CCNA Application Security Design Questions — Page 2 of 2

MCQeasy

Which Cisco solution is primarily designed to provide visibility and protection for SaaS applications like Office 365, Salesforce, and Slack?

A.Cisco Secure Workload

B.Cisco Cloudlock

C.Cisco Secure Firewall

D.Cisco Umbrella

AnswerB

Cisco Cloudlock is the cloud access security broker (CASB) that discovers sanctioned and unsanctioned SaaS usage, applies data-loss prevention and threat policies to Office 365, Salesforce and Slack, and reports on user activity. It directly satisfies the requirement for visibility and protection of those SaaS applications.

Why this answer

Cisco Cloudlock is a cloud access security broker (CASB) that provides visibility into and control over SaaS application usage, including Office 365, Salesforce, and Slack. It uses APIs to monitor user activity, detect data exfiltration, and enforce data loss prevention (DLP) policies specifically for cloud applications. Unlike network-based solutions, Cloudlock operates at the application layer, offering granular SaaS security without requiring traffic redirection.

Exam trap

SDSI often tests the distinction between network security solutions (firewalls, secure internet gateways) and API-based CASB solutions, causing candidates to confuse Cisco Umbrella's DNS-layer protection with Cloudlock's SaaS application visibility.

How to eliminate wrong answers

Option A is wrong because Cisco Secure Workload (formerly Tetration) is designed for data center and workload protection, focusing on micro-segmentation and process behavior monitoring for servers and virtual machines, not SaaS application visibility. Option C is wrong because Cisco Secure Firewall is a next-generation firewall that provides network perimeter security and intrusion prevention, but it lacks the API-based SaaS application visibility and DLP capabilities of a CASB. Option D is wrong because Cisco Umbrella is a secure internet gateway that provides DNS-layer security, web filtering, and cloud-delivered firewall, but it does not offer the deep SaaS application visibility and API-based control that Cloudlock provides.

Practice this question →

Multi-Selectmedium

Which TWO factors must be considered when designing SaaS security using Cisco Cloudlock to ensure compliance with data protection regulations? (Choose TWO)

Select 2 answers

A.Configuring BGP peering with the SaaS provider

B.Establishing remediation workflows for policy violations

C.Defining appropriate data classification and DLP policies

D.Enabling hardware-based encryption for the SaaS vendor

E.Installing agents on all end-user laptops

AnswersB, C

Remediation workflows satisfy the enforcement requirement: Cloudlock detects violations via its DLP and UEBA engines, then triggers automated actions such as quarantine, revoke sharing, or notify owners. This closes the compliance loop, evidencing that detected breaches of data protection policy are actively corrected rather than merely logged.

Why this answer

Option B is correct because Cisco Cloudlock's value in a SaaS compliance program depends on operationalizing its policy engine: when Cloudlock detects a violation (for example, a DLP match or a risky third-party app), remediation workflows such as automated quarantine, revoke sharing, notify user, or alert admin are what actually enforce the regulation and produce an auditable response trail. Option C is correct because Cloudlock's DLP and data classification policies are the foundation of the entire control: you must define which data types are regulated (for example, PII, PCI, PHI) and how they are classified so Cloudlock's API-based scanning of SaaS platforms like Microsoft 365, Google Workspace, and Salesforce can detect and act on them. Option A is not relevant because BGP peering is an internet routing concern for network connectivity, not a SaaS data-protection control, and Cloudlock operates via APIs rather than routing.

Option D is not relevant because hardware-based encryption is a vendor infrastructure matter, not something the Cloudlock customer designs or configures for compliance. Option E is not relevant because Cloudlock is an API-based, agentless CASB that monitors sanctioned SaaS usage from the cloud, so endpoint agents are not required.

Exam trap

The trap is selecting network-centric options (BGP, hardware encryption, endpoint agents) for a SaaS security question; candidates must remember that CASB solutions like Cloudlock are API-based and focus on data classification, DLP, and remediation.

Practice this question →

MCQhard

You are designing a security architecture for a large e-commerce platform that uses a microservices architecture deployed on Cisco Container Platform (CCP). The security team wants to detect and prevent attacks that exploit vulnerabilities in the application code, such as SQL injection and cross-site scripting, without modifying the application code. Which Cisco solution should you design to meet this requirement?

A.Cisco AppDynamics with Security Guard and runtime application self-protection (RASP).

B.Cisco Secure Workload with deep packet inspection and signature-based detection.

C.Cisco Tetration with application dependency mapping and policy enforcement.

D.Cisco Cloudlock with API-based scanning of container images for vulnerabilities.

AnswerA

Cisco AppDynamics with Security Guard provides runtime application self-protection (RASP) that instruments the application at runtime to detect and block attacks like SQL injection and XSS without code changes. It integrates with the application server or runtime environment, analyzing application behavior and user input to prevent exploits in real time, making it suitable for microservices on CCP.

Why this answer

Cisco AppDynamics with Security Guard is designed to provide runtime application self-protection (RASP), which instruments the application runtime to detect and block application-layer attacks such as SQL injection and cross-site scripting. This approach does not require modifying application code and is effective for microservices deployed on Cisco Container Platform, meeting the security team's requirement.

Exam trap

The trap here is confusing microsegmentation or CASB solutions with runtime application self-protection, which is specifically needed for code-level attack prevention.

Practice this question →

MCQmedium

Your organization uses a hybrid cloud model. You are tasked with designing a security posture for workloads in AWS and Azure using Cisco Secure Workload. What is the benefit of the 'Anywhere' agent approach?

A.It provides consistent security policy enforcement across heterogenous environments

B.It automatically patches the underlying operating system

C.It replaces the need for a central management platform

D.It eliminates the need for any firewall rules in the cloud

AnswerA

The Anywhere agent installs directly on workloads in AWS, Azure and on-premises, applying identical policy regardless of host platform. This satisfies the hybrid cloud constraint by removing dependence on native cloud constructs that differ between providers.

Why this answer

The 'Anywhere' agent approach in Cisco Secure Workload provides consistent security policy enforcement across heterogeneous environments, including on-premises, AWS, Azure, and other clouds. It allows you to define policies once and apply them uniformly, regardless of where the workload runs, ensuring a unified security posture.

Exam trap

SDSI often tests the scope of agent capabilities; candidates may confuse the agent with a patching tool or think it replaces firewalls, but its primary benefit is consistent policy enforcement across diverse environments.

How to eliminate wrong answers

Option B is wrong because the agent does not patch the operating system; it focuses on security policy enforcement and visibility. Option C is wrong because the agent does not replace the central management platform; it works in conjunction with it to enforce policies. Option D is wrong because the agent does not eliminate the need for firewall rules; it complements them by providing workload-level microsegmentation.

Practice this question →

Multi-Selecthard

You are designing a secure API gateway architecture for a financial institution using Cisco API Security. The design must protect against OWASP API Security Top 10 threats, specifically Broken Object Level Authorization (BOLA) and Excessive Data Exposure. Which TWO design controls should you implement to mitigate these threats? (Choose two.)

Select 2 answers

A.Enable mutual TLS (mTLS) between the API client and the API gateway to ensure strong authentication.

B.Implement response filtering to remove sensitive data fields from API responses based on the user's role and the principle of least privilege.

C.Enforce object-level authorization checks at the API gateway by validating the user's permissions for each requested resource.

D.Deploy a web application firewall (WAF) in front of the API gateway to block SQL injection and cross-site scripting attacks.

E.Use rate limiting to restrict the number of API requests per user per minute.

AnswersB, C

Excessive Data Exposure happens when APIs return more data than necessary, exposing sensitive information. Response filtering at the API gateway can strip out fields that the user is not authorized to see, based on their role. This enforces the principle of least privilege and reduces the risk of data leakage, directly addressing Excessive Data Exposure.

Why this answer

Broken Object Level Authorization is mitigated by enforcing object-level authorization checks at the API gateway, ensuring users can only access resources they are permitted to. Excessive Data Exposure is mitigated by response filtering, which removes sensitive fields based on user role and least privilege. Together, these controls address the two specific OWASP API Security Top 10 threats mentioned.

Exam trap

The trap here is assuming that authentication mechanisms like mTLS or generic WAF rules can prevent authorization flaws and data exposure, which require specific authorization and response filtering controls.

Practice this question →