all device types without on-premises appliances.

Why this answer

Cisco Umbrella is Cisco's cloud-delivered DNS-layer security platform, blocking malicious domains and IPs before a connection is established. It is the standard Cisco product for DNS-layer security, providing recursive DNS with threat intelligence from Cisco Talos. This makes it the correct choice for DNS-layer protection.

Exam trap

The trap is confusing DNS-layer security with endpoint or firewall security; candidates may pick Secure Endpoint or Secure Firewall because they also block malicious traffic, but Umbrella is the dedicated DNS-layer product.

How to eliminate wrong answers

Option A is wrong because Cisco Secure Endpoint is an endpoint detection and response (EDR) product, not a DNS-layer security service. Option C is wrong because Cisco ISE is an identity and access control platform (NAC, 802.1X, profiling), not DNS security. Option D is wrong because Cisco Secure Firewall is a network firewall/IPS platform; while it can inspect DNS, it is not the dedicated DNS-layer security product that Umbrella is.

Full explanation →

260

Multi-Selectmedium

Which THREE steps are required for a successful security design process?

Select 3 answers

A.Ignoring all existing network infrastructure.

B.Developing a detailed architectural plan and implementation roadmap.

C.Requirements gathering from stakeholders.

D.Purchasing the most expensive hardware available.

E.Performing a risk assessment of the current environment.

AnswersB, C, E

A detailed architectural plan and implementation roadmap translates approved security requirements into concrete designs, control placements and sequenced deployment activities. It satisfies the design process step that moves from analysis into documented, actionable build guidance, ensuring controls are integrated rather than retrofitted.

Why this answer

Option B is correct because a security design must translate requirements and risk findings into a detailed architectural plan and an implementation roadmap that sequences controls, technologies, and milestones. Option C is correct because requirements gathering from stakeholders establishes business, regulatory, and operational needs that drive the security architecture and ensure alignment with organizational objectives. Option E is correct because performing a risk assessment of the current environment identifies assets, threats, vulnerabilities, and existing controls, providing the baseline needed to prioritize security measures.

Option A is incorrect because ignoring existing network infrastructure discards critical context such as topology, legacy systems, and existing controls, which undermines any realistic design. Option D is incorrect because purchasing the most expensive hardware is not a design step and does not guarantee security; solutions should be selected based on requirements and risk, not cost alone.

Exam trap

SDSI often tests whether candidates recognize the disciplined methodology (requirements → risk → architecture/roadmap) versus distractor 'shortcut' answers like ignoring existing infrastructure or buying the most expensive gear.

Full explanation →

261

MCQmedium

A network designer needs to implement a VPN that supports both remote access and site-to-site connectivity. Which protocol is recommended for modern Cisco hardware?

A.IKEv2.

B.SSL VPN.

C.IKEv1.

D.PPTP.

AnswerA

IKEv2 supports remote-access and site-to-site VPNs on modern Cisco hardware, with built-in NAT traversal, MOBIKE for endpoint roaming, and stronger cryptographic suites than IKEv1. It satisfies the requirement for a single protocol covering both connectivity types.

Why this answer

IKEv2 is the recommended protocol for modern Cisco hardware because it supports both remote access and site-to-site VPNs, offers improved security, reliability, and mobility (e.g., MOBIKE), and is widely supported in Cisco IOS, ASA, and Firepower platforms. It is the successor to IKEv1 and is considered best practice.

Exam trap

SDSI often tests the confusion between remote access and site-to-site VPN protocols, and candidates may incorrectly choose SSL VPN for site-to-site or IKEv1 for modern hardware.

How to eliminate wrong answers

Option B is wrong because SSL VPN is primarily used for remote access and is not typically used for site-to-site connectivity; it also may not be supported on all Cisco hardware for site-to-site. Option C is wrong because IKEv1 is an older protocol with known limitations and vulnerabilities, and is not recommended for modern deployments. Option D is wrong because PPTP is an obsolete and insecure protocol with known vulnerabilities, and is not recommended for any modern VPN.

Full explanation →

262

MCQmedium

In a design for a Zero Trust architecture, what is the primary function of the Policy Decision Point (PDP)?

A.To audit session traffic

B.To provide identity management

C.To evaluate access requests based on policy

D.To enforce the policy on the endpoint

AnswerC

The PDP evaluates each access request against policy, identity, device posture and context, then returns a permit or deny decision to the Policy Enforcement Point. This satisfies the Zero Trust requirement that authorisation logic is centralised and separated from enforcement.

Why this answer

In Zero Trust architecture, the Policy Decision Point (PDP) evaluates access requests against policy, identity, device posture, and context to decide whether to grant, deny, or limit access. It is the brain that makes the authorization decision, which is then enforced by the Policy Enforcement Point (PEP).

Exam trap

The trap is confusing the PDP with the PEP or with identity management; candidates must remember the PDP decides, while the PEP enforces.

How to eliminate wrong answers

Option A is wrong because auditing session traffic is a monitoring/logging function, not the PDP's decision role. Option B is wrong because identity management (authentication, directory) is typically handled by an IdP, which feeds the PDP but is not the PDP itself. Option D is wrong because enforcing policy on the endpoint is the role of the Policy Enforcement Point (PEP), not the PDP.

Full explanation →

263

Multi-Selectmedium

When designing a secure API environment, which THREE tasks should the API Gateway handle? (Choose THREE)

Select 3 answers

A.Application data storage

B.Authentication and authorization verification

C.Routing to appropriate backend microservices

D.Request rate limiting

E.Hard-coding all business logic

AnswersB, C, D

The gateway terminates client requests and validates credentials and scopes before forwarding anything upstream, so unauthenticated or unauthorised calls never reach backend services. This satisfies the requirement that the API Gateway enforce authentication and authorization.

Why this answer

Option B is correct because the API Gateway is the central entry point for all client requests, so it should verify authentication tokens (e.g., JWT, OAuth 2.0 access tokens) and enforce authorization policies before forwarding traffic to backend services. Option C is correct because the gateway's core function is to route incoming requests to the appropriate backend microservices based on path, host, headers, or other routing rules, acting as a reverse proxy. Option D is correct because the gateway should enforce request rate limiting (e.g., token bucket or leaky bucket algorithms) to protect backend services from abuse, DoS attacks, and traffic spikes.

Option A is not correct because application data storage belongs to backend databases or storage services, not the API Gateway, which should remain stateless. Option E is not correct because hard-coding all business logic in the gateway creates a monolithic bottleneck and violates microservice separation of concerns; business logic belongs in the backend services.

Exam trap

SDSI often tests the boundary between gateway responsibilities and backend service responsibilities, tempting candidates to assign data storage or business logic to the gateway because it 'handles everything' at the edge.

Full explanation →

264

MCQmedium

What is the purpose of 'Microsegmentation' in a cloud-native architecture?

A.To reduce the attack surface by isolating workloads

B.To automatically scale services based on demand

C.To provide high availability for the service

D.To optimize container scheduling

AnswerA

Microsegmentation applies workload-level policy so each pod or VM communicates only with explicitly permitted peers, preventing lateral movement after compromise. This isolation directly shrinks the reachable attack surface, which is the stated purpose in a cloud-native architecture.

Why this answer

Microsegmentation's core security purpose is to reduce the attack surface by isolating workloads from one another, so that a compromise of one workload cannot freely reach others. It enforces least-privilege east-west traffic policies at the workload level rather than relying on perimeter firewalls. This directly limits lateral movement and blast radius within a cloud-native environment.

Exam trap

The trap is confusing microsegmentation with operational features like scaling, HA, or scheduling — candidates see 'isolation' and pick a performance/availability answer, but the exam wants the security outcome: attack surface reduction and lateral movement prevention.

How to eliminate wrong answers

Option B is wrong because auto-scaling is a compute orchestration function (handled by Kubernetes HPA, ASG, etc.) and has nothing to do with segmentation policy. Option C is wrong because high availability is achieved through redundancy, multi-AZ deployment, and health checks — microsegmentation does not provide HA. Option D is wrong because container scheduling is the job of the orchestrator (Kubernetes scheduler, ECS) and is unrelated to network segmentation policy enforcement.

Full explanation →

265

MCQeasy

Which Cisco solution is primarily designed to provide visibility and protection for SaaS applications like Office 365, Salesforce, and Slack?

A.Cisco Secure Workload

B.Cisco Cloudlock

C.Cisco Secure Firewall

D.Cisco Umbrella

AnswerB

Cisco Cloudlock is the cloud access security broker (CASB) that discovers sanctioned and unsanctioned SaaS usage, applies data-loss prevention and threat policies to Office 365, Salesforce and Slack, and reports on user activity. It directly satisfies the requirement for visibility and protection of those SaaS applications.

Why this answer

Cisco Cloudlock is a cloud access security broker (CASB) that provides visibility into and control over SaaS application usage, including Office 365, Salesforce, and Slack. It uses APIs to monitor user activity, detect data exfiltration, and enforce data loss prevention (DLP) policies specifically for cloud applications. Unlike network-based solutions, Cloudlock operates at the application layer, offering granular SaaS security without requiring traffic redirection.

Exam trap

SDSI often tests the distinction between network security solutions (firewalls, secure internet gateways) and API-based CASB solutions, causing candidates to confuse Cisco Umbrella's DNS-layer protection with Cloudlock's SaaS application visibility.

How to eliminate wrong answers

Option A is wrong because Cisco Secure Workload (formerly Tetration) is designed for data center and workload protection, focusing on micro-segmentation and process behavior monitoring for servers and virtual machines, not SaaS application visibility. Option C is wrong because Cisco Secure Firewall is a next-generation firewall that provides network perimeter security and intrusion prevention, but it lacks the API-based SaaS application visibility and DLP capabilities of a CASB. Option D is wrong because Cisco Umbrella is a secure internet gateway that provides DNS-layer security, web filtering, and cloud-delivered firewall, but it does not offer the deep SaaS application visibility and API-based control that Cloudlock provides.

Full explanation →

266

MCQmedium

When designing a secure management plane, why is it critical to use a dedicated Out-of-Band (OOB) network?

A.To reduce the cost of cabling.

B.To prevent management plane saturation during a data plane DoS attack.

C.To increase the throughput of user traffic.

D.To allow for DHCP-based addressing of management interfaces.

AnswerB

A dedicated out-of-band network carries management traffic on separate paths from production data, so a data plane DoS flood cannot saturate the links or devices administrators rely on to reach and remediate the management plane.

Why this answer

A dedicated Out-of-Band (OOB) management network physically or logically separates management traffic from production data traffic. When a data plane DoS attack saturates the production links, in-band management would become unreachable, preventing administrators from responding. OOB preserves management access so remediation can occur even under active attack.

Exam trap

SDSI often tests the misconception that in-band management with ACLs is sufficient, confusing logical separation with true out-of-band isolation during a data plane attack.

How to eliminate wrong answers

Option A is wrong because cabling cost reduction is an operational side effect, not a security rationale — OOB actually adds cabling and hardware. Option C is wrong because OOB does not carry user traffic at all, so it cannot increase throughput. Option D is wrong because DHCP-based addressing is unrelated to the security purpose of OOB; management interfaces are typically statically addressed for reliability.

Full explanation →

267

Multi-Selectmedium

Which TWO factors must be considered when designing SaaS security using Cisco Cloudlock to ensure compliance with data protection regulations? (Choose TWO)

Select 2 answers

A.Configuring BGP peering with the SaaS provider

B.Establishing remediation workflows for policy violations

C.Defining appropriate data classification and DLP policies

D.Enabling hardware-based encryption for the SaaS vendor

E.Installing agents on all end-user laptops

AnswersB, C

Remediation workflows satisfy the enforcement requirement: Cloudlock detects violations via its DLP and UEBA engines, then triggers automated actions such as quarantine, revoke sharing, or notify owners. This closes the compliance loop, evidencing that detected breaches of data protection policy are actively corrected rather than merely logged.

Why this answer

Option B is correct because Cisco Cloudlock's value in a SaaS compliance program depends on operationalizing its policy engine: when Cloudlock detects a violation (for example, a DLP match or a risky third-party app), remediation workflows such as automated quarantine, revoke sharing, notify user, or alert admin are what actually enforce the regulation and produce an auditable response trail. Option C is correct because Cloudlock's DLP and data classification policies are the foundation of the entire control: you must define which data types are regulated (for example, PII, PCI, PHI) and how they are classified so Cloudlock's API-based scanning of SaaS platforms like Microsoft 365, Google Workspace, and Salesforce can detect and act on them. Option A is not relevant because BGP peering is an internet routing concern for network connectivity, not a SaaS data-protection control, and Cloudlock operates via APIs rather than routing.

Option D is not relevant because hardware-based encryption is a vendor infrastructure matter, not something the Cloudlock customer designs or configures for compliance. Option E is not relevant because Cloudlock is an API-based, agentless CASB that monitors sanctioned SaaS usage from the cloud, so endpoint agents are not required.

Exam trap

The trap is selecting network-centric options (BGP, hardware encryption, endpoint agents) for a SaaS security question; candidates must remember that CASB solutions like Cloudlock are API-based and focus on data classification, DLP, and remediation.

Full explanation →

268

MCQhard

You are designing a security architecture for a large e-commerce platform that uses a microservices architecture deployed on Cisco Container Platform (CCP). The security team wants to detect and prevent attacks that exploit vulnerabilities in the application code, such as SQL injection and cross-site scripting, without modifying the application code. Which Cisco solution should you design to meet this requirement?

A.Cisco AppDynamics with Security Guard and runtime application self-protection (RASP).

B.Cisco Secure Workload with deep packet inspection and signature-based detection.

C.Cisco Tetration with application dependency mapping and policy enforcement.

D.Cisco Cloudlock with API-based scanning of container images for vulnerabilities.

AnswerA

Cisco AppDynamics with Security Guard provides runtime application self-protection (RASP) that instruments the application at runtime to detect and block attacks like SQL injection and XSS without code changes. It integrates with the application server or runtime environment, analyzing application behavior and user input to prevent exploits in real time, making it suitable for microservices on CCP.

Why this answer

Cisco AppDynamics with Security Guard is designed to provide runtime application self-protection (RASP), which instruments the application runtime to detect and block application-layer attacks such as SQL injection and cross-site scripting. This approach does not require modifying application code and is effective for microservices deployed on Cisco Container Platform, meeting the security team's requirement.

Exam trap

The trap here is confusing microsegmentation or CASB solutions with runtime application self-protection, which is specifically needed for code-level attack prevention.

Full explanation →

269

MCQmedium

When designing an automated security policy deployment for Cisco Secure Workload (formerly Tetration), which mechanism allows you to test policies in a simulation environment before applying them to production?

A.Policy Analysis mode

B.Agentless vulnerability scanning

C.Workload isolation testing

D.Inventory change management

E.Live enforcement mode

AnswerA

Policy Analysis mode simulates proposed policies against historical flow data, showing which traffic would be permitted or denied without enforcing changes. This satisfies the requirement to test policies in a simulation environment before production deployment, avoiding accidental workload disruption.

Why this answer

Policy Analysis mode in Cisco Secure Workload allows you to simulate the effect of a policy against historical flow data without enforcing it, showing which flows would be allowed or denied. This lets you validate policy changes in a safe, non-disruptive way before moving to enforcement. It is the designated simulation mechanism for policy testing.

Exam trap

SDSI often tests the misconception that live enforcement or vulnerability scanning can be used for safe policy testing; the correct answer is Policy Analysis mode, which simulates against historical flows.

How to eliminate wrong answers

Option B is wrong because agentless vulnerability scanning discovers vulnerabilities but does not simulate policy enforcement. Option C is wrong because workload isolation testing is not a Secure Workload feature for policy simulation; isolation is an enforcement action. Option D is wrong because inventory change management tracks workload changes but does not test policy behavior.

Option E is wrong because live enforcement mode applies policies in production, which is the opposite of simulation and can disrupt traffic if misconfigured.

Full explanation →

270

Multi-Selecthard

Which TWO methods are used by Cisco Stealthwatch to detect anomalies in network traffic?

Select 2 answers

A.Signature-based matching for every packet.

B.Deep packet inspection of every payload byte.

C.Behavioral baseline modeling of host and network patterns.

D.Analysis of NetFlow, IPFIX, and other flow telemetry.

E.Manual input of all known malicious IP addresses.

AnswersC, D

Stealthwatch builds behavioural baselines of normal host and network activity, then flags deviations such as unusual data volumes, new peer connections or off-hours transfers. This detects anomalies without relying on static signatures, catching threats that match no known pattern.

Why this answer

Cisco Stealthwatch detects anomalies primarily through behavioral baseline modeling (option C), which learns normal host and network communication patterns over time and then flags deviations such as unusual traffic volumes, new peer connections, or atypical protocol usage. It also relies on analysis of NetFlow, IPFIX, and other flow telemetry (option D), since flow records exported by routers and switches provide the scalable metadata Stealthwatch uses for visibility and threat detection. These two methods work together: flow telemetry supplies the data, and behavioral baselining turns it into anomaly alerts.

Signature-based matching for every packet (A) and deep packet inspection of every payload byte (B) describe intrusion prevention or full-packet inspection approaches, not Stealthwatch's flow-based analytics. Manual input of all known malicious IP addresses (E) is not a detection method, as Stealthwatch does not depend on manually enumerating every bad IP.

Exam trap

The trap is conflating Stealthwatch with a signature-based IPS or DPI tool — candidates pick 'signature matching' or 'deep packet inspection' because those sound like security detection, but Stealthwatch's power is behavioral analytics on flow data.

Full explanation →

271

MCQmedium

A design requirements document specifies a need for 'Network Segmentation' to contain breaches. Which Cisco technology provides the best granular control using Scalable Group Tags (SGTs)?

A.Cisco TrustSec (SGTs).

B.Cisco Secure Firewall interface zones.

C.VLAN-based segmentation.

D.Cisco Umbrella local policy.

AnswerA

Cisco TrustSec assigns Scalable Group Tags to endpoints and enforces group-based policy in the data plane, delivering micro-segmentation with far finer granularity than VLAN or subnet-based controls. This directly satisfies the segmentation requirement for breach containment.

Why this answer

Cisco TrustSec with Scalable Group Tags (SGTs) provides the best granular control for network segmentation by enabling identity-based micro-segmentation. SGTs allow policies to be enforced based on group membership rather than IP addresses, which is more scalable and dynamic, effectively containing breaches by limiting lateral movement.

Exam trap

The trap is choosing VLANs or firewall zones for segmentation; candidates may think these provide sufficient control, but the question specifically asks for SGT-based granular control, which only TrustSec delivers.

How to eliminate wrong answers

Option B is wrong because Cisco Secure Firewall interface zones provide segmentation based on physical or logical interfaces, which is less granular and does not offer identity-based tagging. Option C is wrong because VLAN-based segmentation is limited to Layer 2 and does not provide the granular, identity-based control of SGTs; it also requires manual configuration and is not scalable. Option D is wrong because Cisco Umbrella local policy is for DNS-layer security and does not provide network segmentation or SGT-based control.

Full explanation →

272

MCQhard

A security architect is designing a risk mitigation strategy for a network that must comply with PCI DSS. The design must ensure that all cardholder data environment (CDE) traffic is segmented from the corporate network and that any violation of segmentation policy triggers an immediate alert. Which Cisco solution should be used to achieve both micro-segmentation and policy violation alerting?

A.Cisco Secure Firewall with access control policies

B.Cisco Identity Services Engine (ISE) with TrustSec

C.Cisco Nexus Dashboard with network segmentation

D.Cisco Secure Workload

AnswerD

Cisco Secure Workload (formerly Tetration) provides micro-segmentation based on workload identity and enforces policies across data center and cloud environments. It can detect and alert on policy violations in real time, meeting the requirement for immediate alerting when segmentation is breached. This solution is designed for zero-trust segmentation and compliance enforcement.

Why this answer

The requirement is for micro-segmentation of the CDE with immediate alerting on policy violations. Cisco Secure Workload provides agent-based or agentless micro-segmentation that maps workload dependencies and enforces granular policies. It continuously monitors for violations and can generate alerts, ensuring PCI DSS compliance and rapid response to segmentation breaches.

Exam trap

The trap here is confusing network segmentation tools like TrustSec with workload-level micro-segmentation that includes real-time violation alerting.

Full explanation →

273

MCQmedium

Your organization uses a hybrid cloud model. You are tasked with designing a security posture for workloads in AWS and Azure using Cisco Secure Workload. What is the benefit of the 'Anywhere' agent approach?

A.It provides consistent security policy enforcement across heterogenous environments

B.It automatically patches the underlying operating system

C.It replaces the need for a central management platform

D.It eliminates the need for any firewall rules in the cloud

AnswerA

The Anywhere agent installs directly on workloads in AWS, Azure and on-premises, applying identical policy regardless of host platform. This satisfies the hybrid cloud constraint by removing dependence on native cloud constructs that differ between providers.

Why this answer

The 'Anywhere' agent approach in Cisco Secure Workload provides consistent security policy enforcement across heterogeneous environments, including on-premises, AWS, Azure, and other clouds. It allows you to define policies once and apply them uniformly, regardless of where the workload runs, ensuring a unified security posture.

Exam trap

SDSI often tests the scope of agent capabilities; candidates may confuse the agent with a patching tool or think it replaces firewalls, but its primary benefit is consistent policy enforcement across diverse environments.

How to eliminate wrong answers

Option B is wrong because the agent does not patch the operating system; it focuses on security policy enforcement and visibility. Option C is wrong because the agent does not replace the central management platform; it works in conjunction with it to enforce policies. Option D is wrong because the agent does not eliminate the need for firewall rules; it complements them by providing workload-level microsegmentation.

Full explanation →

274

MCQmedium

A software company is designing a DevSecOps pipeline that uses Cisco Umbrella to protect developers from malicious domains during automated builds. The pipeline must automatically update Umbrella blocklists based on threat intelligence feeds from Cisco Talos. Which design component is required to achieve this automation?

A.Cisco Umbrella Reporting API with a webhook to trigger blocklist updates.

B.Cisco Umbrella Policies API with manual approval workflow for blocklist changes.

C.Cisco Umbrella Enforcement API with a CI/CD job that pushes Talos threat indicators to Umbrella.

D.Cisco Umbrella Investigate API with a scheduled script to pull Talos feeds and update blocklists.

AnswerC

The Umbrella Enforcement API allows programmatic addition of domains to the Umbrella blocklist. By integrating a CI/CD job that retrieves threat indicators from Cisco Talos feeds and pushes them to Umbrella via this API, the pipeline can automatically update blocklists. This design provides a direct, supported method for dynamic enforcement based on the latest threat intelligence.

Why this answer

The requirement is to automatically update Umbrella blocklists based on Talos threat intelligence. The Umbrella Enforcement API is specifically designed to programmatically add domains to the blocklist. By integrating this API into a CI/CD job that pulls Talos feeds, the pipeline can dynamically enforce the latest threat intelligence without manual intervention, ensuring developers are protected from emerging threats.

Exam trap

The trap here is confusing the Investigate API, which is for threat research, with the Enforcement API, which is for taking action on threats.

Full explanation →

275

Multi-Selecthard

You are designing a secure API gateway architecture for a financial institution using Cisco API Security. The design must protect against OWASP API Security Top 10 threats, specifically Broken Object Level Authorization (BOLA) and Excessive Data Exposure. Which TWO design controls should you implement to mitigate these threats? (Choose two.)

Select 2 answers

A.Enable mutual TLS (mTLS) between the API client and the API gateway to ensure strong authentication.

B.Implement response filtering to remove sensitive data fields from API responses based on the user's role and the principle of least privilege.

C.Enforce object-level authorization checks at the API gateway by validating the user's permissions for each requested resource.

D.Deploy a web application firewall (WAF) in front of the API gateway to block SQL injection and cross-site scripting attacks.

E.Use rate limiting to restrict the number of API requests per user per minute.

AnswersB, C

Excessive Data Exposure happens when APIs return more data than necessary, exposing sensitive information. Response filtering at the API gateway can strip out fields that the user is not authorized to see, based on their role. This enforces the principle of least privilege and reduces the risk of data leakage, directly addressing Excessive Data Exposure.

Why this answer

Broken Object Level Authorization is mitigated by enforcing object-level authorization checks at the API gateway, ensuring users can only access resources they are permitted to. Excessive Data Exposure is mitigated by response filtering, which removes sensitive fields based on user role and least privilege. Together, these controls address the two specific OWASP API Security Top 10 threats mentioned.

Exam trap

The trap here is assuming that authentication mechanisms like mTLS or generic WAF rules can prevent authorization flaws and data exposure, which require specific authorization and response filtering controls.

Full explanation →

276

MCQmedium

To protect a SaaS application accessed by remote users, which Cisco solution provides a unified cloud-native security stack including DNS-layer security and SWG?

A.Cisco Duo

B.Cisco Firepower Threat Defense

C.Cisco Secure Endpoint

D.Cisco Umbrella

AnswerD

Cisco Umbrella is a cloud-native security service edge platform delivering DNS-layer security, secure web gateway, cloud access security broker and firewall capabilities from one unified stack, protecting roaming users regardless of location without appliance deployment.

Why this answer

Cisco Umbrella is the cloud-native Secure Internet Gateway (SIG) that combines DNS-layer security, Secure Web Gateway (SWG), cloud-delivered firewall, and CASB into a single unified stack delivered from the cloud. It is specifically designed to protect users accessing SaaS and internet resources from any location without backhauling traffic to a data center. The other options are point products that do not deliver this unified cloud-native DNS+SWG capability.

Exam trap

SDSI often tests whether candidates can distinguish cloud-native security service edge (SSE) platforms like Umbrella from on-premises appliances or identity-only tools, so the trap is picking a familiar product name (Duo, Firepower, Secure Endpoint) that does not actually provide DNS-layer security plus SWG.

How to eliminate wrong answers

Option A is wrong because Cisco Duo is a Zero Trust access and MFA platform focused on identity verification and device trust, not a DNS-layer or web gateway security stack. Option B is wrong because Cisco Firepower Threat Defense is an on-premises or virtual NGFW/IPS appliance, not a cloud-native unified stack with DNS-layer security and SWG. Option C is wrong because Cisco Secure Endpoint is an endpoint detection and response (EDR) agent that protects hosts, not network or web traffic for SaaS access.

Full explanation →

277

MCQeasy

What is the primary role of Cisco SecureX in a SOC architecture?

A.To provide local firewall policy management.

B.To provide a centralized platform for visibility and orchestration.

C.To act as a secondary backup firewall.

D.To replace all other security tools.

AnswerB

SecureX aggregates telemetry from Cisco and third-party controls into one console, then drives automated workflows such as threat response playbooks. This centralised visibility plus orchestration is precisely the SOC role the stem asks for, replacing fragmented per-product consoles.

Why this answer

Cisco SecureX is a cloud-native platform that provides a centralized view of security across multiple products and orchestrates workflows. Its primary role in a SOC is to integrate disparate security tools, automate responses, and provide unified visibility, thereby improving efficiency and threat response. It does not replace other tools but enhances them.

Exam trap

Candidates may think SecureX is a firewall management tool or a replacement for other security products, but it is an integration and orchestration platform.

How to eliminate wrong answers

Option A is wrong because local firewall policy management is done through FMC or FTD, not SecureX. Option C is wrong because SecureX is not a firewall or backup device; it is a platform for integration and orchestration. Option D is wrong because SecureX does not replace other security tools; it integrates with them to provide a unified view.

Full explanation →

278

MCQmedium

When assessing risk for a remote office branch, the architect decides to use Cisco Umbrella. Which requirement is addressed by implementing the Umbrella roaming client for branch endpoints?

A.Providing deep packet inspection for local branch-to-branch file transfers.

B.Managing local firewall rules on the branch router.

C.Providing local site-to-site VPN encryption for branch traffic.

D.Enforcing security policies on endpoints even when they are off the corporate network.

AnswerD

The Umbrella roaming client intercepts DNS and IP requests directly on the endpoint, applying policy regardless of whether the device sits behind the branch firewall. This satisfies the off-network requirement, where traditional perimeter enforcement no longer covers roaming branch users.

Why this answer

The Umbrella roaming client is lightweight software installed on endpoints (laptops, desktops) that redirects DNS queries to Cisco Umbrella's global network regardless of where the endpoint is — on-premises, at home, or on public Wi-Fi. This ensures DNS-layer security policy enforcement (blocking malicious domains, C2 callbacks, phishing) follows the user off the corporate network, which is the core value proposition of the roaming client. It does not perform DPI, manage router firewalls, or encrypt site-to-site VPN traffic.

Exam trap

SDSI often tests whether candidates confuse Umbrella's DNS-layer roaming client with full NGFW/IPS capabilities — the trap is picking an answer that describes deep packet inspection or VPN encryption, which Umbrella does not provide.

How to eliminate wrong answers

Option A is wrong because deep packet inspection of branch-to-branch file transfers is a function of an NGFW/IPS (e.g., Firepower), not Umbrella's DNS-layer roaming client, which only inspects DNS requests and does not see payload contents. Option B is wrong because the roaming client runs on endpoints and has no capability to manage or modify firewall rules on a branch router — that would require router CLI/management access. Option C is wrong because site-to-site VPN encryption is handled by routers, firewalls, or SD-WAN appliances (IPsec/DMVPN), not by an endpoint DNS security agent.

Full explanation →

279

MCQhard

A manufacturing firm wants to secure IoT devices using Cisco TrustSec. Which mechanism ensures that traffic from IoT sensors is isolated from corporate traffic without relying on complex VLAN/ACL management?

A.Dynamic ARP Inspection

B.Scalable Group Tags (SGTs)

C.Private VLANs (PVLANs)

D.VLAN Trunking Protocol

AnswerB

SGTs are carried in the Cisco Metadata header, so the network enforces group-based policy without redesigning VLANs or maintaining sprawling ACLs. IoT sensors receive a tag, and Security Group ACLs on enforcement devices isolate their traffic from corporate groups, satisfying the stem's requirement to avoid complex VLAN/ACL management.

Why this answer

Cisco TrustSec uses Scalable Group Tags (SGTs) embedded in the packet (via Cisco Metadata or inline tagging) to enforce group-based policy. IoT sensors are assigned an SGT, and a Security Group ACL (SGACL) on the enforcement device permits or denies traffic based on source/destination tag pairs — no VLANs or IP-based ACLs required. This scales cleanly because policy follows the tag, not the topology.

Exam trap

SDSI often tests whether candidates default to familiar Layer 2 isolation tools (PVLANs, DAI) when the question explicitly asks for a scalable, tag-based mechanism that avoids VLAN/ACL management — the answer is TrustSec SGTs.

How to eliminate wrong answers

Option A is wrong because Dynamic ARP Inspection is a Layer 2 security feature that validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing; it does not provide group-based traffic isolation. Option C is wrong because Private VLANs provide Layer 2 isolation within a single VLAN using promiscuous/isolated/community ports, but they require VLAN-level configuration and do not scale across routed domains or provide tag-based policy. Option D is wrong because VLAN Trunking Protocol propagates VLAN database information between switches; it is a management protocol, not a segmentation or policy mechanism.

Full explanation →

280

MCQhard

You are designing security for a multi-cloud environment. Which feature in Cisco Secure Firewall allows for automated policy deployment based on cloud tags?

A.Static IP-based Access Control Lists.

B.VLAN tagging.

C.Dynamic Object Groups.

D.Network Interface Virtualization.

AnswerC

Dynamic Object Groups let firewall policies reference cloud tags, so group membership updates automatically as tagged resources are added or removed across providers. This satisfies the multi-cloud requirement for automated policy deployment without manually editing rules when cloud workloads change.

Why this answer

Dynamic Object Groups in Cisco Secure Firewall (formerly Firepower) let policies reference cloud resource tags (AWS tags, Azure tags, GCP labels) instead of static IPs. As cloud instances are created, terminated, or re-tagged, the firewall automatically updates group membership and enforces policy accordingly, enabling automated policy deployment in multi-cloud environments. This is the mechanism designed specifically for tag-driven, dynamic policy.

Exam trap

SDSI often tests whether candidates confuse Layer 2 segmentation constructs (VLANs, PVLANs) with cloud-tag-driven dynamic policy, catching those who pick a familiar networking term over the correct automation feature.

How to eliminate wrong answers

Option A is wrong because static IP-based ACLs require manual updates whenever cloud instances change IPs — the opposite of automated, tag-driven policy, and unmanageable in elastic cloud environments. Option B is wrong because VLAN tagging is a Layer 2 segmentation mechanism within a network, not a cloud-tag-driven policy automation feature, and cloud providers abstract VLANs differently. Option D is wrong because Network Interface Virtualization is not a Cisco Secure Firewall feature for tag-based policy; it is a generic concept and does not provide automated policy deployment based on cloud tags.

Full explanation →

281

Multi-Selecthard

Which THREE of the following are considered 'Threat Response' automation actions in a Cisco XDR environment?

Select 3 answers

A.Sending a company-wide email

B.Blocking a malicious file hash

C.Rebooting the server hardware

D.Blocking a malicious URL

E.Isolating an infected host

AnswersB, D, E

Blocking a malicious file hash is an enforcement action that pushes the indicator to endpoint or network controls, preventing execution or download. It satisfies the Threat Response criterion because it directly neutralises the threat rather than merely observing or enriching it.

Why this answer

In Cisco XDR, Threat Response automation actions are the enforcement steps that directly neutralize an identified indicator or compromised asset. Option B, blocking a malicious file hash, is correct because it pushes a hash-based block (e.g., via Cisco Secure Endpoint or Umbrella) so the known-bad file cannot execute or be downloaded again. Option D, blocking a malicious URL, is correct because it enforces a URL/domain block through Secure Internet Gateway or Umbrella DNS/web policies, preventing users from reaching the attacker's infrastructure.

Option E, isolating an infected host, is correct because network isolation via Secure Endpoint cuts the endpoint off from the network while keeping the agent connected for investigation and remediation. Option A, sending a company-wide email, is merely a notification/communication step and not an enforcement action, and Option C, rebooting the server hardware, is a disruptive administrative operation that does not itself contain or remediate the threat.

Exam trap

SDSI often tests whether candidates mistake generic IT or communications actions (emails, reboots) for security response actions — the exam wants containment/remediation verbs, not notification or maintenance tasks.

Full explanation →

282

MCQmedium

Which protocol is used for the control plane communication between Cisco SD-WAN controllers?

A.EIGRP.

B.BGP.

C.OSPF.

D.OMP.

AnswerD

OMP (Overlay Management Protocol) runs the SD-WAN control plane, carrying route, policy, TLOC and key-exchange information between vSmart controllers and vEdge/cEdge devices over DTLS/TLS. It is the sole protocol providing this controller-to-device control plane communication.

Why this answer

Cisco SD-WAN uses the Overlay Management Protocol (OMP) for control plane communication between SD-WAN controllers (vManage, vBond, vSmart) and between controllers and WAN edge devices. OMP carries routing information, policy, and TLOC (transport locator) attributes, forming the overlay control plane that enables SD-WAN's dynamic path selection.

Exam trap

SDSI often tests the confusion between underlay routing protocols (BGP, OSPF, EIGRP) and the SD-WAN overlay control plane protocol, which is OMP.

How to eliminate wrong answers

Option A is wrong because EIGRP is a traditional interior gateway protocol used for underlay routing, not for SD-WAN overlay control plane communication. Option B is wrong because BGP is used for underlay routing and for some SD-WAN route exchange with external networks, but it is not the native control plane protocol between SD-WAN controllers. Option C is wrong because OSPF is another traditional IGP for underlay routing, not the SD-WAN overlay control plane protocol.

Full explanation →

283

Multi-Selectmedium

Which TWO methods are effective for securing email infrastructure against phishing?

Select 2 answers

A.Using only local SMTP relays.

B.DMARC/SPF/DKIM implementation.

C.Disabling all attachments in emails.

D.Cisco Secure Email sandboxing.

E.Allowing all inbound mail traffic.

AnswersB, D

SPF authorises sending hosts, DKIM cryptographically signs messages, and DMARC ties both to the visible From domain with a policy. Together they let receivers reject or quarantine spoofed mail, directly countering phishing that forges your domain.

Why this answer

Option B is correct because implementing SPF, DKIM, and DMARC together authenticates the sending domain: SPF authorizes sending IPs via DNS TXT records, DKIM cryptographically signs messages with a public key published in DNS, and DMARC tells receivers how to handle messages that fail SPF/DKIM alignment, which directly blocks spoofed sender addresses used in phishing. Option D is correct because Cisco Secure Email sandboxing detonates suspicious attachments and URLs in an isolated environment to detect zero-day malware and credential-harvesting links that signature-based filters miss, adding a behavioral layer of phishing defense. Option A is wrong because using only local SMTP relays does not authenticate senders or filter malicious content and can even worsen spoofing exposure.

Option C is wrong because disabling all attachments is overly broad, breaks legitimate business mail, and does not stop phishing links or social-engineering text. Option E is wrong because allowing all inbound mail traffic removes any filtering or policy enforcement, directly enabling phishing delivery.

Exam trap

SDSI often tests the misconception that extreme measures like disabling all attachments are effective, when in fact authentication protocols and sandboxing are the correct layered approach.

Full explanation →

284

MCQmedium

A security architect is designing a Cisco Secure Firewall deployment for a multi-cloud environment. Which design strategy ensures consistent security policy enforcement across AWS and Azure instances?

A.Utilize a centralized FMC to manage virtual Secure Firewalls across all cloud environments.

B.Deploy separate FMC instances in each cloud provider for localized management.

C.Use individual Firewall Device Managers (FDM) for every instance.

D.Implement cloud-native security groups exclusively to bypass firewall bottlenecks.

AnswerA

A centralised FMC manages virtual Secure Firewalls in both AWS and Azure, pushing one unified policy set to every instance. This directly satisfies the stem's requirement for consistent enforcement across clouds, since policy is authored once and deployed identically, rather than configured separately per cloud platform.

Why this answer

A centralized FMC (Firepower Management Center) provides a single pane of glass for policy creation, deployment, and monitoring across all virtual Secure Firewall instances regardless of whether they run in AWS, Azure, or on-premises. This ensures that the same access control, IPS, and URL filtering policies are consistently enforced, eliminating policy drift between clouds. FMC supports multi-domain and hierarchical policy inheritance, which is essential for multi-cloud consistency.

Exam trap

SDSI often tests the misconception that each cloud requires its own management plane; candidates pick separate FMCs thinking it provides redundancy, but the exam expects centralized FMC for consistent policy.

How to eliminate wrong answers

Option B is wrong because separate FMC instances per cloud create policy silos, requiring duplicate configuration and preventing consistent enforcement across environments. Option C is wrong because FDM is a per-device, single-instance manager with no centralized orchestration, making consistent multi-cloud policy impossible at scale. Option D is wrong because cloud-native security groups are stateless/stateful L3-L4 filters that lack Cisco's L7 inspection, IPS, and unified policy model, and they do not replace firewall policy enforcement.

Full explanation →

Cisco Designing Cisco Security Infrastructure (SDSI, 300-745, CCNP Security, design-focused) (SDSI) (SDSI) — Questions 226–284