Select Two (Multi-Select) Questions

Explainability and transparency (XAI)

Explainability and transparency (XAI) satisfies the requirement that automated security decisions remain auditable and defensible. Security teams must understand why a model flagged an event, so XAI techniques such as feature attribution and surrogate models expose the reasoning behind each verdict, enabling analyst review, regulatory compliance and bias detection.

API integration and extensibility

API integration and extensibility directly satisfy the stem's demand for AI/ML design considerations: models must ingest telemetry and push verdicts across Microsoft Entra ID, SIEM and ticketing systems, so broad, documented APIs and webhook or plugin extensibility determine whether automation can act on predictions rather than stall at data boundaries.

Data quality and labeling

Poor-quality or unlabelled training data directly degrades the detection accuracy of any AI-driven security automation, so data quality and labelling must be assessed before platform selection. This satisfies the stem's design-consideration constraint: without representative, accurately labelled datasets, models generate false positives and miss genuine threats.

Implement strict schema validation on all incoming API requests

Strict schema validation rejects malformed or unexpected payloads at the API boundary, directly mitigating OWASP API Top 10 injection and mass assignment style attacks. It enforces the expected data contract before requests reach backend logic.

Monitor API traffic for anomalies that indicate data exfiltration

Continuous traffic monitoring detects anomalous patterns such as unusual data volumes or destinations, exposing exfiltration attempts that pass authentication. This addresses OWASP API Top 10 concerns around excessive data exposure and insecure endpoints, satisfying the requirement to identify active abuse.

Deploy API Security to detect Broken Object Level Authorization (BOLA)

BOLA, the top OWASP API risk, occurs when an object identifier is manipulated to access another user's data. API Security inspects object-level access patterns and flags unauthorised cross-tenant requests, satisfying the requirement to detect this authorisation flaw.

Workflow orchestration

Workflow orchestration chains discrete automated actions into a defined sequence, passing outputs between steps. In an automated pipeline this satisfies the need to coordinate multiple security tools without manual intervention, executing the end-to-end process reliably and repeatably.

Incident management and response

Incident management and response provides the case-centric layer where alerts are correlated, enriched and tracked to closure. Within an automated pipeline it satisfies the requirement to manage the lifecycle of a detected threat, ensuring response actions are recorded and accountable.

Threat intelligence aggregation

Threat intelligence aggregation consolidates indicators from multiple feeds into a normalised store that automation can query. In an automated pipeline this satisfies the need to enrich observables with reputation and context before decisions are taken, improving accuracy of subsequent response actions.

Infrastructure as Code (IaC)

Infrastructure as Code defines Cisco devices and policies in version-controlled templates, so every change is peer-reviewed, tested and auditable before deployment. This directly satisfies the stem's demand for a robust DevSecOps architecture by eliminating undocumented manual configuration drift across the estate.

Continuous Monitoring

Continuous monitoring provides ongoing telemetry across the pipeline and runtime, detecting anomalies, drift and threats as they emerge. It satisfies the DevSecOps demand for feedback loops, enabling rapid response to security events affecting Cisco infrastructure components throughout the application lifecycle.

Automated Testing

Automated testing embeds security and functional validation directly into the CI/CD pipeline, catching defects before deployment. This satisfies the DevSecOps requirement for shifting security left across Cisco infrastructure, ensuring every code change is verified consistently without manual gates slowing delivery.

802.1X (EAP-TLS).

802.1X with EAP-TLS authenticates IoT devices using certificate-based identity at the switch port, satisfying the requirement for cryptographic, per-device identification. Devices lacking supplicants need alternatives, but certificate exchange provides strong identity without relying on inferred behaviour.

Device profiling (ISE).

Cisco ISE device profiling identifies IoT endpoints by passively analysing attributes such as MAC OUI, DHCP options and HTTP user agents, satisfying the requirement for identification where 802.1X supplicants are absent. It classifies devices into profiles that then drive authorisation policy.

Device posture validation

Device posture validation satisfies the requirement for identity-based endpoint access by feeding compliance signals—encryption status, patch level, EDR health—into Conditional Access, so Microsoft Entra ID grants tokens only to healthy devices. This enforces zero-trust least privilege at the endpoint rather than trusting credentials alone.

Multi-factor authentication

Multi-factor authentication satisfies the identity assurance constraint by requiring a second factor beyond a password, blocking credential-only attacks such as phishing or replay against endpoint sign-ins. Enforcing it through Microsoft Entra ID conditional access ensures compromised passwords alone cannot establish a trusted session to protected endpoints.

Monitoring for anomalous user behavior and account takeovers.

Cloudlock baselines each SaaS user's normal activity, then flags deviations such as impossible travel, mass downloads or new forwarding rules that indicate account takeover. Detecting these anomalies early interrupts exfiltration before bulk data leaves the tenant.

Enforcing consistent DLP policies across various SaaS platforms.

Cloudlock applies one DLP policy set across sanctioned SaaS platforms, matching sensitive data patterns and enforcing sharing restrictions consistently. This uniformity closes the gap where a user exfiltrates via whichever application has the weakest controls.

Cisco Secure Network Analytics

Secure Network Analytics supplies the network side of the correlation: flow telemetry from NetFlow and IPFIX, behavioural analytics and detections that reveal anomalous traffic and command-and-control activity. Combined with endpoint telemetry, it lets investigators pivot between network and host evidence, satisfying the stem's correlation requirement.

Cisco Secure Endpoint

Secure Endpoint contributes the host-side telemetry — process executions, file activity, detections and device trajectory — that network flow data alone cannot show. Correlating these endpoint events with network traffic gives investigators the full attack chain, satisfying the stem's requirement for improved correlation.

Cultural resistance to change

Legacy operations teams often distrust automation that removes manual oversight, so cultural resistance directly obstructs rollout. This human factor is a recognised implementation challenge, distinct from technical gaps such as missing APIs or inconsistent logs, and must be managed through change enablement before automated security can succeed.

Fragmented or inconsistent log data

Legacy estates log in inconsistent formats across heterogeneous devices, so correlation and automated response lack reliable normalised input. This fragmentation directly satisfies the challenge criterion, since automation depends on consistent, aggregated telemetry that legacy systems rarely deliver natively.

Lack of native API support in legacy devices

Many legacy devices expose only CLI or SNMP, offering no REST APIs for programmatic control. Automation platforms therefore cannot query or enforce policy directly, satisfying the challenge criterion because integration requires fragile screen-scraping or manual scripting instead of native orchestration.

Authentication and authorization verification

The gateway terminates client requests and validates credentials and scopes before forwarding anything upstream, so unauthenticated or unauthorised calls never reach backend services. This satisfies the requirement that the API Gateway enforce authentication and authorization.

Routing to appropriate backend microservices

Routing requests to the correct backend microservices is a core gateway function, satisfying the stem's requirement that the gateway fronts a distributed API environment. The gateway terminates the client connection and forwards traffic based on path, host or header rules, so clients never address individual services directly.

Request rate limiting

Rate limiting at the gateway enforces a defined request threshold per client, protecting backend services from traffic spikes and abuse before requests reach them. This satisfies the stem's secure API environment requirement by centralising throttling at the entry point, rather than duplicating it across each downstream service.

Regulatory and compliance requirements

Regulatory and compliance requirements dictate mandatory controls, data residency, retention, and audit obligations the infrastructure must satisfy. Treating them as a critical factor ensures the design meets legally binding mandates, directly shaping the security requirements derived during risk assessment.

Current threat intelligence and landscape

Current threat intelligence and landscape reveal which adversaries, tactics, and vulnerabilities actively threaten the organisation. Factoring this into the risk assessment ensures the infrastructure design addresses realistic, present dangers rather than historical or theoretical ones.

Criticality of business data and assets

Criticality of business data and assets establishes how much protection each resource warrants, driving classification, segmentation and control selection. It is a foundational input because design requirements scale with the value and sensitivity of what is being secured.

Cisco Threat Grid sandboxing

Cisco Threat Grid sandboxing detonates suspicious attachments and URLs in an isolated environment, observing actual behaviour rather than relying on signatures. This satisfies the stem's email-based threat mitigation requirement by catching zero-day malware and evasive threats that static filtering misses, blocking delivery before a user can interact with the payload.

Outbreak filters

Outbreak Filters quarantine suspicious messages ahead of signature availability, using real-time threat telemetry to block fast-moving campaigns. This satisfies the requirement to mitigate rapidly emerging email threats during the window before conventional antivirus definitions are published.

SenderBase reputation service

SenderBase assigns reputation scores to sending IP addresses and domains based on traffic behaviour, allowing Secure Email to reject or throttle messages from known malicious senders. This satisfies the requirement to mitigate email threats before content inspection occurs.

A centralized, automated enforcement policy engine

A centralized, automated enforcement policy engine satisfies the requirement for consistent, dynamic control across distributed workloads. It evaluates identity, device and workload context to permit or deny east-west traffic, removing manual rule maintenance. This directly enables the least-privilege, assume-breach enforcement that Zero Trust microsegmentation demands, aligning with Microsoft Entra ID conditional access principles.

Visibility into every communication flow

Microsegmentation enforces least-privilege east-west traffic, which demands complete knowledge of existing workload-to-workload flows before policy creation. Without full visibility into every communication flow, you cannot define accurate segmentation rules, and legitimate traffic gets blocked. This directly satisfies the stem's requirement for successful Zero Trust deployment.

Identification and classification of all workloads

Microsegmentation policies can only be scoped to workloads that are known and labelled, so identifying and classifying every workload supplies the inventory and sensitivity metadata the policy engine needs. Without this visibility, east-west rules cannot be written per workload, and the Zero Trust requirement to deny by default across the estate fails.

Scan the pipeline code for vulnerabilities

Pipeline code defines every build, test and deployment action, so scanning it for vulnerabilities detects injection flaws, insecure dependencies and tampered definitions before they execute, protecting the CI/CD pipeline itself rather than only the artefacts it produces.

Use isolated and ephemeral build runners

Isolated, ephemeral runners rebuild the execution environment for every job, so a compromised build cannot persist malware, credentials or tampering into subsequent runs. This directly satisfies the stem's pipeline-hardening requirement by eliminating the shared, long-lived agent state that attackers otherwise poison to compromise later builds.

Use a secure secret management service

Storing credentials in a dedicated secret management service keeps them out of source code, build logs and pipeline variables, satisfying the requirement to limit secret exposure. Centralised rotation and access auditing further reduce the blast radius if a pipeline component is compromised, unlike hard-coded or plaintext alternatives.

Behavioral baseline modeling of host and network patterns.

Stealthwatch builds behavioural baselines of normal host and network activity, then flags deviations such as unusual data volumes, new peer connections or off-hours transfers. This detects anomalies without relying on static signatures, catching threats that match no known pattern.

Analysis of NetFlow, IPFIX, and other flow telemetry.

Stealthwatch ingests flow telemetry — NetFlow, IPFIX and similar records exported by routers and switches — then applies behavioural analytics to baseline normal traffic and flag deviations. This satisfies the stem's anomaly-detection requirement, since flow metadata reveals volumetric and behavioural shifts without needing full packet capture.

API Gateway access logs

API Gateway access logs record every request — caller identity, endpoint, response code, latency — providing the authoritative request-level audit trail. Without these logs, individual API calls and their outcomes remain invisible to security monitoring.

Traffic telemetry from the service mesh sidecars

Service mesh sidecars intercept all east-west and ingress traffic, emitting per-request telemetry such as latency, response codes and source identity without application changes. This satisfies the stem's visibility requirement by exposing API traffic flows that network-level tools miss, particularly for encrypted service-to-service calls inside the cluster.

Policies are stored in version control systems

Storing policies in version control gives each change a commit history, reviewable diffs and rollback, which is the defining property of Policy as Code: policy definitions are treated as source artefacts rather than manual device configuration.

Policies can be validated with automated tests

Automated tests validate policy definitions before deployment, catching syntax errors and logic conflicts in the pipeline rather than in production. This satisfies the stem's requirement for a true Policy as Code characteristic: treating policy like software, where version-controlled definitions undergo continuous integration testing, ensuring only verified rules reach Cisco security infrastructure.

Blocking a malicious file hash

Blocking a malicious file hash is an enforcement action that pushes the indicator to endpoint or network controls, preventing execution or download. It satisfies the Threat Response criterion because it directly neutralises the threat rather than merely observing or enriching it.

Blocking a malicious URL

Blocking a malicious URL is an enforcement action that prevents endpoints or users from reaching the harmful destination. Cisco XDR treats this as a Threat Response automation action, satisfying the stem's requirement for active mitigation rather than detection or investigation.

Isolating an infected host

Isolating an infected host is a containment action that removes the compromised endpoint from the network, directly limiting lateral movement. Cisco XDR classifies this as a Threat Response automation action, satisfying the stem's requirement for response rather than detection.

Cisco Identity Services Engine (ISE).

Cisco ISE enforces Zero Trust for remote users by applying posture assessment and identity-based policy before granting network access. It satisfies the scenario's requirement for continuous verification, integrating with Microsoft Entra ID to evaluate device compliance and user context, then dynamically authorising or restricting access through TrustSec segmentation.

Cisco AnyConnect.

Cisco AnyConnect enforces Zero Trust for remote users by combining VPN connectivity with endpoint posture assessment and identity-based access control. It continuously verifies device compliance and user identity before granting network access, satisfying the scenario's requirement for secure remote access that trusts neither the network nor the user by default.

User login patterns and anomalies

Reviewing user login patterns and anomalies in Cisco Cloudlock satisfies the requirement to monitor SaaS user behaviour continuously. Cloudlock's User and Entity Behavior Analytics baselines each user's normal activity, then flags deviations such as impossible travel, unusual access times or suspicious IP addresses, surfacing compromised credentials and insider threats for regular review.

External file sharing activities

External file sharing activities expose sensitive data to third parties outside the organisation, so Cloudlock's DLP and anomaly detection monitor these events to enforce sharing policies. Regular review satisfies the SaaS integration plan's requirement to detect unauthorised external exposure, catching risky public links or domain-wide sharing that bypasses internal controls.

Third-party application integration permissions

Cisco Cloudlock's CASB reviews OAuth scopes granted to connected SaaS apps, so auditing third-party application integration permissions exposes over-privileged or risky grants that could permit data exfiltration, satisfying the requirement to regularly review activities affecting SaaS tenant security.