AI Automation And Devsecops practice questions

Optimize container performance

Why it fails: This is a secondary benefit, not the security goal.

Scale container instances

Why it fails: This is an orchestration task.

Manage container networking

Why it fails: This is handled by the CNI plugin.

Cisco Smart Licensing Utility

Why it fails: For license management.

Cisco Adaptive Security Device Manager

Why it fails: A legacy management tool.

Cisco DNA Center

Why it fails: Orchestrates network devices, not security response.

Cisco Secure Firewall

Why it fails: Requires decryption for payload analysis.

Cisco Umbrella

Why it fails: Focuses on DNS-layer security.

Cisco Secure Email

Why it fails: Focuses on email-based threats.

Static malware analysis

Why it fails: This is for file-based detection.

Dynamic sandboxing

Why it fails: This is for behavioral analysis of files.

Vulnerability assessment

Why it fails: This checks for system flaws.

Cisco DNA Center GUI

Why it fails: GUI is not for pipeline integration.

Python native sockets

Why it fails: Too low-level and does not offer infrastructure-as-code state management.

Cisco Defense Orchestrator Portal

Why it fails: The portal is for manual orchestration; it lacks a native GitHub Action integration.

Cisco ISE pxGrid Node

Why it fails: While it can receive data, it is not the primary API for trigger-based response actions in this context.

Cisco Stealthwatch Management Console CLI

Why it fails: CLI is not suitable for automated pipeline integration.

Cisco DNA Center Assurance API

Why it fails: This is for network health, not security threat hunting.

Umbrella Provisioning API

Why it fails: Used for site/network management.

Umbrella Reporting API

Why it fails: Used to read logs and metrics.

Umbrella Log Management API

Why it fails: Used to export raw logs.

Manual CLI restore

Why it fails: Violates the principles of CI/CD.

FMC Factory Reset

Why it fails: Too destructive to be a pipeline rollback method.

Automated snapshot deletion

Why it fails: This would delete the recovery data.

DNS Filtering

Why it fails: Blocks malicious domains, not login attempts.

SSL Inspection

Why it fails: Detects malware, not necessarily credential stuffing.

Intrusion Prevention System (IPS)

Why it fails: Not optimized for application-level credential stuffing.

Cisco Secure Firewall Management Center Policy Analyzer with pre-deployment rule analysis

Why it fails: FMC Policy Analyzer focuses on analyzing existing rules and traffic, not on simulating proposed changes. While it can help identify risky rules after they are in place, it lacks a pre-deployment simulation feature that integrates with CI/CD to evaluate a policy change before it is committed to the FMC, making it unsuitable for this design requirement.

Cisco Secure Firewall Threat Defense REST API with a custom pre-commit hook

Why it fails: The FTD REST API allows configuration changes and retrieval of operational data, but it does not provide a policy analysis engine. Using it with a pre-commit hook would require building custom logic to parse and assess rules, which is not the native, purpose-built pre-deployment validation capability needed for automated risk analysis of firewall policies.

Cisco Secure Firewall Management Center Policy Analyzer

Why it fails: FMC Policy Analyzer evaluates existing access rules against traffic flows and hit counts to identify unused or overly permissive rules, but it is a post-deployment analysis tool. It does not integrate into a CI/CD pipeline to block a policy change before deployment, so it fails to meet the requirement for pre-deployment validation.

Use Cisco ISE Admin Portal with automated GUI scripting to update authorization policies.

Why it fails: GUI scripting is fragile, insecure, and not supported for production automation. It is prone to breakage with UI changes and lacks proper error handling. This approach is not a design best practice for DevSecOps and cannot provide the consistency and security required for automated policy updates in a healthcare environment with strict compliance needs.

Use Cisco ISE pxGrid to publish authorization policy changes from the CI/CD system to ISE.

Why it fails: pxGrid is designed for sharing contextual information between ISE and other security tools, not for directly modifying ISE authorization policies. While pxGrid can be used to trigger policy changes indirectly, it does not provide a direct, programmatic way to update policies. Relying on pxGrid would introduce unnecessary complexity and latency, failing to meet the requirement for consistent, automated policy updates.

Use Cisco ISE REST API with OAuth 2.0 tokens generated by the CI/CD system to update authorization policies.

Why it fails: ISE REST API supports basic authentication and, in newer versions, OAuth 2.0. However, using OAuth 2.0 tokens generated by the CI/CD system requires ISE to be configured as a resource server, which is not a standard or straightforward configuration. This approach introduces complexity and potential security gaps, making it less reliable for consistent policy updates in this scenario.

Agentless vulnerability scanning

Why it fails: Agentless vulnerability scanning discovers software flaws and missing patches on hosts; it neither models nor simulates policy enforcement, so it cannot preview policy behaviour. It tempts because it is a genuine Cisco Secure Workload capability, and would be correct when the requirement is continuous vulnerability assessment rather than policy validation.

Workload isolation testing

Why it fails: Workload isolation testing verifies segmentation by quarantining workloads or blocking traffic in the live fabric; it enforces rather than simulates, so no dry-run preview of policy outcomes occurs. It tempts because isolation and segmentation are the product's core purpose, and would be correct when validating that a workload is contained.

Inventory change management

Why it fails: Inventory change management tracks workload additions, removals and attribute drift over time; it records state changes rather than modelling policy decisions, so it cannot simulate enforcement. It tempts because accurate inventory underpins policy scoping, and would be correct when the task is detecting newly discovered or decommissioned workloads.

Live enforcement mode

Why it fails: Live enforcement mode applies policy to production traffic immediately, altering real flows with no simulation stage; it is the opposite of a dry run. It tempts because it is the natural final step after testing, and would be correct once policy has already been validated and is ready for production rollout.

Manually updating via FMC UI then exporting JSON

Why it fails: Manual UI edits followed by JSON export are neither automated nor idempotent, and exported files can drift from FMC's live state between runs. This approach suits documenting an existing configuration or seeding a lab, not repeatable DevSecOps pipeline enforcement of rule updates.

Pushing configuration snapshots via SCP

Why it fails: SCP transfers whole configuration files, so Ansible cannot report per-rule changed state or converge only differences, breaking idempotency and bypassing FMC's validation. Snapshots suit disaster-recovery backups, where restoring a known-good configuration wholesale is the goal rather than incremental rule management.

Executing raw REST API calls via shell scripts

Why it fails: Raw REST calls in shell scripts return no changed-state reporting, so Ansible cannot determine idempotency, and credentials passed through shell commands risk exposure in process lists and logs. Direct API calls are appropriate for one-off automation outside Ansible's declarative module framework.

Embed as environment variables in the build runner

Why it fails: Environment variables persist in the runner's process and logs, exposing the FMC API key to any job or artefact on that host. It is tempting because CI systems inject variables natively, but compliance demands a secrets manager issuing short-lived, audited credentials rather than static runner variables.

Encrypt with base64 and store in Git

Why it fails: Base64 is reversible encoding, not encryption, so the FMC key sits in Git history in plaintext-equivalent form. It is tempting because the value looks scrambled and Terraform accepts it, but compliance requires a secrets manager with dynamic, audited credentials rather than encoded strings in repositories.

Hardcode in the Terraform provider block

Why it fails: Hardcoding the key in the provider block commits it to version control and state files, breaching compliance and rotation requirements. It is tempting because it works immediately in a local test, but production pipelines must retrieve credentials at runtime from a secrets manager, never from Terraform configuration.

Cloud-native storage

Why it fails: Cloud-native storage retains telemetry and event data but performs no normalisation or schema mapping. Cisco XDR's normalisation happens in the data model and integration layer that translates each product's events into a common schema. Storage is correct when the requirement is long-term retention or querying of raw telemetry.

Local management agent

Why it fails: A local management agent only collects telemetry from the host it is installed on; it performs no cross-product normalisation or orchestration. It is tempting because agents do feed event data into XDR, but that role is data collection, not the normalisation engine that maps disparate Cisco product telemetry into a common schema for automated workflows.

Packet inspection engine

Why it fails: Packet inspection analyses network traffic content for threats; it does not translate disparate product event formats into a shared schema. Normalisation for orchestration is handled by Cisco XDR's data model and integration APIs. Packet inspection fits detecting malicious traffic patterns, not unifying vendor telemetry.

Automated hardware deployment

Why it fails: Shift Left concerns when and where security controls run within the pipeline, not how infrastructure is provisioned; hardware deployment is unrelated to it. It is tempting because pipeline automation does include provisioning tools, but that is infrastructure as code, a separate practise.

Increased development speed

Why it fails: Shift Left moves security testing into earlier pipeline stages, catching defects sooner and reducing remediation cost; it does not inherently raise development speed, and often adds gates. Increased speed is the goal of CI/CD automation or parallel testing, not the primary benefit of Shift Left security.

Elimination of security teams

Why it fails: Shift Left moves security testing into earlier pipeline stages; it redistributes responsibility to developers rather than removing the security function, which still owns policy, tooling and review. It is tempting because automation does absorb routine scanning work, but specialist security expertise remains essential.

Manage user identities

Why it fails: Artifactory stores and versions build artefacts, scanning them for vulnerabilities and enforcing promotion policies; it holds no identity data and cannot authenticate users. Managing user identities belongs to Microsoft Entra ID, which handles authentication, conditional access and directory objects — the right tool when the requirement is controlling who may sign in.

Monitor real-time network traffic

Why it fails: Artifact repositories store and version build artefacts with integrity metadata, vulnerability scanning and signed provenance; they do not inspect live packets. It is tempting because network monitoring is a security control, but that belongs to IDS/NDR tooling, not to Artifactory's supply-chain role.

Execute live security testing

Why it fails: Artifactory serves stored artefacts and metadata to pipelines; it does not run dynamic scans or probes against a running application. Live security testing is performed by DAST tools such as OWASP ZAP against a deployed environment — the correct choice when the requirement is exercising a running system rather than governing artefact integrity.

Duo Web SDK

Why it fails: The Web SDK embeds Duo's prompt into a browser login flow, so it authenticates end users rather than administering accounts or authentication configuration. It is tempting as the standard client-side integration for protecting a web application, and would be correct when adding Duo two-factor authentication to a custom sign-in page.

Duo Auth API

Why it fails: The Auth API performs authentication and returns results; it cannot create, update or delete user objects or change policy settings. It is tempting because it is the primary Duo interface for verifying credentials, and would be right when integrating second-factor login into a custom application.

Duo Telemetry API

Why it fails: The Telemetry API streams authentication and device health events to external monitoring, so it reports activity rather than managing users or settings. It is tempting because it exposes authentication data, and would be correct when feeding Duo logs into a SIEM or analytics platform for detection.

Cisco Catalyst Center

Why it fails: Cisco Catalyst Center is a network automation and assurance controller for provisioning and monitoring campus infrastructure, not a Zero Trust access broker. It is tempting because it automates design and policy deployment, but it lacks the identity-aware, per-application access enforcement that Cisco ISE or Duo provide for remote developers.

Cisco IOS-XE

Why it fails: Cisco IOS-XE is the network operating system running on switches and routers; it forwards packets but does not itself authenticate users or enforce Zero Trust policy. It is tempting because access ultimately traverses IOS-XE devices, yet the identity-aware brokering must come from Cisco ISE or Duo.

Cisco Webex

Why it fails: Cisco Webex provides meetings, messaging and calling, offering no identity-based access control to internal servers. It is tempting because it is a Cisco collaboration product used by remote workers, but Zero Trust requires policy enforcement per user and device, which Webex does not perform.

Increased hardware throughput

Why it fails: False positive reduction improves the accuracy of detections, cutting analyst triage time and alert fatigue; it does not affect packet processing capacity. Increased hardware throughput is achieved by offloading, faster interfaces or dedicated processing hardware, not by tuning detection accuracy.

Lower bandwidth consumption

Why it fails: False positive reduction lowers the count of erroneous alerts requiring analyst review; it does not alter traffic volume traversing the network. Lower bandwidth consumption is achieved by traffic shaping, compression or filtering, which is tempting when the stated problem is link saturation rather than alert noise.

Faster packet forwarding

Why it fails: False positive reduction suppresses benign alerts that analysts would otherwise investigate, cutting triage workload; it does not touch packet handling. Faster packet forwarding belongs to data-plane acceleration or hardware offload, so it is tempting when performance, not alert fidelity, is the goal.