CCNA Secure Infrastructure Design Questions — Page 2 of 2

MCQmedium

In a design for a Zero Trust architecture, what is the primary function of the Policy Decision Point (PDP)?

A.To audit session traffic

B.To provide identity management

C.To evaluate access requests based on policy

D.To enforce the policy on the endpoint

AnswerC

The PDP evaluates each access request against policy, identity, device posture and context, then returns a permit or deny decision to the Policy Enforcement Point. This satisfies the Zero Trust requirement that authorisation logic is centralised and separated from enforcement.

Why this answer

In Zero Trust architecture, the Policy Decision Point (PDP) evaluates access requests against policy, identity, device posture, and context to decide whether to grant, deny, or limit access. It is the brain that makes the authorization decision, which is then enforced by the Policy Enforcement Point (PEP).

Exam trap

The trap is confusing the PDP with the PEP or with identity management; candidates must remember the PDP decides, while the PEP enforces.

How to eliminate wrong answers

Option A is wrong because auditing session traffic is a monitoring/logging function, not the PDP's decision role. Option B is wrong because identity management (authentication, directory) is typically handled by an IdP, which feeds the PDP but is not the PDP itself. Option D is wrong because enforcing policy on the endpoint is the role of the Policy Enforcement Point (PEP), not the PDP.

Practice this question →

MCQmedium

When designing a secure management plane, why is it critical to use a dedicated Out-of-Band (OOB) network?

A.To reduce the cost of cabling.

B.To prevent management plane saturation during a data plane DoS attack.

C.To increase the throughput of user traffic.

D.To allow for DHCP-based addressing of management interfaces.

AnswerB

A dedicated out-of-band network carries management traffic on separate paths from production data, so a data plane DoS flood cannot saturate the links or devices administrators rely on to reach and remediate the management plane.

Why this answer

A dedicated Out-of-Band (OOB) management network physically or logically separates management traffic from production data traffic. When a data plane DoS attack saturates the production links, in-band management would become unreachable, preventing administrators from responding. OOB preserves management access so remediation can occur even under active attack.

Exam trap

SDSI often tests the misconception that in-band management with ACLs is sufficient, confusing logical separation with true out-of-band isolation during a data plane attack.

How to eliminate wrong answers

Option A is wrong because cabling cost reduction is an operational side effect, not a security rationale — OOB actually adds cabling and hardware. Option C is wrong because OOB does not carry user traffic at all, so it cannot increase throughput. Option D is wrong because DHCP-based addressing is unrelated to the security purpose of OOB; management interfaces are typically statically addressed for reliability.

Practice this question →

MCQmedium

To protect a SaaS application accessed by remote users, which Cisco solution provides a unified cloud-native security stack including DNS-layer security and SWG?

A.Cisco Duo

B.Cisco Firepower Threat Defense

C.Cisco Secure Endpoint

D.Cisco Umbrella

AnswerD

Cisco Umbrella is a cloud-native security service edge platform delivering DNS-layer security, secure web gateway, cloud access security broker and firewall capabilities from one unified stack, protecting roaming users regardless of location without appliance deployment.

Why this answer

Cisco Umbrella is the cloud-native Secure Internet Gateway (SIG) that combines DNS-layer security, Secure Web Gateway (SWG), cloud-delivered firewall, and CASB into a single unified stack delivered from the cloud. It is specifically designed to protect users accessing SaaS and internet resources from any location without backhauling traffic to a data center. The other options are point products that do not deliver this unified cloud-native DNS+SWG capability.

Exam trap

SDSI often tests whether candidates can distinguish cloud-native security service edge (SSE) platforms like Umbrella from on-premises appliances or identity-only tools, so the trap is picking a familiar product name (Duo, Firepower, Secure Endpoint) that does not actually provide DNS-layer security plus SWG.

How to eliminate wrong answers

Option A is wrong because Cisco Duo is a Zero Trust access and MFA platform focused on identity verification and device trust, not a DNS-layer or web gateway security stack. Option B is wrong because Cisco Firepower Threat Defense is an on-premises or virtual NGFW/IPS appliance, not a cloud-native unified stack with DNS-layer security and SWG. Option C is wrong because Cisco Secure Endpoint is an endpoint detection and response (EDR) agent that protects hosts, not network or web traffic for SaaS access.

Practice this question →

MCQhard

A manufacturing firm wants to secure IoT devices using Cisco TrustSec. Which mechanism ensures that traffic from IoT sensors is isolated from corporate traffic without relying on complex VLAN/ACL management?

A.Dynamic ARP Inspection

B.Scalable Group Tags (SGTs)

C.Private VLANs (PVLANs)

D.VLAN Trunking Protocol

AnswerB

SGTs are carried in the Cisco Metadata header, so the network enforces group-based policy without redesigning VLANs or maintaining sprawling ACLs. IoT sensors receive a tag, and Security Group ACLs on enforcement devices isolate their traffic from corporate groups, satisfying the stem's requirement to avoid complex VLAN/ACL management.

Why this answer

Cisco TrustSec uses Scalable Group Tags (SGTs) embedded in the packet (via Cisco Metadata or inline tagging) to enforce group-based policy. IoT sensors are assigned an SGT, and a Security Group ACL (SGACL) on the enforcement device permits or denies traffic based on source/destination tag pairs — no VLANs or IP-based ACLs required. This scales cleanly because policy follows the tag, not the topology.

Exam trap

SDSI often tests whether candidates default to familiar Layer 2 isolation tools (PVLANs, DAI) when the question explicitly asks for a scalable, tag-based mechanism that avoids VLAN/ACL management — the answer is TrustSec SGTs.

How to eliminate wrong answers

Option A is wrong because Dynamic ARP Inspection is a Layer 2 security feature that validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing; it does not provide group-based traffic isolation. Option C is wrong because Private VLANs provide Layer 2 isolation within a single VLAN using promiscuous/isolated/community ports, but they require VLAN-level configuration and do not scale across routed domains or provide tag-based policy. Option D is wrong because VLAN Trunking Protocol propagates VLAN database information between switches; it is a management protocol, not a segmentation or policy mechanism.

Practice this question →

MCQhard

You are designing security for a multi-cloud environment. Which feature in Cisco Secure Firewall allows for automated policy deployment based on cloud tags?

A.Static IP-based Access Control Lists.

B.VLAN tagging.

C.Dynamic Object Groups.

D.Network Interface Virtualization.

AnswerC

Dynamic Object Groups let firewall policies reference cloud tags, so group membership updates automatically as tagged resources are added or removed across providers. This satisfies the multi-cloud requirement for automated policy deployment without manually editing rules when cloud workloads change.

Why this answer

Dynamic Object Groups in Cisco Secure Firewall (formerly Firepower) let policies reference cloud resource tags (AWS tags, Azure tags, GCP labels) instead of static IPs. As cloud instances are created, terminated, or re-tagged, the firewall automatically updates group membership and enforces policy accordingly, enabling automated policy deployment in multi-cloud environments. This is the mechanism designed specifically for tag-driven, dynamic policy.

Exam trap

SDSI often tests whether candidates confuse Layer 2 segmentation constructs (VLANs, PVLANs) with cloud-tag-driven dynamic policy, catching those who pick a familiar networking term over the correct automation feature.

How to eliminate wrong answers

Option A is wrong because static IP-based ACLs require manual updates whenever cloud instances change IPs — the opposite of automated, tag-driven policy, and unmanageable in elastic cloud environments. Option B is wrong because VLAN tagging is a Layer 2 segmentation mechanism within a network, not a cloud-tag-driven policy automation feature, and cloud providers abstract VLANs differently. Option D is wrong because Network Interface Virtualization is not a Cisco Secure Firewall feature for tag-based policy; it is a generic concept and does not provide automated policy deployment based on cloud tags.

Practice this question →

MCQmedium

Which protocol is used for the control plane communication between Cisco SD-WAN controllers?

A.EIGRP.

B.BGP.

C.OSPF.

D.OMP.

AnswerD

OMP (Overlay Management Protocol) runs the SD-WAN control plane, carrying route, policy, TLOC and key-exchange information between vSmart controllers and vEdge/cEdge devices over DTLS/TLS. It is the sole protocol providing this controller-to-device control plane communication.

Why this answer

Cisco SD-WAN uses the Overlay Management Protocol (OMP) for control plane communication between SD-WAN controllers (vManage, vBond, vSmart) and between controllers and WAN edge devices. OMP carries routing information, policy, and TLOC (transport locator) attributes, forming the overlay control plane that enables SD-WAN's dynamic path selection.

Exam trap

SDSI often tests the confusion between underlay routing protocols (BGP, OSPF, EIGRP) and the SD-WAN overlay control plane protocol, which is OMP.

How to eliminate wrong answers

Option A is wrong because EIGRP is a traditional interior gateway protocol used for underlay routing, not for SD-WAN overlay control plane communication. Option B is wrong because BGP is used for underlay routing and for some SD-WAN route exchange with external networks, but it is not the native control plane protocol between SD-WAN controllers. Option C is wrong because OSPF is another traditional IGP for underlay routing, not the SD-WAN overlay control plane protocol.

Practice this question →

Multi-Selectmedium

Which TWO methods are effective for securing email infrastructure against phishing?

Select 2 answers

A.Using only local SMTP relays.

B.DMARC/SPF/DKIM implementation.

C.Disabling all attachments in emails.

D.Cisco Secure Email sandboxing.

E.Allowing all inbound mail traffic.

AnswersB, D

SPF authorises sending hosts, DKIM cryptographically signs messages, and DMARC ties both to the visible From domain with a policy. Together they let receivers reject or quarantine spoofed mail, directly countering phishing that forges your domain.

Why this answer

Option B is correct because implementing SPF, DKIM, and DMARC together authenticates the sending domain: SPF authorizes sending IPs via DNS TXT records, DKIM cryptographically signs messages with a public key published in DNS, and DMARC tells receivers how to handle messages that fail SPF/DKIM alignment, which directly blocks spoofed sender addresses used in phishing. Option D is correct because Cisco Secure Email sandboxing detonates suspicious attachments and URLs in an isolated environment to detect zero-day malware and credential-harvesting links that signature-based filters miss, adding a behavioral layer of phishing defense. Option A is wrong because using only local SMTP relays does not authenticate senders or filter malicious content and can even worsen spoofing exposure.

Option C is wrong because disabling all attachments is overly broad, breaks legitimate business mail, and does not stop phishing links or social-engineering text. Option E is wrong because allowing all inbound mail traffic removes any filtering or policy enforcement, directly enabling phishing delivery.

Exam trap

SDSI often tests the misconception that extreme measures like disabling all attachments are effective, when in fact authentication protocols and sandboxing are the correct layered approach.

Practice this question →

MCQmedium

A security architect is designing a Cisco Secure Firewall deployment for a multi-cloud environment. Which design strategy ensures consistent security policy enforcement across AWS and Azure instances?

A.Utilize a centralized FMC to manage virtual Secure Firewalls across all cloud environments.

B.Deploy separate FMC instances in each cloud provider for localized management.

C.Use individual Firewall Device Managers (FDM) for every instance.

D.Implement cloud-native security groups exclusively to bypass firewall bottlenecks.

AnswerA

A centralised FMC manages virtual Secure Firewalls in both AWS and Azure, pushing one unified policy set to every instance. This directly satisfies the stem's requirement for consistent enforcement across clouds, since policy is authored once and deployed identically, rather than configured separately per cloud platform.

Why this answer

A centralized FMC (Firepower Management Center) provides a single pane of glass for policy creation, deployment, and monitoring across all virtual Secure Firewall instances regardless of whether they run in AWS, Azure, or on-premises. This ensures that the same access control, IPS, and URL filtering policies are consistently enforced, eliminating policy drift between clouds. FMC supports multi-domain and hierarchical policy inheritance, which is essential for multi-cloud consistency.

Exam trap

SDSI often tests the misconception that each cloud requires its own management plane; candidates pick separate FMCs thinking it provides redundancy, but the exam expects centralized FMC for consistent policy.

How to eliminate wrong answers

Option B is wrong because separate FMC instances per cloud create policy silos, requiring duplicate configuration and preventing consistent enforcement across environments. Option C is wrong because FDM is a per-device, single-instance manager with no centralized orchestration, making consistent multi-cloud policy impossible at scale. Option D is wrong because cloud-native security groups are stateless/stateful L3-L4 filters that lack Cisco's L7 inspection, IPS, and unified policy model, and they do not replace firewall policy enforcement.

Practice this question →