Knowledge + Practice

CCNA Risk Events And Requirements Questions

75 of 79 questions · Page 1/2 · Risk Events And Requirements topic · Answers revealed

Practice these questions Exam hub All questions

1

MCQmedium

When designing for high availability, what is the role of the 'Heartbeat' mechanism in a Cisco firewall pair?

A.To authenticate users.

B.To sync firewall configurations.

C.To detect the failure of the peer unit.

D.To balance traffic load.

AnswerC

The heartbeat continuously exchanges liveness signals between the active and standby units, so a missed threshold triggers failover. This directly satisfies the high-availability requirement by detecting peer failure, enabling the standby firewall to assume the active role and maintain traffic flow without manual intervention.

Why this answer

The heartbeat mechanism in a Cisco firewall HA pair sends periodic hello messages between peer units so each can detect whether the other is still alive. If heartbeats stop arriving within the hold time, the standby unit assumes the active unit has failed and takes over. It is purely a health/failure-detection mechanism, not a configuration sync or load-balancing function.

Exam trap

The trap is confusing heartbeat (liveness detection) with configuration synchronization; both use the failover link, but only the heartbeat detects peer failure, and candidates often pick 'sync configurations' as the heartbeat's role.

How to eliminate wrong answers

Option A is wrong because user authentication is handled by identity services (e.g., ISE, RADIUS, LDAP), not by HA heartbeats. Option B is wrong because configuration synchronization is performed over the failover link's config-sync channel, not by the heartbeat itself (the heartbeat is the liveness check). Option D is wrong because traffic load balancing is a separate function (e.g., ECMP, load balancers, or active/active clustering), not the role of the heartbeat.

Practice this question →

2

MCQhard

A security architect is configuring a design for an enterprise with high-speed (100G) traffic. Which Cisco firewall solution is most appropriate?

A.Cisco Umbrella virtual appliance.

B.Cisco Firepower 1000 series.

C.Cisco AnyConnect.

D.Cisco Firepower 9300 series.

AnswerD

The Firepower 9300's chassis-based architecture delivers the throughput the 100G requirement demands, scaling to roughly 1.2 Tbps with multiple security modules. Its clustered configuration sustains high-speed inspection without becoming a bottleneck, satisfying the enterprise's performance constraint where fixed-appliance alternatives would fall short.

Why this answer

Cisco Firepower 9300 series is a high-end, carrier-class firewall designed for high-speed, high-throughput environments, including 100G interfaces. It supports modular security services and clustering for scalability and redundancy. This makes it the most appropriate choice for an enterprise with 100G traffic.

Exam trap

SDSI often tests the scalability limits of different firewall models; candidates may incorrectly choose the 1000 series for high-speed environments due to familiarity or cost considerations.

How to eliminate wrong answers

Option A is wrong because Cisco Umbrella virtual appliance is a DNS-layer security solution, not a high-speed firewall. Option B is wrong because Cisco Firepower 1000 series is for small to medium businesses with lower throughput (up to 1 Gbps). Option C is wrong because Cisco AnyConnect is a VPN client, not a firewall.

Practice this question →

3

MCQhard

A security architect is designing a solution to block malicious URLs across all branch offices. Which Cisco feature provides the most efficient, scalable way to manage this across 500+ locations?

A.Cisco Umbrella cloud-delivered DNS filtering.

B.Cisco Stealthwatch.

C.Cisco Identity Services Engine (ISE).

D.Local URL filtering on each branch firewall.

AnswerA

Cisco Umbrella enforces DNS filtering from a single cloud policy console, so one URL-blocking rule propagates to all 500+ branch offices without per-site appliance configuration. This satisfies the stem's scalability and efficiency constraint across distributed locations.

Why this answer

Cisco Umbrella provides cloud-delivered DNS-layer security, so a single policy change in the Umbrella dashboard instantly applies to all 500+ branch offices without touching each site's firewall. DNS filtering blocks malicious domains before a connection is even established, making it both efficient and scalable for distributed environments.

Exam trap

The trap is choosing a detection tool (Stealthwatch) or an identity tool (ISE) for an enforcement task — candidates match 'security' to the wrong Cisco product category instead of recognizing DNS-layer blocking as Umbrella's specialty.

How to eliminate wrong answers

Option B is wrong because Stealthwatch is a network traffic analytics and anomaly-detection platform, not a URL-blocking enforcement point — it detects threats but does not block URLs at the DNS layer. Option C is wrong because ISE handles identity, access control, and network admission (802.1X, posture), not URL filtering. Option D is wrong because local URL filtering on each branch firewall requires per-site configuration and management, which does not scale to 500+ locations and creates policy drift.

Practice this question →

4

MCQeasy

A design requirement for a new SOC environment mandates that incident data must be centralized. Which Cisco tool is best suited to act as the single pane of glass for integrating disparate security logs and telemetry?

A.Cisco SecureX

B.Cisco Firepower Management Center (FMC)

C.Cisco Identity Services Engine (ISE)

D.Cisco Defense Orchestrator (CDO)

AnswerA

Cisco SecureX aggregates telemetry from multiple Cisco and third-party security products into a unified console, correlating alerts and enabling consistent response workflows. This centralisation satisfies the mandate for a single pane of glass integrating disparate logs across the SOC environment.

Why this answer

Cisco SecureX is the platform designed to act as a single pane of glass, integrating disparate security products and telemetry into a unified console with threat response, case management, and orchestration. It aggregates data from Cisco and third-party tools, making it the best fit for centralizing incident data across a SOC.

Exam trap

The trap is confusing device-management consoles (FMC, CDO) or identity platforms (ISE) with an integration/aggregation platform; candidates who equate 'centralized management' with 'single pane of glass' will pick FMC or CDO.

How to eliminate wrong answers

Option B is wrong because Cisco Firepower Management Center (FMC) manages Firepower/FTD devices and their events, but it is not a cross-vendor integration platform for disparate security logs. Option C is wrong because Cisco Identity Services Engine (ISE) is a policy and identity control plane for network access, not a log aggregation or incident centralization tool. Option D is wrong because Cisco Defense Orchestrator (CDO) is a cloud-based management platform for firewall policy across multiple devices, not a SOC-wide telemetry aggregation and incident console.

Practice this question →

5

MCQmedium

A security architect is designing a SIEM integration for a distributed enterprise. Which tool selection criteria best aligns with the requirement to support real-time correlation across disparate cloud and on-premises environments?

A.Choose tools that utilize a monolithic database structure to ensure data consistency.

B.Focus on tools that strictly utilize hardware-based packet capture for all telemetry.

C.Select tools based solely on the number of pre-built connectors available in the marketplace.

D.Prioritize tools that support native Common Event Format (CEF) ingestion and bidirectional API integrations.

AnswerD

CEF normalises event data from heterogeneous sources into a common schema, while bidirectional APIs let the SIEM both ingest telemetry and push enforcement actions back. This pairing directly satisfies the stem's real-time correlation requirement across disparate cloud and on-premises environments.

Why this answer

Native Common Event Format (CEF) ingestion and bidirectional API integrations are the criteria that best support real-time correlation across disparate cloud and on-premises sources. CEF is a standardized log format that normalizes events from heterogeneous vendors, and bidirectional APIs allow the SIEM to both ingest telemetry and push response actions back to sources, which is essential for a distributed enterprise.

Exam trap

The trap is choosing an answer based on superficial scalability or connector-count claims; the exam tests whether you recognize that standardized ingestion (CEF) plus bidirectional integration is what enables real-time cross-environment correlation.

How to eliminate wrong answers

Option A is wrong because a monolithic database structure creates a scalability bottleneck and cannot efficiently handle the volume and variety of distributed cloud and on-premises telemetry; modern SIEMs use distributed or columnar stores. Option B is wrong because hardware-based packet capture is impractical for cloud environments and does not scale to a distributed enterprise; it also misses log-based telemetry entirely. Option C is wrong because selecting tools solely on the number of pre-built connectors ignores whether those connectors support real-time normalization, correlation, and bidirectional response — quantity of connectors is a vanity metric, not a capability metric.

Practice this question →

6

MCQmedium

An organization is modifying their architecture to meet new compliance requirements for logging. The design requires offloading logs from multiple Cisco Firepower sensors. What is the recommended destination for long-term audit storage?

A.Security Information and Event Management (SIEM)

B.Cisco ISE Node

C.Cisco Catalyst Center

D.Local flash memory on the sensor

AnswerA

A SIEM aggregates and correlates event data from multiple Firepower sensors, providing the centralised, tamper-resistant retention required for long-term audit storage. It satisfies the compliance constraint by enabling historical log querying and reporting beyond each sensor's local storage capacity.

Why this answer

For long-term audit storage of logs from multiple Cisco Firepower sensors, a Security Information and Event Management (SIEM) system is the recommended destination. SIEMs are designed to aggregate, correlate, and retain logs from diverse sources for compliance and forensic analysis. They provide centralized storage, search, and reporting capabilities that meet audit requirements.

Exam trap

SDSI often tests the appropriate use of SIEM for centralized log retention versus using management platforms (FMC, ISE, Catalyst Center) that have limited or different purposes. Candidates may incorrectly choose a Cisco management tool for long-term storage.

How to eliminate wrong answers

Option B is wrong because a Cisco ISE node is primarily for identity and access control, not for long-term storage of Firepower logs; it may generate its own logs but is not a log repository. Option C is wrong because Cisco Catalyst Center (formerly DNA Center) is a network management and automation platform, not a SIEM or log storage solution. Option D is wrong because local flash memory on the sensor is limited, not centralized, and not suitable for long-term audit storage; it may be used for buffering but not for compliance retention.

Practice this question →

7

MCQmedium

An organization is performing a risk assessment for a new remote access design. They identify that the SOC currently lacks visibility into anomalous VPN session behavior. Which Cisco solution should the design incorporate to provide behavioral analytics for incident response tool selection?

A.Cisco Identity Services Engine

B.Cisco Umbrella

C.Cisco Secure Network Analytics

D.Cisco Secure Firewall Management Center

AnswerC

Cisco Secure Network Analytics applies behavioural modelling and anomaly detection to network flows, including VPN sessions, surfacing deviations the SOC cannot see today. It satisfies the stem's requirement for behavioural analytics feeding incident response tool selection, unlike signature-based options that only match known threats.

Why this answer

Cisco Secure Network Analytics (formerly Stealthwatch) uses NetFlow and telemetry to build behavioural baselines and detect anomalies such as unusual VPN session patterns, data transfers, or connection volumes. It is purpose-built for network behavioural analytics and feeds incident response tooling with actionable detections. This directly addresses the SOC's lack of visibility into anomalous VPN behaviour.

Exam trap

SDSI often tests the distinction between identity/policy platforms (ISE), DNS security (Umbrella), and true network behavioural analytics (Secure Network Analytics), tempting candidates to pick the most familiar Cisco security product.

How to eliminate wrong answers

Option A is wrong because Cisco Identity Services Engine is a policy and identity enforcement platform for network access control, not a behavioural analytics engine for VPN session anomalies. Option B is wrong because Cisco Umbrella provides DNS-layer security and secure web gateway functions, which do not deliver the network flow behavioural analytics required here. Option D is wrong because Cisco Secure Firewall Management Center manages firewall policy and events; while it has some analytics, it is not the dedicated behavioural analytics solution for VPN session visibility across the network.

Practice this question →

8

MCQeasy

What is the primary purpose of conducting a risk assessment as part of the security design process?

A.To identify and prioritize security controls based on threat and vulnerability data.

B.To automate the patching of all network servers.

C.To ensure compliance with local labor laws.

D.To select the cheapest security hardware.

AnswerA

Risk assessment maps threats and vulnerabilities against assets, producing prioritised findings that direct where security controls are applied. This satisfies the design goal of identifying and prioritising controls based on threat and vulnerability data rather than deploying controls arbitrarily.

Why this answer

A risk assessment identifies threats, vulnerabilities, and potential impacts, then prioritizes them so that security controls can be selected and funded based on actual risk rather than guesswork. This ensures the design addresses the most significant risks first and justifies control selection to stakeholders.

Exam trap

The trap is selecting an operational or cost-focused answer (patching, cheapest hardware) instead of recognizing that risk assessment is about identifying and prioritizing controls based on threat and vulnerability data.

How to eliminate wrong answers

Option B is wrong because patching automation is an operational vulnerability-management activity, not the purpose of a risk assessment — the assessment may inform patching priorities but does not automate patching. Option C is wrong because labor law compliance is unrelated to security risk assessment; it falls under HR and legal compliance, not security design. Option D is wrong because selecting the cheapest hardware is a cost decision, not a risk-based decision — risk assessment may justify spending more on controls for high-risk areas, not less.

Practice this question →

9

MCQeasy

A design requirements gathering phase identifies that users frequently access untrusted SaaS applications. Which Cisco solution should be included to mitigate data exfiltration risks?

A.Cisco Secure Firewall with IPS enabled.

B.Cisco Umbrella with CASB capability enabled.

C.Cisco AnyConnect VPN.

D.Cisco Identity Services Engine (ISE).

AnswerB

Umbrella's CASB capability provides inline visibility and control over sanctioned and unsanctioned SaaS traffic, applying data-loss prevention policies to block uploads of sensitive data. This directly addresses the untrusted-SaaS exfiltration risk identified during requirements gathering.

Why this answer

Cisco Umbrella with CASB capability enabled provides visibility and control over SaaS application usage, including the ability to detect and block unsanctioned apps, enforce DLP policies, and mitigate data exfiltration risks. It is specifically designed to secure cloud access and protect data in SaaS environments.

Exam trap

The trap is selecting a traditional network security tool (firewall, VPN, ISE) for a SaaS data exfiltration problem; candidates must recognize that CASB capabilities, like those in Umbrella, are specifically designed for SaaS visibility and control.

How to eliminate wrong answers

Option A is wrong because Cisco Secure Firewall with IPS focuses on network intrusion prevention and does not provide the granular SaaS application visibility and data-level controls needed for untrusted SaaS. Option C is wrong because Cisco AnyConnect VPN provides secure remote access but does not inspect or control SaaS application usage or data exfiltration. Option D is wrong because Cisco ISE is for identity and access control for network devices, not for monitoring or securing SaaS application data.

Practice this question →

10

MCQhard

A security architect is designing an incident response workflow. Which action in the Cisco Secure Endpoint console would be most appropriate to perform if a 'Host Isolation' request fails during an active threat containment?

A.Clear the event logs in FMC

B.Reboot the Cisco Secure Endpoint server

C.Quarantine the host via Cisco ISE

D.Deploy a new firewall policy

AnswerC

When Host Isolation fails, quarantining the endpoint through Cisco ISE applies network-level access control, blocking the compromised host from communicating while remediation proceeds. This contains the active threat despite the failed endpoint-level isolation, maintaining containment without disrupting other devices.

Why this answer

When Host Isolation in Cisco Secure Endpoint fails, the endpoint remains on the network and the threat is still active, so the architect needs an alternative enforcement point. Cisco ISE can apply a quarantine or remediation authorization profile via 802.1X, MACsec, or TrustSec to restrict the endpoint's network access at the switch or wireless controller. This provides a network-layer containment fallback that does not depend on the endpoint agent's isolation capability.

Exam trap

SDSI often tests the assumption that endpoint isolation is the only containment tool, when the correct answer requires recognising that network access control (ISE) provides an independent fallback enforcement point.

How to eliminate wrong answers

Option A is wrong because clearing event logs in FMC destroys forensic evidence and does nothing to contain the threat; FMC is also a firewall management plane, not an endpoint containment tool. Option B is wrong because rebooting the Secure Endpoint server is a disruptive infrastructure action that would not isolate the compromised host and could interrupt protection for the entire estate. Option D is wrong because deploying a new firewall policy is a broad, slow change that does not target the specific compromised endpoint and would not reliably stop east-west or outbound traffic from that host.

Practice this question →

11

MCQmedium

Which Cisco product allows administrators to manage security policies across a multi-vendor firewall environment?

A.Cisco SecureX.

B.Cisco Defense Orchestrator (CDO).

C.Cisco ISE.

D.Cisco Firepower Management Center (FMC).

AnswerB

Cisco Defense Orchestrator provides cloud-delivered, centralised policy management across multi-vendor firewalls, including Cisco, Check Point, Palo Alto Networks and Fortinet. It normalises policies into a single interface, satisfying the stem's multi-vendor constraint directly, unlike single-platform tools such as Cisco Firepower Management Center or Cisco Secure Firewall.

Why this answer

Cisco Defense Orchestrator (CDO) is a cloud-based management platform designed to orchestrate security policy across multi-vendor firewalls (Cisco ASA, FTD, Meraki, and third-party devices). It provides a single console for policy consistency, object management, and device onboarding across heterogeneous environments. FMC is Firepower-only, ISE is identity/NAC, and SecureX is an integration/automation fabric, not a multi-vendor firewall policy manager.

Exam trap

The trap is assuming FMC is the universal firewall manager; the exam distinguishes Firepower-only (FMC) from multi-vendor (CDO), and candidates often pick FMC out of familiarity.

How to eliminate wrong answers

Option A is wrong because Cisco SecureX is a cloud-based integration and automation platform that unifies visibility across Cisco security products; it does not manage firewall policy across vendors. Option C is wrong because Cisco ISE is an identity and access control platform (NAC, 802.1X, TrustSec), not a firewall policy manager. Option D is wrong because Cisco Firepower Management Center (FMC) manages only Cisco Firepower/FTD devices, not multi-vendor firewalls.

Practice this question →

12

MCQhard

A risk assessment reveals that internal servers are vulnerable to unauthorized access via SMB protocols. Which Cisco feature should be implemented on the internal switching infrastructure to mitigate this risk?

A.ACLs on the core switch.

B.Cisco Secure Endpoint scan.

C.Cisco TrustSec (SGTs).

D.Cisco Umbrella local policy.

AnswerC

Cisco TrustSec assigns Security Group Tags to endpoints and enforces group-based access control within the switching fabric, so SMB traffic from unauthorised segments is blocked regardless of IP addressing, directly mitigating the unauthorised SMB access risk identified.

Why this answer

Cisco TrustSec uses Security Group Tags (SGTs) to enforce role-based access control within the switching infrastructure, allowing segmentation and policy enforcement based on identity/role rather than IP addresses. By tagging SMB traffic and applying SGACLs, unauthorized access to internal servers via SMB can be blocked at the switch level. This is the appropriate internal segmentation control for the described risk.

Exam trap

The trap is choosing a familiar but less appropriate control (ACLs on core switch) over the identity-aware segmentation feature (TrustSec/SGTs) that the exam expects for internal SMB risk mitigation.

How to eliminate wrong answers

Option A is wrong because ACLs on the core switch are static, IP-based, and do not scale well for dynamic role-based segmentation; while they can block SMB, TrustSec provides the identity-aware, scalable mitigation expected in a secure architecture design. Option B is wrong because Cisco Secure Endpoint scan is an endpoint-level malware scan, not a network segmentation control for SMB access. Option D is wrong because Cisco Umbrella local policy is DNS-layer security and does not enforce SMB access control on internal switching infrastructure.

Practice this question →

13

MCQeasy

Which Cisco product is specifically designed to provide visibility into encrypted traffic without the need for manual decryption?

A.Cisco Encrypted Traffic Analytics (ETA).

B.Cisco Identity Services Engine (ISE).

C.Cisco Stealthwatch.

D.Cisco Firepower IPS.

AnswerA

Cisco Encrypted Traffic Analytics (ETA) satisfies the visibility-without-decryption constraint by analysing packet metadata and initial handshake fields, using machine learning to detect malware in encrypted flows. It identifies threats in TLS traffic without requiring decryption keys or breaking encryption, unlike solutions needing SSL inspection.

Why this answer

Cisco Encrypted Traffic Analytics (ETA) uses machine learning and network telemetry to identify malware in encrypted traffic without decrypting it. It analyzes flow metadata and sequence of packet lengths and times (SPLT) to detect threats, preserving privacy and reducing complexity. This is specifically designed for visibility into encrypted traffic.

Exam trap

SDSI often tests the distinction between tools that require decryption (Firepower IPS) and those that analyze encrypted traffic without decryption (ETA); candidates may confuse ETA with Stealthwatch or Firepower.

How to eliminate wrong answers

Option B is wrong because Cisco ISE is for identity and access control, not traffic analysis. Option C is wrong because Cisco Stealthwatch provides network visibility and behavioral analysis but does not specifically analyze encrypted traffic without decryption; it may rely on ETA for that. Option D is wrong because Cisco Firepower IPS can decrypt traffic for inspection but requires manual decryption configuration and does not provide visibility without decryption.

Practice this question →

14

MCQeasy

What is the primary function of Cisco pxGrid in a network design?

A.To encrypt traffic.

B.To exchange security context and data between Cisco and third-party products.

C.To filter web traffic.

D.To manage physical hardware.

AnswerB

pxGrid shares security context, such as identity, posture and threat data, between Cisco platforms and third-party tools, enabling coordinated enforcement. This context-exchange role is the primary function the stem asks for, distinct from inline traffic inspection.

Why this answer

Cisco pxGrid is a platform that enables bidirectional, context-sharing integration between Cisco security products and third-party solutions. It publishes security context — such as identity, endpoint posture, threat detection, and session data — and allows subscribers to query or receive that data to trigger coordinated responses. Its primary function is exchanging security context and data, not enforcing traffic controls itself.

Exam trap

SDSI often tests whether candidates mistake pxGrid for an enforcement or encryption mechanism, when it is actually a context-sharing integration bus — the trap is picking a function that belongs to another Cisco product.

How to eliminate wrong answers

Option A is wrong because pxGrid does not encrypt traffic; encryption is handled by protocols like IPsec, TLS, or MACsec, and pxGrid itself uses certificate-based mutual TLS only to secure its own control/data channel. Option C is wrong because pxGrid is not a web proxy or content filter — web filtering is performed by Cisco Umbrella or Secure Web Appliance (WSA). Option D is wrong because pxGrid does not manage physical hardware; it is a software integration fabric that runs as a service on Cisco ISE and exchanges contextual data with ecosystem partners.

Practice this question →

15

MCQmedium

A security architect is designing a DR strategy. Which feature of Cisco Secure Firewall ensures that configurations are synchronized between primary and backup units in a high-availability pair?

A.Cisco Secure Firewall Failover Link.

B.Cisco Defense Orchestrator auto-sync.

C.Cisco Identity Services Engine RADIUS sync.

D.Cisco FMC policy deployment.

AnswerA

The failover link is a dedicated connection between the pair that carries stateful failover messages, including connection state and configuration synchronisation. It lets the standby unit mirror the active unit's configuration so it can take over without manual rebuilding.

Why this answer

In a Cisco Secure Firewall high-availability (failover) pair, the failover link is the dedicated interface used to exchange hello/heartbeat messages and synchronize state and configuration between the primary and secondary units. It carries the failover communication that keeps the standby unit's configuration and connection state consistent with the active unit. Without a functioning failover link, the pair cannot maintain synchronized state or properly detect peer health.

Exam trap

The trap is conflating centralized management (FMC, CDO) with HA synchronization; candidates assume any 'management' product handles failover config sync, when in fact the dedicated failover link is the correct mechanism.

How to eliminate wrong answers

Option B is wrong because Cisco Defense Orchestrator is a cloud-based multi-device management platform; it does not perform real-time HA configuration synchronization between firewall peers. Option C is wrong because Cisco ISE RADIUS sync relates to identity/authentication policy, not firewall HA state or configuration replication. Option D is wrong because FMC policy deployment pushes policies from the manager to managed devices; it is not the mechanism that synchronizes configuration between the two units of an HA pair.

Practice this question →

16

MCQmedium

During a risk assessment, it is determined that a legacy application cannot be patched. Which Cisco security control should be prioritized to compensate for this vulnerability?

A.Cisco Stealthwatch behavioral alerts.

B.Cisco AnyConnect VPN.

C.Virtual patching via Cisco Secure Firewall IPS.

D.Cisco Umbrella DNS blocking.

AnswerC

Virtual patching through Cisco Secure Firewall IPS satisfies the unpatched legacy application constraint by inspecting traffic inline and blocking exploits targeting known vulnerabilities, without touching the host. It compensates for the missing vendor patch by enforcing signature-based and anomaly detection at the network layer, shielding the application until it can be retired or replaced.

Why this answer

Virtual patching via Cisco Secure Firewall IPS provides a compensating control for unpatched vulnerabilities by inspecting and blocking exploit traffic at the network layer. It does not require modifying the legacy application, making it ideal when patching is not possible. This approach reduces risk while maintaining availability.

Exam trap

SDSI often tests the difference between detection (Stealthwatch) and prevention (IPS); candidates may choose a monitoring tool when an active compensating control is required.

How to eliminate wrong answers

Option A is wrong because Stealthwatch provides behavioral alerts and visibility but does not actively block or compensate for a specific vulnerability. Option B is wrong because AnyConnect VPN provides secure remote access but does not address application vulnerabilities. Option D is wrong because Umbrella DNS blocking can block malicious domains but does not protect against exploits targeting a known vulnerability in the application itself.

Practice this question →

17

MCQeasy

A design needs to restrict network access based on the user's role and device type. Which Cisco product is the primary engine for this context-aware policy control?

A.Cisco SecureX.

B.Cisco Firepower Management Center.

C.Cisco Umbrella.

D.Cisco Identity Services Engine (ISE).

AnswerD

Cisco ISE evaluates identity, device posture and role attributes, then enforces context-aware access policy through network enforcement. This satisfies the requirement by combining user role and device type into authorisation decisions, which is ISE's core policy engine function.

Why this answer

Cisco Identity Services Engine (ISE) is the primary policy engine for context-aware access control in Cisco's security architecture. It evaluates identity attributes (user role, group membership) and device attributes (device type, posture, location) to enforce dynamic network access policies via 802.1X, MAB, and TrustSec. ISE integrates with switches, wireless controllers, and VPNs to apply role-based and device-based access restrictions, making it the correct answer for this requirement.

Exam trap

SDSI often tests the distinction between policy enforcement engines (ISE) and threat detection/response platforms (SecureX, Firepower, Umbrella), so candidates may incorrectly choose a product that provides security visibility rather than access control.

How to eliminate wrong answers

Option A is wrong because Cisco SecureX is a cloud-based platform that integrates multiple security products for threat detection and response, but it does not enforce network access policies based on user role and device type. Option B is wrong because Cisco Firepower Management Center manages Firepower next-generation firewalls and IPS devices, focusing on threat defense and policy management for those appliances, not on identity and device-based network access control. Option C is wrong because Cisco Umbrella is a cloud-delivered secure internet gateway that provides DNS-layer security, web filtering, and cloud firewall capabilities, but it does not serve as the primary engine for context-aware network access control based on user and device attributes.

Practice this question →

18

MCQmedium

In a post-incident design, which tool should be used to provide visibility into user activity across multiple SaaS applications?

A.Cisco ISE.

B.Cisco Stealthwatch.

C.Cisco Secure Firewall.

D.Cisco Umbrella (with CASB).

AnswerD

Cisco Umbrella's CASB component discovers sanctioned and unsanctioned SaaS usage and reports user activity across those applications, satisfying the multi-SaaS visibility requirement. Its cloud-native proxy logs API-based activity from integrated services, giving the post-incident view the stem demands.

Why this answer

Cisco Umbrella with CASB provides visibility and control over user activity across SaaS applications by combining DNS-layer security with cloud access security broker capabilities. CASB discovers shadow SaaS usage, enforces policies, and provides activity visibility across sanctioned and unsanctioned apps. ISE is identity/NAC, Stealthwatch is network flow analytics, and Secure Firewall is perimeter/IPS — none deliver SaaS application activity visibility the way Umbrella CASB does.

Exam trap

The trap is picking a network security tool (Stealthwatch, Secure Firewall) for SaaS activity visibility; the exam expects you to recognize CASB (Umbrella with CASB) as the SaaS visibility layer.

How to eliminate wrong answers

Option A is wrong because Cisco ISE provides identity and network access control, not SaaS application activity visibility. Option B is wrong because Cisco Stealthwatch analyzes network flows for anomalies and threats, but does not provide per-user SaaS application activity visibility. Option C is wrong because Cisco Secure Firewall enforces network security policy and IPS at the perimeter, but lacks the CASB-level SaaS application discovery and user activity insight.

Practice this question →

19

MCQmedium

A security architect is configuring Cisco SecureX for the first time. Which is the most important step to enable centralized incident response?

A.Setting the dashboard background color.

B.Manually uploading log files.

C.Renaming all the products in the dashboard.

D.Integrating product API credentials (e.g., Secure Endpoint, Umbrella).

AnswerD

SecureX achieves centralised incident response only by pulling telemetry and response actions from each integrated product, which requires supplying API credentials for Secure Endpoint, Umbrella and similar tools. Without those credentials no data or remediation capability flows into the platform, so this step underpins the entire centralised workflow.

Why this answer

Cisco SecureX aggregates data and enables automated workflows across Cisco security products by integrating their APIs. To enable centralized incident response, you must integrate product API credentials (e.g., Secure Endpoint, Umbrella, Firepower) so SecureX can pull events, correlate them, and trigger response actions. Without API integration, SecureX has no data to work with.

Exam trap

SDSI often tests the misconception that SecureX works out-of-the-box without integration — candidates pick cosmetic or manual options, but the exam expects you to know that API credential integration is the foundational step for centralized incident response.

How to eliminate wrong answers

Option A is wrong because dashboard background color is purely cosmetic and has no functional impact on incident response. Option B is wrong because manually uploading log files is not how SecureX ingests data — it uses API integrations for continuous, automated telemetry, and manual uploads would not scale or provide real-time response. Option C is wrong because renaming products in the dashboard is a display customization and does not enable any incident-response capability.

Practice this question →

20

MCQhard

A security architect is designing a solution to meet a regulatory requirement that all administrative access to network devices must be authenticated with multi-factor authentication (MFA) and that all commands executed by administrators must be logged and auditable. Which Cisco solution should be integrated into the design?

A.Cisco Secure Firewall Management Center with RADIUS authentication

B.Cisco Umbrella with Active Directory integration

C.Cisco Identity Services Engine (ISE) with TACACS+ and external MFA integration

D.Cisco Secure Network Analytics with LDAP authentication

AnswerC

ISE can act as a TACACS+ server to provide centralized authentication, authorization, and accounting for network device administrative access. It integrates with external MFA providers to enforce multi-factor authentication. Additionally, ISE logs all commands executed, providing the audit trail required by the regulation.

Why this answer

The requirement is for MFA and command auditing for network device administrative access. Cisco ISE with TACACS+ provides centralized device administration, integrates with MFA providers, and logs all commands. This meets the regulatory requirements for authentication and auditability.

Exam trap

The trap here is confusing management platform authentication with network device administrative access control, which requires TACACS+ or RADIUS.

Practice this question →

21

MCQmedium

When designing an architecture to mitigate the risk of data exfiltration, which Cisco solution provides visibility into the data being sent out of the organization?

A.Cisco Secure Firewall with TLS Inspection.

B.Cisco Umbrella (DNS only).

C.Cisco ISE.

D.Cisco Stealthwatch.

AnswerA

Secure Firewall decrypts outbound TLS sessions, inspects the plaintext payload against file and data policies, then logs or blocks the flow. TLS inspection is essential because encrypted egress otherwise hides exactly what data is leaving the organisation.

Why this answer

Cisco Secure Firewall with TLS Inspection is correct because it decrypts outbound TLS/SSL sessions, allowing the firewall's application-layer engines (Snort/IPS, URL filtering, file inspection) to see the actual payload leaving the organization. Without TLS inspection, encrypted exfiltration traffic is opaque to the firewall. This gives the deepest payload-level visibility into data being sent externally, which is exactly what exfiltration mitigation requires.

Exam trap

The trap here is confusing metadata-level visibility (NetFlow, DNS) with payload-level visibility — candidates pick Stealthwatch or Umbrella because they 'see traffic,' but only TLS inspection reveals the actual data content.

How to eliminate wrong answers

Option B is wrong because Cisco Umbrella (DNS only) can only see domain-name resolution requests, not the content of the data being transmitted — it can block known-bad domains but cannot inspect payloads for sensitive data. Option C is wrong because Cisco ISE is a network access control and identity policy platform (802.1X, MAB, profiling, posture, TrustSec), not a data-inspection or exfiltration-visibility tool. Option D is wrong because Cisco Stealthwatch (now Secure Network Analytics) analyzes NetFlow/IPFIX metadata for anomaly and threat detection — it sees flow patterns, not the actual data content being exfiltrated.

Practice this question →

22

Multi-Selecthard

When designing a post-incident security architecture, which THREE factors are critical for determining the placement of Cisco Secure Firewall sensors?

Select 3 answers

A.The number of users connected to the local office Wi-Fi.

B.Local temperature of the server room.

C.Physical segmentation of the network (VLANs/VRFs).

D.Availability of mirror ports or TAP points for traffic inspection.

E.Traffic throughput capacity of the firewall hardware.

AnswersC, D, E

VLANs and VRFs define the physical and logical segmentation boundaries within the network. Sensor placement must align with these boundaries so inspection points sit at trust transitions between segments, satisfying the requirement to monitor inter-segment traffic.

Why this answer

Option C is correct because the physical and logical segmentation of the network (VLANs and VRFs) dictates where a sensor can be inserted and which traffic flows it can observe, since a firewall sensor must sit at a boundary between segments to inspect inter-segment traffic. Option D is correct because placing a sensor requires either a SPAN/mirror port on a switch or a network TAP to copy traffic for inspection; without such a monitoring point, the sensor cannot passively receive the packets it needs to analyze. Option E is correct because the firewall hardware's traffic throughput capacity must match or exceed the volume of traffic at the proposed placement, otherwise the sensor will drop packets or become a bottleneck, undermining both security and availability.

Option A does not belong because the count of Wi-Fi users is a rough scale indicator, not a determinant of sensor placement, which depends on traffic paths and segmentation rather than user population. Option B does not belong because server room temperature is a facilities/environmental concern and has no bearing on where a network security sensor is logically or physically positioned.

Exam trap

SDSI often tests the confusion between environmental factors (like temperature) and network architecture factors; candidates may select user count or temperature instead of segmentation, TAP availability, and throughput.

Practice this question →

23

MCQhard

When assessing the risk of 'Data Loss' via USB devices, which Cisco product provides the best control for endpoint-based DLP?

A.Cisco Secure Endpoint.

B.Cisco Stealthwatch.

C.Cisco ISE.

D.Cisco Umbrella.

AnswerA

Secure Endpoint runs on the host, so it can detect and block file writes to removable media and apply device-control policies at the point of copy. That endpoint enforcement is what USB-based data loss prevention demands, unlike network or cloud controls.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) is the endpoint agent that provides device-level control, including USB device blocking and data loss prevention policies on endpoints. It is the only option that operates at the endpoint layer where USB devices are physically attached, making it the correct choice for endpoint-based DLP against USB data loss.

Exam trap

SDSI often tests the layer at which a control operates, and candidates who pick ISE or Stealthwatch for 'control' miss that USB DLP requires an endpoint agent, not network or identity infrastructure.

How to eliminate wrong answers

Option B is wrong because Cisco Stealthwatch analyzes network flow data (NetFlow/IPFIX) for anomaly detection; it has no endpoint USB control capability. Option C is wrong because Cisco ISE enforces network access policy (802.1X, profiling, posture) and can restrict network access but does not control USB storage devices on endpoints. Option D is wrong because Cisco Umbrella is a DNS-layer security and secure web gateway service for internet traffic, not an endpoint USB DLP control.

Practice this question →

24

MCQmedium

A SOC analyst requires a tool to gain visibility into encrypted traffic without full decryption. Which Cisco product feature should be included in the design to meet this requirement?

A.Cisco Encrypted Traffic Analytics (ETA).

B.Cisco Firepower SSL decryption policies.

C.Cisco AnyConnect Network Visibility Module (NVM).

D.Cisco Identity Services Engine (ISE) Profiling.

AnswerA

ETA derives security telemetry from encrypted flow metadata and sequence patterns without decrypting payloads, so threats in TLS traffic are detected while privacy and compliance constraints are preserved. This satisfies the requirement for visibility into encrypted traffic without full decryption.

Why this answer

Cisco Encrypted Traffic Analytics (ETA) uses machine learning and network telemetry (NetFlow, TLS metadata such as handshake fields and packet-length sequences) to detect malware in encrypted traffic without decrypting it. It is purpose-built for visibility into encrypted flows while preserving privacy and performance, exactly matching the SOC analyst's requirement.

Exam trap

SDSI often tests the distinction between decrypting traffic (SSL decryption) and analyzing encrypted traffic metadata (ETA) — candidates pick SSL decryption because it sounds more thorough, but the question explicitly says 'without full decryption.'

How to eliminate wrong answers

Option B is wrong because Firepower SSL decryption policies actually decrypt traffic (with a certificate), which is the opposite of 'without full decryption' and introduces privacy, performance, and certificate-management overhead. Option C is wrong because AnyConnect NVM collects endpoint telemetry (processes, applications) from the endpoint itself, not visibility into encrypted network traffic flows. Option D is wrong because ISE Profiling identifies and classifies endpoints on the network (device type, OS) for access control — it does not inspect encrypted traffic content or metadata for threat detection.

Practice this question →

25

MCQeasy

Which risk assessment methodology component focuses on identifying the 'crown jewels' of the organization's network architecture?

A.Control Implementation

B.Asset Identification

C.Vulnerability Scanning

D.Threat Vector Analysis

AnswerB

Asset identification inventories and classifies the systems, data and services in the architecture, establishing which are business-critical. That inventory is the prerequisite for designating crown jewels, since risk scoring cannot prioritise assets that have not first been discovered and documented.

Why this answer

Asset Identification is the component of risk assessment that focuses on discovering and cataloging all assets, especially the 'crown jewels'—the most critical and valuable data, systems, and applications. This step is foundational because you cannot protect what you haven't identified, and risk cannot be accurately assessed without knowing which assets are most business-critical. By identifying crown jewels first, organizations can prioritize subsequent risk analysis and controls where they matter most.

Exam trap

SDSI often tests the misconception that vulnerability scanning or threat vector analysis identifies crown jewels, but those activities assume you already know which assets are critical; the trap is confusing the order of operations in risk assessment.

How to eliminate wrong answers

Option A is wrong because Control Implementation is about deploying security measures (e.g., firewalls, encryption) to mitigate risks, not about identifying critical assets. Option C is wrong because Vulnerability Scanning focuses on discovering technical weaknesses in systems, not on determining which assets are the crown jewels. Option D is wrong because Threat Vector Analysis examines how attackers could exploit vulnerabilities, but it does not identify the organization's most valuable assets.

Practice this question →

26

MCQhard

During a design review, it is determined that the current logging architecture is missing context for user identity. Which Cisco tool must be integrated with the firewall to map IP addresses to specific usernames in the logs?

A.Cisco Defense Orchestrator.

B.Cisco Identity Services Engine (ISE).

C.Cisco Umbrella.

D.Cisco SecureX.

AnswerB

Cisco ISE supplies user-to-IP mapping through its identity and session directory, which the firewall consumes via pxGrid or the ISE identity source. This restores the missing user context in logs, resolving the design review finding.

Why this answer

Cisco Identity Services Engine (ISE) is the identity and policy platform that integrates with firewalls (via pxGrid or the ISE Identity Source) to map IP addresses to usernames, providing user-identity context in firewall logs. ISE maintains the active session directory of user-to-IP mappings from 802.1X, MAB, VPN, and passive authentication, which the firewall queries to enrich logs.

Exam trap

SDSI often tests the difference between management/orchestration platforms (Defense Orchestrator, SecureX) and the actual identity source (ISE) — candidates pick SecureX because it sounds like the central hub, but it does not itself provide IP-to-username mapping.

How to eliminate wrong answers

Option A is wrong because Cisco Defense Orchestrator is a cloud-based management platform for firewalls and other devices — it manages configurations and policies but does not provide user-to-IP identity mapping. Option C is wrong because Cisco Umbrella is a DNS-layer security service that blocks malicious domains; it does not map IPs to usernames for firewall log enrichment. Option D is wrong because Cisco SecureX is an integrated security platform that aggregates threat intelligence and automates workflows across products, but it relies on ISE (or similar) for identity data — it is not itself the identity source.

Practice this question →

27

MCQhard

An architect is reviewing post-incident logs in Cisco SecureX. Which feature allows the analyst to see the timeline of events from different integrated products in one view?

A.Stealthwatch Alarms view.

B.SecureX Incident/Event Timeline.

C.FMC Event Viewer.

D.ISE Auth Reports.

AnswerB

SecureX correlates telemetry from each integrated product into a single chronological Incident/Event Timeline, letting the analyst pivot across Secure Endpoint, Umbrella and firewall detections in one view. This directly satisfies the stem's requirement to see events from different integrated products together after an incident.

Why this answer

SecureX provides an Incident/Event Timeline view that aggregates events from all integrated products (Secure Endpoint, Umbrella, Firepower, Email, etc.) into a single chronological view for an investigation. This is the feature that lets an analyst see the sequence of events across products without pivoting between consoles. The other options are single-product event views that do not aggregate cross-product timelines.

Exam trap

The trap is picking a product-specific event view (Stealthwatch, FMC, ISE) when the question asks for a unified cross-product timeline — candidates confuse 'event view' with 'cross-product correlation'.

How to eliminate wrong answers

Option A is wrong because Stealthwatch Alarms view shows only network flow alarms from Secure Network Analytics, not a cross-product timeline. Option C is wrong because FMC Event Viewer displays firewall/IPS events only within the Firepower domain. Option D is wrong because ISE Auth Reports show authentication and authorization events for identity services, not a unified incident timeline.

Practice this question →

28

Multi-Selectmedium

Which THREE components are critical for an effective post-incident 'Architecture Adaptation'?

Select 3 answers

A.Increasing the number of helpdesk staff.

B.Updating security policies to address the identified gap.

C.Hardening of configurations on impacted network devices.

D.Renaming all user accounts in the domain.

E.Root Cause Analysis (RCA) report.

AnswersB, C, E

Architecture Adaptation requires closing the specific weakness the incident exposed, so revising security policies translates findings into enforceable controls. Without policy change, the same gap persists and the adaptation is incomplete, satisfying the stem's post-incident remediation requirement.

Why this answer

Option B is correct because architecture adaptation requires updating security policies to close the specific gap that enabled the incident, ensuring governance and controls reflect the lessons learned. Option C is correct because hardening configurations on impacted network devices directly remediates the exploitable weaknesses and prevents recurrence at the architectural/device level. Option E is correct because the Root Cause Analysis (RCA) report identifies the underlying failure and provides the evidence-based foundation for adapting the architecture.

Option A is not a structural or architectural change; adding helpdesk staff addresses operational capacity, not the root cause or design gap. Option D is not a remediation or adaptation measure; mass account renaming does not fix the vulnerability and can disrupt identity management without improving security posture.

Exam trap

SDSI often tests the difference between operational incident response tasks (e.g., staffing, account renaming) and strategic architectural changes. Candidates may pick operational actions that seem helpful but do not address the root cause or prevent recurrence.

Practice this question →

29

Multi-Selectmedium

Which THREE criteria are used during the 'Requirements Gathering' phase of a secure architecture design?

Select 3 answers

A.The color of the hardware rack units.

B.The personal email addresses of the network engineering team.

C.Business objectives and compliance requirements.

D.Throughput and latency requirements for critical applications.

E.Existing network topology and traffic flow patterns.

AnswersC, D, E

Requirements gathering begins by capturing what the business needs and what regulations mandate, since these drive every later design decision. Compliance obligations such as PCI DSS or GDPR directly shape segmentation, logging and control choices.

Why this answer

Option C is correct because requirements gathering in secure architecture design must capture business objectives and applicable compliance requirements (e.g., PCI DSS, HIPAA, GDPR), since these drive security controls, data handling, and risk tolerance. Option D is correct because throughput and latency requirements for critical applications define performance constraints that shape topology, link sizing, QoS, and redundancy decisions in the design. Option E is correct because the existing network topology and traffic flow patterns establish the baseline environment, including segmentation, choke points, and trust boundaries, that the secure architecture must integrate with or migrate from.

Option A is not a requirements-gathering criterion; rack unit color is a physical aesthetic detail with no bearing on security or functional design. Option B is also irrelevant, as personal email addresses of engineers are not a design requirement and would raise privacy concerns rather than inform architecture.

Exam trap

The trap is including irrelevant or personal details as 'requirements' — candidates may pick options that sound administrative or technical but have no impact on architecture design, such as rack color or personal contact info.

Practice this question →

30

MCQeasy

A security architect is documenting security requirements for a new data center design. The requirements must include a control that provides visibility into all traffic flows, including those between virtual machines, and can detect advanced threats using behavioral analysis. Which Cisco solution should be included in the design to meet these requirements?

A.Cisco Umbrella Investigate

B.Cisco Identity Services Engine

C.Cisco Secure Network Analytics

D.Cisco Secure Firewall Management Center

AnswerC

Secure Network Analytics provides network-wide visibility by collecting NetFlow and other telemetry from physical and virtual network devices. It uses behavioral analysis and machine learning to detect advanced threats such as insider attacks and malware command-and-control. It can monitor inter-VM traffic when integrated with the virtual infrastructure, making it suitable for this requirement.

Why this answer

The design requires visibility into all traffic flows, including inter-VM, and behavioral analysis for advanced threats. Cisco Secure Network Analytics collects telemetry from network infrastructure and virtual switches, applying behavioral analytics to detect anomalies. It provides the necessary visibility and threat detection capabilities for the data center environment.

Exam trap

The trap here is assuming that firewall management tools provide comprehensive network visibility, when they only see traffic that traverses the firewall.

Practice this question →

31

Multi-Selecthard

Which TWO Cisco products are used to achieve 'Zero Trust' for remote users?

Select 2 answers

A.Cisco Umbrella.

B.Cisco Identity Services Engine (ISE).

C.Cisco Stealthwatch.

D.Cisco AnyConnect.

E.Cisco Secure Email.

AnswersB, D

Cisco ISE enforces Zero Trust for remote users by applying posture assessment and identity-based policy before granting network access. It satisfies the scenario's requirement for continuous verification, integrating with Microsoft Entra ID to evaluate device compliance and user context, then dynamically authorising or restricting access through TrustSec segmentation.

Why this answer

Cisco Identity Services Engine (ISE) (B) is correct because it provides the policy decision and enforcement point for Zero Trust, performing identity-based authentication, authorization, posture assessment, and network access control (via RADIUS, 802.1X, and TrustSec/SGT) so that remote users are granted least-privilege access based on identity and device compliance. Cisco AnyConnect (D) is correct because it is the endpoint client that establishes the secure remote-access tunnel (SSL/TLS or IPsec IKEv2) and feeds endpoint posture and identity context into ISE, enabling continuous trust verification for remote users. Cisco Umbrella (A) is a DNS-layer and secure web gateway security service, not the identity/posture policy engine or the remote-access client required for Zero Trust enforcement.

Cisco Stealthwatch (C) is network traffic visibility and anomaly detection (flow analysis), and Cisco Secure Email (E) is email security; neither provides the identity-based access control or remote-user tunnel needed for Zero Trust.

Exam trap

SDSI often tests the distinction between Zero Trust enforcement components (ISE + AnyConnect) and Zero Trust visibility/protection add-ons (Umbrella, Stealthwatch, Secure Email) — candidates pick the well-known security products instead of the identity and endpoint enforcement pair.

Practice this question →

32

Multi-Selectmedium

A security designer is tasked with improving the SOC's incident response time. Which TWO Cisco platform capabilities should be integrated to enable automated threat hunting and containment? (Choose two)

Select 2 answers

A.Cisco Secure Endpoint

B.Cisco Webex

C.Cisco UCS Manager

D.Cisco Secure Firewall

E.Cisco Prime Infrastructure

AnswersA, D

Cisco Secure Endpoint provides continuous endpoint telemetry and automated containment, isolating compromised hosts and enabling threat hunting across the estate. Integrating it supplies the endpoint detection and response capability the SOC needs to shorten incident response time through automated investigation and remediation actions.

Why this answer

Cisco Secure Endpoint (A) is correct because it provides endpoint detection and response (EDR) telemetry and can automatically isolate a compromised host, which directly supports automated threat hunting and containment at the endpoint layer. Cisco Secure Firewall (D) is correct because its management center (FMC) supports automated threat hunting via correlation/incident policies and can enforce containment by blocking malicious traffic through access control and intrusion policies. Together these platforms feed and act on threat intelligence to shorten SOC response time.

Cisco Webex (B) is a collaboration suite, Cisco UCS Manager (C) manages compute hardware, and Cisco Prime Infrastructure (E) is a network management tool; none of these provide the automated threat hunting and containment capabilities required here.

Exam trap

The trap here is confusing general Cisco infrastructure/management products (UCS Manager, Prime Infrastructure, Webex) with security enforcement and detection platforms; candidates who pick 'Cisco' products by brand familiarity rather than by security function will choose wrong.

Practice this question →

33

MCQhard

An organization wants to monitor all internal traffic for anomalies. Which Cisco tool is used for behavioral analysis of network flows?

A.Cisco Secure Network Analytics (Stealthwatch).

B.Cisco ISE.

C.Cisco Umbrella.

D.Cisco Firepower IPS.

AnswerA

Cisco Secure Network Analytics (Stealthwatch) uses NetFlow and IPFIX telemetry to build behavioural baselines of internal traffic, then applies anomaly detection to flag deviations. This satisfies the requirement to monitor all internal traffic for anomalies without deploying inline inspection at every segment.

Why this answer

Cisco Secure Network Analytics (formerly Stealthwatch) is specifically designed for behavioral analysis of network flows. It collects NetFlow, IPFIX, and other flow telemetry from routers, switches, and firewalls, then applies machine learning and behavioral analytics to detect anomalies such as data exfiltration, lateral movement, or command-and-control traffic. Unlike signature-based tools, it baselines normal traffic patterns and alerts on deviations, making it the correct choice for monitoring internal traffic for anomalies.

Exam trap

SDSI often tests the distinction between flow-based behavioral analytics (Stealthwatch) and signature-based intrusion prevention (Firepower IPS) or DNS-layer security (Umbrella). Candidates may confuse 'monitoring internal traffic' with packet inspection, leading them to pick Firepower IPS.

How to eliminate wrong answers

Option B is wrong because Cisco ISE is a network access control and policy enforcement platform for identity-based access, not a flow-based anomaly detection tool. Option C is wrong because Cisco Umbrella provides DNS-layer security and secure web gateway functions, focusing on external domain resolution rather than internal traffic flow analysis. Option D is wrong because Cisco Firepower IPS is a signature and policy-based intrusion prevention system that inspects packets inline, but it does not perform behavioral analysis of network flows across the internal network.

Practice this question →

34

MCQeasy

Which document is essential for the SOC to standardize how they handle identified security incidents?

A.Vulnerability Assessment Report.

B.Vendor Product Data Sheets.

C.Incident Response Plan (IRP).

D.Network Topology Map.

AnswerC

The Incident Response Plan defines the standardised phases, roles, escalation paths and communication procedures the SOC follows for every identified incident. This satisfies the standardisation requirement by giving analysts one consistent, repeatable process rather than ad hoc handling.

Why this answer

The Incident Response Plan (IRP) is the document that standardizes how a SOC detects, responds to, and recovers from security incidents. It defines roles, escalation paths, communication procedures, and step-by-step playbooks, ensuring a consistent and repeatable response. This makes it the essential reference for incident handling.

Exam trap

SDSI often tests document purpose confusion, and candidates may pick a vulnerability report or topology map because they sound security-related, missing that only the IRP standardizes incident handling.

How to eliminate wrong answers

Option A is wrong because a Vulnerability Assessment Report documents discovered vulnerabilities and risk ratings; it informs remediation but does not standardize incident handling procedures. Option B is wrong because vendor product data sheets describe product features and specifications, not SOC incident response processes. Option D is wrong because a network topology map shows infrastructure layout and can assist troubleshooting, but it does not define incident response roles, escalation, or procedures.

Practice this question →

35

MCQeasy

During a post-incident review, an architect discovers that the SOC could not correlate logs across the Cisco Secure Email and Cisco Secure Endpoint platforms. Which integration should the design specify to improve future incident response?

A.Cisco Webex Control Hub

B.Cisco Security Cloud Control (SecureX)

C.Cisco DNA Center

D.Cisco ThousandEyes

AnswerB

Cisco Security Cloud Control (SecureX) aggregates telemetry from Secure Email and Secure Endpoint into a single console, correlating events across both platforms. This directly resolves the stem's cross-platform visibility gap, enabling the SOC to trace an incident end to end during future investigations.

Why this answer

Cisco Security Cloud Control (formerly SecureX) is the platform that aggregates telemetry from Cisco Secure Email, Secure Endpoint, Secure Firewall, and other products into a unified incident view. It enables cross-platform correlation, threat hunting, and automated response workflows, directly solving the SOC's inability to correlate logs across email and endpoint.

Exam trap

The trap is confusing network management (DNA Center) or monitoring (ThousandEyes) platforms with security telemetry correlation; the correct answer is the security integration fabric, Security Cloud Control/SecureX.

How to eliminate wrong answers

Option A is wrong because Webex Control Hub manages Webex collaboration services, not security telemetry correlation. Option C is wrong because Cisco DNA Center is a network controller/assurance platform for campus and SD-Access, not a security analytics or SIEM integration layer. Option D is wrong because ThousandEyes provides network path and digital experience monitoring, not security event correlation across email and endpoint.

Practice this question →

36

MCQmedium

Which design principle should be followed when implementing micro-segmentation in a data center?

A.Keep all servers in the same VLAN for simplicity.

B.Segment based only on IP addresses.

C.Disable all firewalls for maximum performance.

D.Implement identity-based segmentation at the workload level.

AnswerD

Identity-based segmentation ties policy to workload identity rather than static IP addresses, so rules follow the workload across environments and remain accurate as addresses change. This satisfies the design principle of granular, workload-level control central to effective microsegmentation.

Why this answer

Micro-segmentation is designed to enforce least-privilege east-west traffic controls at the granularity of individual workloads, not network topology. Identity-based segmentation at the workload level ties policy to the workload's identity (labels, tags, service accounts, or attributes) rather than to mutable network constructs like IP addresses or VLANs. This allows policies to follow the workload across hosts, clusters, and clouds, which is the core design principle behind Cisco Secure Workload, ACI, and zero-trust architectures.

Exam trap

The trap here is confusing network segmentation (VLANs, subnets, IP ranges) with micro-segmentation, which is workload-identity-based and enforced at the host or workload level.

How to eliminate wrong answers

Option A is wrong because keeping all servers in one VLAN recreates a flat Layer 2 broadcast domain, which is the exact opposite of micro-segmentation and enables unrestricted lateral movement. Option B is wrong because IP-based segmentation is brittle — IPs change with DHCP, autoscaling, and workload mobility, and it cannot express workload identity or role. Option C is wrong because disabling firewalls removes the enforcement point entirely; micro-segmentation depends on policy enforcement, not on removing it for performance.

Practice this question →

37

MCQeasy

A design requirement for a SOC environment is to have real-time visibility into who is on the network. Which Cisco tool is best for this?

A.Cisco SecureX.

B.Cisco Umbrella.

C.Cisco Firepower Management Center.

D.Cisco Identity Services Engine (ISE).

AnswerD

Cisco Identity Services Engine provides real-time contextual identity data by profiling and authenticating endpoints and users as they connect. This satisfies the visibility requirement, showing who and what is on the network at any moment, which Umbrella or Firepower alone cannot deliver.

Why this answer

Cisco Identity Services Engine (ISE) is the platform that provides real-time visibility into who is on the network by integrating with identity stores (Active Directory, LDAP), profiling endpoints, and enforcing 802.1X/MAB-based access. It continuously tracks authenticated users, device types, and posture, giving SOC teams live contextual awareness of network participants. This makes ISE the correct tool for the stated requirement.

Exam trap

SDSI often tests the confusion between visibility/identity tools (ISE) and threat detection/response tools (SecureX, Umbrella, FMC) — candidates pick a security operations platform when the requirement is specifically real-time identity visibility.

How to eliminate wrong answers

Option A is wrong because Cisco SecureX is a threat detection and response platform that aggregates telemetry and orchestrates security workflows; it does not provide real-time identity-based visibility into who is on the network. Option B is wrong because Cisco Umbrella is a cloud-delivered DNS-layer security and secure web gateway service focused on blocking malicious domains, not on identifying network users. Option C is wrong because Cisco Firepower Management Center manages Firepower NGFW/IPS devices and provides threat and traffic visibility, but it does not deliver identity-based network access visibility like ISE.

Practice this question →

38

MCQeasy

A design requirement specifies that all remote access must be verified through device health checks. Which Cisco tool allows for this posture assessment?

A.Cisco Identity Services Engine (ISE) pxGrid.

B.Cisco Umbrella roaming client.

C.Cisco AnyConnect Secure Client with Compliance Module.

D.Cisco Secure Firewall VPN portal.

AnswerC

The AnyConnect Secure Client Compliance Module performs posture assessment on the endpoint, checking antivirus, patch level and other health criteria before granting access. This satisfies the design requirement that all remote access be verified through device health checks.

Why this answer

Cisco AnyConnect Secure Client with the Compliance Module is the correct answer because it performs endpoint posture assessment before granting remote access. The Compliance Module checks device health attributes such as OS version, antivirus status, and patch level, and reports them to Cisco ISE for policy enforcement. This directly satisfies the requirement that all remote access must be verified through device health checks.

Exam trap

SDSI often tests the confusion between tools that provide security services (like Umbrella or Firewall) and those that perform endpoint posture assessment (like AnyConnect with Compliance Module), so candidates may incorrectly select a tool that sounds security-related but lacks posture capabilities.

How to eliminate wrong answers

Option A is wrong because Cisco ISE pxGrid is a platform for sharing contextual information between security tools, not a posture assessment agent itself; it does not perform device health checks on endpoints. Option B is wrong because Cisco Umbrella roaming client provides DNS-layer security and does not conduct posture assessment or device health verification. Option D is wrong because Cisco Secure Firewall VPN portal is a web-based portal for VPN access and does not include endpoint posture assessment capabilities; it relies on other tools for that function.

Practice this question →

39

MCQhard

An organization experiences a surge in successful phishing attacks. The post-incident architecture adaptation requires automated email analysis. Which Cisco product provides the necessary API for integrating email sandboxing data into a SOAR platform?

A.Cisco Firepower Management Center REST API.

B.Cisco Defense Orchestrator API.

C.Cisco Secure Email API.

D.Cisco Identity Services Engine ERS API.

AnswerC

The Secure Email API exposes sandbox verdicts and message telemetry programmatically, letting the SOAR platform pull detonation results and automate response. This satisfies the requirement for automated email analysis following the phishing surge, which manual submission cannot scale to meet.

Why this answer

Cisco Secure Email (formerly Email Security Appliance) provides a dedicated API that exposes email sandboxing verdicts and threat intelligence, enabling SOAR platforms to automate response actions like quarantining malicious messages. The API specifically supports retrieving detailed analysis from Cisco Advanced Malware Protection (AMP) and Threat Grid sandboxing, which is exactly what's needed for post-incident phishing analysis. Other Cisco APIs focus on different security domains (network, policy orchestration, identity) and lack native email sandboxing data.

Exam trap

SDSI often tests the confusion between network security APIs (Firepower) and email security APIs, so candidates may incorrectly choose Firepower Management Center because it also offers sandboxing integration for files, but it does not handle email-specific sandboxing data.

How to eliminate wrong answers

Option A is wrong because the Firepower Management Center REST API manages network security policies, intrusion events, and firewall logs—not email sandboxing data. Option B is wrong because Cisco Defense Orchestrator is a cloud-based management platform for firewall and security device configuration, not an email security analysis tool. Option D is wrong because the Identity Services Engine ERS API is for identity and access control (e.g., endpoint profiling, guest management), not email threat analysis.

Practice this question →

40

MCQmedium

A requirement for an incident response toolset is the ability to automatically contain a workstation upon detecting a specific malware threat. Which Cisco tool provides this 'isolate' capability?

A.Cisco AnyConnect.

B.Cisco Umbrella roaming client.

C.Cisco Secure Endpoint (AMP).

D.Cisco Secure Firewall.

AnswerC

Cisco Secure Endpoint enforces host isolation by severing all network traffic on the compromised workstation except the management channel to the cloud console, satisfying the automatic containment requirement. Its endpoint agent detects the malware threat and triggers isolation without manual intervention, directly delivering the 'isolate' capability the incident response toolset demands.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) provides endpoint detection and response (EDR) with the ability to isolate a compromised workstation from the network. This 'isolate' capability automatically contains threats upon detection, preventing lateral movement. It is specifically designed for endpoint containment.

Exam trap

SDSI often tests the specific capabilities of Cisco security products; candidates may confuse network-based containment (Firewall) with endpoint isolation (Secure Endpoint).

How to eliminate wrong answers

Option A is wrong because Cisco AnyConnect is a VPN client and does not provide endpoint isolation. Option B is wrong because Cisco Umbrella roaming client provides DNS-layer security but cannot isolate a workstation. Option D is wrong because Cisco Secure Firewall is a network security appliance that can block traffic but does not have direct endpoint isolation capabilities.

Practice this question →

41

Multi-Selecthard

During a risk assessment, which THREE factors are considered critical for determining the design requirements of a secure infrastructure? (Choose three)

Select 3 answers

A.Regulatory and compliance requirements

B.Office physical location and square footage

C.Current threat intelligence and landscape

D.Employee headcount and department budget

E.Criticality of business data and assets

AnswersA, C, E

Regulatory and compliance requirements dictate mandatory controls, data residency, retention, and audit obligations the infrastructure must satisfy. Treating them as a critical factor ensures the design meets legally binding mandates, directly shaping the security requirements derived during risk assessment.

Why this answer

Option A (Regulatory and compliance requirements) is correct because laws and standards such as GDPR, HIPAA, PCI DSS, or ISO 27001 impose mandatory controls (encryption, access logging, retention) that directly shape the architecture and security baselines of the infrastructure. Option C (Current threat intelligence and landscape) is correct because knowing the active threat actors, TTPs, and emerging vulnerabilities (e.g., from MITRE ATT&CK or CVE feeds) determines which defensive controls, segmentation, and monitoring capabilities must be designed in. Option E (Criticality of business data and assets) is correct because classifying data and assets by business impact drives the required protection level, such as tiered controls, redundancy, and recovery objectives (RTO/RPO) for the most critical systems.

Option B is not a security design driver, since office location and square footage are facilities-planning details rather than risk factors affecting control selection. Option D is also not relevant, as headcount and department budget are organizational and financial inputs, not determinants of the technical security requirements themselves.

Exam trap

SDSI often tests the distinction between business operational factors (like office size or headcount) and true security design drivers, tempting candidates to select logistical or budgetary items that feel relevant but do not determine technical security requirements.

Practice this question →

42

MCQmedium

When gathering requirements for a security design, a customer specifies they need to automate the containment of infected endpoints discovered by Cisco Secure Endpoint. Which API integration should the architect document?

A.Cisco Umbrella Investigate API

B.Cisco Secure Endpoint API

C.Cisco Secure Firewall API

D.Cisco ISE REST API

AnswerB

The Cisco Secure Endpoint API exposes endpoints for isolating and unisolating compromised hosts, enabling automated containment. This satisfies the requirement to automate containment of infected endpoints discovered by Secure Endpoint, which manual console action cannot scale to deliver.

Why this answer

The Cisco Secure Endpoint API (formerly AMP for Endpoints) provides programmatic access to endpoint detection and response (EDR) capabilities, including the ability to isolate (contain) an infected endpoint. Since the requirement is to automate containment of endpoints discovered by Cisco Secure Endpoint, the architect must document the Cisco Secure Endpoint API. This API allows security teams to integrate with SIEM/SOAR platforms to trigger isolation actions automatically.

Exam trap

SDSI often tests the confusion between endpoint security APIs and network security APIs, so candidates might mistakenly choose Cisco Umbrella or Cisco ISE for endpoint containment.

How to eliminate wrong answers

Option A is wrong because the Cisco Umbrella Investigate API provides threat intelligence and DNS-layer security insights, not endpoint containment. Option C is wrong because the Cisco Secure Firewall API manages firewall policies and configurations, not endpoint isolation. Option D is wrong because the Cisco ISE REST API is used for network access control and identity management, not for containing endpoints.

Practice this question →

43

MCQmedium

A design requirement for risk mitigation in a data center requires micro-segmentation. Which Cisco technology is specifically designed to provide workload-level segmentation based on identity and policy?

A.Cisco Secure Workload.

B.Cisco Firepower NGFW.

C.Cisco AnyConnect.

D.Cisco TrustSec/SGTs.

AnswerA

Cisco Secure Workload enforces micro-segmentation at the workload level, using identity-based policies and process-level telemetry rather than network topology. This satisfies the stem's requirement for workload-level segmentation, delivering granular east-west control inside the data centre where IP-based rules cannot distinguish individual workloads.

Why this answer

Cisco Secure Workload (formerly Tetration) is specifically designed for micro-segmentation at the workload level, using identity-based policies derived from software agents on servers or agentless methods. It provides visibility into application dependencies and enforces granular segmentation based on workload attributes (e.g., process, user, labels) rather than just network addresses. This makes it the correct choice for a requirement that explicitly calls for workload-level segmentation based on identity and policy.

Exam trap

SDSI often tests the distinction between network-level segmentation (TrustSec/SGTs) and workload-level segmentation (Secure Workload), so candidates may incorrectly choose TrustSec because they associate segmentation with SGTs, missing the workload-specific requirement.

How to eliminate wrong answers

Option B is wrong because Cisco Firepower NGFW is a perimeter-focused next-generation firewall that enforces policy at network boundaries, not at the individual workload level inside the data center. Option C is wrong because Cisco AnyConnect is a VPN client for remote access, providing secure connectivity but not micro-segmentation of workloads. Option D is wrong because Cisco TrustSec/SGTs provide group-based segmentation using tags in the network fabric, but they operate at the network layer and do not offer the workload-level identity and policy granularity that Secure Workload provides.

Practice this question →

44

MCQhard

A design architect is selecting a tool to monitor the security of a hybrid cloud environment. Which Cisco tool provides visibility into both on-premises and cloud (AWS/Azure) traffic flows?

A.Cisco ISE.

B.Cisco Secure Email.

C.Cisco Secure Network Analytics.

D.Cisco Secure Firewall.

AnswerC

Cisco Secure Network Analytics uses flow telemetry from physical and virtual probes, plus cloud connectors, to correlate on-premises and AWS/Azure traffic in one view. This satisfies the stem's hybrid visibility constraint, unlike tools limited to either the data centre or public cloud alone.

Why this answer

Cisco Secure Network Analytics (formerly Stealthwatch) provides network traffic visibility and threat detection across on-premises and hybrid cloud environments, including AWS and Azure. It uses flow telemetry (NetFlow, IPFIX) and behavioral analytics to detect anomalies in both data center and cloud traffic, making it the correct tool for hybrid cloud security monitoring.

Exam trap

SDSI often tests tool-role confusion, and candidates may pick Secure Firewall because it 'sees traffic,' missing that the question asks for visibility and analytics across hybrid cloud, which is Secure Network Analytics' specialty.

How to eliminate wrong answers

Option A is wrong because Cisco ISE is a network access control and identity policy platform for wired, wireless, and VPN access; it does not provide traffic flow visibility into cloud environments. Option B is wrong because Cisco Secure Email focuses on email security (phishing, malware, spam) and does not monitor network traffic flows in hybrid cloud. Option D is wrong because Cisco Secure Firewall enforces policy and inspects traffic at the perimeter or in the cloud, but its primary role is enforcement and inspection, not the broad flow-based visibility and analytics across hybrid environments that Secure Network Analytics provides.

Practice this question →

45

MCQeasy

Which design factor is most important when deploying a large-scale Cisco Secure Firewall cluster?

A.Ensuring all firewalls have the same firmware version.

B.Ensuring adequate load balancing and capacity planning.

C.The color of the patch cables used.

D.The physical location of the firewalls.

AnswerB

A large-scale cluster concentrates enormous concurrent connection volumes, so throughput must be distributed evenly across nodes; without adequate load balancing and capacity planning, individual firewalls saturate, causing asymmetric flows and dropped sessions. This directly satisfies the stem's scale constraint.

Why this answer

In a large-scale Cisco Secure Firewall cluster, the most important design factor is ensuring adequate load balancing and capacity planning, because cluster throughput, session distribution, and failover behavior depend on how traffic is balanced across nodes and whether each node has sufficient CPU, memory, and interface bandwidth. Without proper capacity planning and load distribution, the cluster becomes a bottleneck or experiences asymmetric flows and failover issues. This directly determines whether the cluster meets performance and availability requirements.

Exam trap

SDSI often tests the tendency to pick operational hygiene items (like matching firmware) over architectural factors (load balancing and capacity planning) when asked about the most important design consideration for a large-scale cluster.

How to eliminate wrong answers

Option A is wrong because while consistent firmware across cluster nodes is a best practice for compatibility, it is not the most important design factor for large-scale performance and availability — it is an operational hygiene item, not a capacity/architecture decision. Option C is wrong because patch cable color is irrelevant to firewall cluster design and performance. Option D is wrong because while physical location matters for latency and redundancy (e.g., across data centers), it is secondary to ensuring the cluster has adequate load balancing and capacity to handle traffic; location alone does not determine cluster scalability.

Practice this question →

46

Multi-Selecthard

Which TWO Cisco technologies should be used to protect a data center against lateral movement of threats?

Select 2 answers

A.Cisco Umbrella.

B.Cisco Secure Network Analytics (Stealthwatch).

C.Cisco Secure Email.

D.Cisco AnyConnect.

E.Cisco Secure Workload (Tetration).

AnswersB, E

Cisco Secure Network Analytics applies behavioural analytics and flow telemetry to detect anomalous east-west traffic inside the data centre. It satisfies the lateral-movement constraint by identifying compromised hosts communicating unusually, enabling rapid containment before threats spread across segmented workloads.

Why this answer

Cisco Secure Network Analytics (Stealthwatch) (B) is correct because it uses NetFlow/IPFIX telemetry and behavioral analytics to detect anomalous east-west traffic inside the data center, which is exactly how lateral movement between workloads appears. Cisco Secure Workload (Tetration) (E) is correct because it provides microsegmentation and workload-level policy enforcement based on application dependencies, allowing you to block unauthorized host-to-host communication that lateral movement relies on. Together these two address detection and prevention of lateral threat movement within the data center.

Cisco Umbrella (A) is DNS-layer security focused on internet-bound resolution, not internal east-west traffic. Cisco Secure Email (C) protects against email-borne threats at the gateway, unrelated to lateral movement. Cisco AnyConnect (D) is a VPN/remote-access client for securing user connectivity, not for containing internal data center threats.

Exam trap

The trap is picking edge or user-focused tools (Umbrella, AnyConnect, Secure Email) for an internal east-west problem — candidates forget that lateral movement happens inside the data center, where flow analytics and workload micro-segmentation are the right controls.

Practice this question →

47

MCQmedium

Which Cisco feature is used to ensure that only authorized devices can connect to the network?

A.Cisco Umbrella.

B.Cisco ISE (802.1X).

C.Cisco Firepower IPS.

D.Cisco Stealthwatch.

AnswerB

Cisco ISE with 802.1X authenticates each device before granting network access, enforcing identity-based admission control at the port or wireless layer. This directly satisfies the requirement that only authorised devices connect, since unauthenticated endpoints are denied access rather than merely monitored.

Why this answer

Cisco ISE with 802.1X provides port-based network access control that authenticates devices and users before granting network access. It enforces identity-based policies so only authorized devices (validated via certificates, credentials, or MAB) can connect, making it the correct feature for ensuring only authorized devices join the network.

Exam trap

SDSI often tests the difference between visibility/detection tools (Stealthwatch, Umbrella, Firepower IPS) and access-control tools (ISE 802.1X) — candidates pick a security product that sounds comprehensive but does not actually authorize devices at the access layer.

How to eliminate wrong answers

Option A is wrong because Cisco Umbrella is a DNS-layer security and secure web gateway service — it blocks malicious domains but does not control which devices can connect to the network. Option C is wrong because Cisco Firepower IPS inspects traffic for threats and can block exploits, but it does not perform network admission control or device authentication at the access layer. Option D is wrong because Cisco Stealthwatch (Secure Network Analytics) is a network traffic analysis and anomaly detection tool — it provides visibility and threat detection, not access control or device authorization.

Practice this question →

48

Multi-Selecthard

Which TWO Cisco products are used to monitor and detect threats in a network environment?

Select 2 answers

A.Cisco Secure Network Analytics (Stealthwatch).

B.Cisco Secure Email.

C.Cisco ISE.

D.Cisco AnyConnect.

E.Cisco Secure Firewall (IPS).

AnswersA, E

Secure Network Analytics (Stealthwatch) uses NetFlow and telemetry to baseline traffic and detect anomalies such as beaconing, exfiltration, and lateral movement across the network. This satisfies the requirement to monitor and detect threats in the environment.

Why this answer

Cisco Secure Network Analytics (Stealthwatch) (A) is correct because it uses NetFlow and flow telemetry with behavioral analytics and machine learning to continuously monitor network traffic and detect anomalies, insider threats, and malware command-and-control activity. Cisco Secure Firewall (IPS) (E) is correct because its Intrusion Prevention System inspects traffic inline against signatures and behavioral policies to detect and block exploits, malicious payloads, and known attack patterns. Cisco Secure Email (B) is not a network monitoring/detection product in this context; it focuses on securing email communications (spam, phishing, malware filtering) rather than monitoring network traffic for threats.

Cisco ISE (C) is a policy and identity/access-control platform (802.1X, profiling, posture, guest access), not a threat monitoring/detection tool. Cisco AnyConnect (D) is a VPN/remote-access client providing secure connectivity, not network threat monitoring or detection.

Exam trap

SDSI often tests whether candidates can distinguish detection/monitoring products (Stealthwatch, IPS) from access control (ISE), email security (Secure Email), and endpoint VPN (AnyConnect) — the trap is selecting any Cisco security product as a 'threat detection' tool without checking its actual function.

Practice this question →

49

MCQmedium

A security architect is reviewing the risk register for a financial services network. A new risk has been identified: unmanaged IoT devices on the corporate LAN could be used as pivot points to reach PCI-scoped servers. The business has mandated that the design must prevent any communication between IoT endpoints and PCI zones, even if the IoT devices are compromised. Which Cisco ISE design element should the architect include to enforce this segmentation requirement?

A.Security Group Tags (SGTs) with enforcement on Cisco Catalyst switches using SGACL policies

B.802.1X with MAC Authentication Bypass (MAB) to profile and authorize IoT devices

C.Cisco TrustSec policy with Security Group ACLs applied on the Cisco Secure Firewall

D.Change of Authorization (CoA) to dynamically reassign IoT devices to a quarantine VLAN

AnswerA

SGTs assign a tag to IoT endpoints via ISE and enforce SGACLs on network devices, blocking traffic to PCI-tagged resources. This provides scalable, identity-based micro-segmentation without relying on IP addresses, directly meeting the requirement to prevent any communication between IoT and PCI zones.

Why this answer

The requirement is to prevent any communication between IoT and PCI zones, even if IoT devices are compromised. Security Group Tags (SGTs) with SGACL enforcement on Cisco Catalyst switches provide identity-based micro-segmentation directly on the network fabric, ensuring that traffic from IoT-tagged devices to PCI-tagged resources is blocked regardless of IP address changes. This is a core Cisco TrustSec design pattern for regulatory compliance and least-privilege access.

Exam trap

The trap here is assuming that authentication or quarantine alone provides segmentation, when in fact only a policy enforcement mechanism like SGACLs can block specific group-to-group traffic.

Practice this question →

50

MCQhard

An organization experiences a breach where a malicious file was downloaded. Which Cisco product can be used to perform 'retrospective' analysis on that file's history across the organization?

A.Cisco Stealthwatch.

B.Cisco Secure Endpoint (AMP).

C.Cisco Secure Email.

D.Cisco Umbrella.

AnswerB

Cisco Secure Endpoint retains file trajectory and prevalence data, letting analysts retrospectively trace a malicious file's history and affected hosts across the organisation. This retrospective hunting capability directly matches the stem's requirement after the download breach.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) maintains a cloud-based file reputation and retrospective analysis capability. When a file is later determined to be malicious, Secure Endpoint can retroactively query its telemetry to identify every endpoint where that file was seen, enabling retrospective detection and response. Stealthwatch is network flow analytics, Secure Email handles email-borne threats, and Umbrella is DNS-layer security — none provide endpoint file-history retrospective analysis.

Exam trap

The trap is confusing network-layer visibility (Stealthwatch, Umbrella) with endpoint file-history retrospective analysis; the exam wants you to associate 'retrospective' with Secure Endpoint/AMP.

How to eliminate wrong answers

Option A is wrong because Cisco Stealthwatch is a network traffic and flow analytics platform (NetFlow/IPFIX) that detects anomalies, not a file-history retrospective analysis tool. Option C is wrong because Cisco Secure Email inspects email messages and attachments at the gateway, but does not maintain endpoint file execution history for retrospective queries. Option D is wrong because Cisco Umbrella provides DNS-layer security and secure web gateway functions, not endpoint file retrospective analysis.

Practice this question →

51

Multi-Selectmedium

Which THREE factors influence the design of a SOC incident response plan?

Select 3 answers

A.Regulatory compliance requirements (e.g., GDPR).

B.The personal hobbies of the SOC analysts.

C.The price of the office furniture.

D.The technical capabilities of the security product stack.

E.The business impact of downtime for critical services.

AnswersA, D, E

Regulatory compliance requirements such as GDPR dictate mandated breach notification timelines, evidence retention and reporting obligations. These legal constraints directly shape incident response plan design, forcing defined escalation paths and documentation standards that the SOC must follow during and after an incident.

Why this answer

Option A is correct because regulatory compliance requirements such as GDPR, HIPAA, or PCI DSS impose mandatory breach notification timelines, data-handling rules, and documentation duties that the incident response plan must explicitly address. Option D is correct because the technical capabilities of the security product stack — for example, whether the SOC has EDR, SIEM correlation, SOAR playbook automation, or network forensics — directly determine which detection, containment, and eradication actions the plan can realistically execute. Option E is correct because the business impact of downtime for critical services drives incident severity classification, prioritization, and recovery time objectives (RTOs), ensuring response efforts protect the most vital business functions first.

Option B does not belong because analysts' personal hobbies are irrelevant to professional incident response design, and Option C does not belong because office furniture pricing has no bearing on security, compliance, or business continuity considerations in a SOC plan.

Exam trap

SDSI often tests which factors are relevant to SOC design, so candidates may pick distractors that sound plausible but are unrelated to security, compliance, or business impact.

Practice this question →

52

MCQhard

During a post-incident review, an architect identifies that Cisco Stealthwatch (Secure Network Analytics) failed to alert on lateral movement due to lack of visibility. Which design modification is required to ensure visibility into internal east-west traffic?

A.Update the Cisco Secure Endpoint policy to scan memory more frequently on all endpoints.

B.Enable NetFlow export from core and distribution layer switches to the Stealthwatch Flow Collector.

C.Increase the logging interval on the perimeter Cisco Firepower Management Center.

D.Integrate the Cisco ISE platform via pxGrid to force all internal hosts to re-authenticate.

AnswerB

Stealthwatch derives its analytics from flow telemetry, so east-west visibility depends on NetFlow exported from core and distribution switches to the Flow Collector. Without that export, internal lateral movement generates no flow records, leaving the gap identified in the review unaddressed.

Why this answer

Stealthwatch (Cisco Secure Network Analytics) relies on flow telemetry—primarily NetFlow/IPFIX—to build its behavioral baselines and detect anomalies such as lateral movement. Without flow export from internal Layer 3 boundaries (core and distribution switches), the Flow Collector only sees perimeter traffic and cannot observe east-west conversations between internal hosts. Enabling NetFlow export from those switches feeds the Flow Collector the internal flow records needed to detect anomalous host-to-host behavior.

Exam trap

SDSI often tests the misconception that endpoint agents or identity platforms (ISE/pxGrid) provide network flow visibility—candidates must remember Stealthwatch is a flow-based NDR tool that depends on NetFlow/IPFIX from network devices, not endpoint or identity telemetry.

How to eliminate wrong answers

Option A is wrong because Secure Endpoint is an endpoint detection and response (EDR) agent that inspects files, processes, and memory on hosts—it does not provide network flow visibility into east-west traffic and cannot feed Stealthwatch's flow analytics. Option C is wrong because increasing logging on the perimeter Firepower Management Center only enriches perimeter firewall logs; it does nothing to expose internal switch-to-switch or host-to-host traffic flows. Option D is wrong because ISE pxGrid integration provides identity, posture, and SGT context for policy enforcement, not the raw flow telemetry Stealthwatch needs to detect lateral movement.

Practice this question →

53

Multi-Selectmedium

Which THREE items should be included in a 'Security Design Requirements' document?

Select 3 answers

A.The preferred color scheme for the SOC monitors.

B.List of all potential threat actors and their motivations.

C.Latency requirements for critical business applications.

D.The salary information of the security team.

E.Regulatory compliance requirements (e.g., GDPR, HIPAA).

AnswersB, C, E

Documenting potential threat actors and their motivations scopes the design against realistic adversaries, such as insiders, organised crime or nation-states. This satisfies the requirements document's purpose by tying controls to the threats the organisation actually faces.

Why this answer

Option B is correct because a Security Design Requirements document must identify the threat landscape it is designed to defend against, so enumerating potential threat actors (e.g., nation-state APTs, insider threats, hacktivists) and their motivations (financial gain, espionage, disruption) directly informs the selection of controls, monitoring use cases, and risk prioritization. Option C is correct because latency requirements for critical business applications are a functional constraint that security controls (such as TLS inspection, WAF, DLP, or zero-trust proxies) must respect; documenting acceptable thresholds (e.g., sub-50 ms response time) ensures security architecture does not break business performance SLAs. Option E is correct because regulatory compliance requirements such as GDPR, HIPAA, PCI DSS, or SOX define mandatory legal and contractual controls (data residency, encryption, breach notification timelines, access logging) that the security design must satisfy, making them a core input to the requirements baseline.

Option A is not correct because monitor color schemes are a facilities or ergonomics preference, not a security design requirement. Option D is not correct because security team salary information is an HR and payroll matter and has no bearing on the technical or procedural design of security controls.

Exam trap

SDSI often tests whether candidates can distinguish genuine design requirements from operational or HR trivia, so distractors like monitor colors or salaries are included to see if you apply the right criteria.

Practice this question →

54

MCQeasy

What is the primary role of Cisco Secure Firewall in a network design?

A.To act as a core network switch.

B.To manage user credentials.

C.To provide internet access for all users.

D.To provide traffic inspection, filtering, and access control.

AnswerD

Traffic inspection, filtering and access control are the firewall's core enforcement functions, satisfying the design requirement for stateful segmentation between trust zones. It examines flows against policy and permits or denies them, which is the primary role a Secure Firewall plays in any network design.

Why this answer

Cisco Secure Firewall (formerly Firepower) is a next-generation firewall whose primary role is to inspect traffic, enforce access control policies, and filter based on L3/L4/L7 attributes, application identity, and threat intelligence. It provides stateful inspection, IPS, URL filtering, and application control, making it the enforcement point for network security policy.

Exam trap

SDSI often tests whether candidates confuse the firewall's security enforcement role with connectivity or management functions — candidates pick 'provide internet access' because firewalls are at the edge, but the exam expects you to identify inspection, filtering, and access control as the primary role.

How to eliminate wrong answers

Option A is wrong because a firewall is not a switch — core network switching is handled by Catalyst/Nexus switches; firewalls operate at the network edge or between zones and do not provide high-density L2 switching. Option B is wrong because managing user credentials is the role of identity systems like ISE or Active Directory, not the firewall (though the firewall can consume identity data for policy). Option C is wrong because providing internet access is a routing/NAT function that may involve the firewall, but it is not the primary role — the primary role is security inspection and control, not connectivity.

Practice this question →

55

MCQmedium

A security architect is adapting a design post-incident after a credential theft event. Which Cisco ISE feature should be integrated into the architecture to mitigate the risk of compromised static credentials?

A.Deploying Cisco pxGrid to share user identity info with the firewall.

B.Configuring Cisco TrustSec to segment user traffic based on IP address.

C.Implementing Cisco AnyConnect Device Posture assessment.

D.Enabling MFA integration with Cisco Duo via RADIUS.

AnswerD

Integrating Cisco Duo MFA via RADIUS into Cisco ISE adds a possession or biometric factor at authentication, so a stolen static password alone cannot grant access. This directly mitigates the credential-theft risk described in the post-incident scenario.

Why this answer

Credential theft of static passwords is best mitigated by adding a second authentication factor that cannot be replayed or stolen alongside the password. Integrating Cisco Duo MFA with ISE via RADIUS enforces a second factor (push, TOTP, biometric) at authentication time, so a stolen password alone is insufficient to gain access. This directly addresses the post-incident risk described.

Exam trap

SDSI often tests whether candidates confuse identity sharing (pxGrid), segmentation (TrustSec), or posture (AnyConnect) with actual MFA — the trap is picking a feature that sounds security-related but does not add a second authentication factor.

How to eliminate wrong answers

Option A is wrong because pxGrid shares identity/context information with ecosystem partners (e.g., firewalls) for policy enforcement — it does not add an authentication factor and would not stop a stolen password from being used. Option B is wrong because TrustSec segmentation based on IP address is about micro-segmentation and policy enforcement, not credential protection; moreover, TrustSec uses SGTs, not IP addresses, as its primary construct. Option C is wrong because AnyConnect Device Posture assesses the endpoint's compliance (AV, patches, etc.) — it does not add a second authentication factor and would not mitigate stolen static credentials by itself.

Practice this question →

56

MCQhard

Which tool provides visibility into encrypted traffic without full decryption in a Cisco network design?

A.Cisco Encrypted Traffic Analytics (ETA).

B.Cisco Firepower IPS.

C.Cisco Identity Services Engine (ISE).

D.Cisco Stealthwatch.

AnswerA

Cisco Encrypted Traffic Analytics satisfies the visibility-without-decryption constraint by analysing packet metadata, sequence patterns and initial handshake fields to detect malware in TLS flows. It identifies threats without terminating or decrypting sessions, preserving privacy and performance where full inspection is impractical.

Why this answer

Cisco Encrypted Traffic Analytics (ETA) is designed to identify malware and threats in encrypted traffic without full decryption by using flow metadata, sequence of packet lengths and times (SPLT), and machine learning. It leverages Cisco's Talos threat intelligence and can run on Catalyst switches and ISR/ASR routers. Firepower IPS, ISE, and Stealthwatch do not provide ETA's decryption-free encrypted traffic analysis.

Exam trap

The trap is assuming deep inspection requires decryption; the exam tests that ETA provides encrypted traffic visibility without decryption, and candidates often pick Firepower IPS by default.

How to eliminate wrong answers

Option B is wrong because Cisco Firepower IPS typically requires decryption (SSL/TLS inspection) to inspect encrypted payloads deeply; it does not natively provide decryption-free encrypted traffic analytics. Option C is wrong because Cisco ISE is an identity and access control platform, not an encrypted traffic analysis tool. Option D is wrong because Cisco Stealthwatch analyzes network flows for anomalies but does not perform ETA-style decryption-free malware detection in encrypted traffic.

Practice this question →

57

MCQmedium

A design architect is updating an incident response strategy. What is the role of the 'Post-Incident Architecture Adaptation' phase?

A.To document the costs of the incident.

B.To update the network documentation for the next annual audit.

C.To discipline employees who caused the incident.

D.To identify and implement changes to prevent recurrence of the incident.

AnswerD

This phase reviews root cause and control gaps exposed during the incident, then feeds architectural changes back into the design so the same attack path cannot be exploited again. It closes the response loop by preventing recurrence.

Why this answer

The Post-Incident Architecture Adaptation phase is where lessons learned from an incident are translated into concrete architectural and policy changes to prevent recurrence. It is not about cost accounting, audit documentation, or HR discipline — it is about feeding findings back into the design so the same class of incident is mitigated or eliminated. This aligns with the NIST IR lifecycle 'lessons learned' and continuous improvement stages.

Exam trap

The trap is treating post-incident activities as administrative (cost, audit, discipline) rather than architectural; the exam wants you to recognize that this phase is about design changes to prevent recurrence.

How to eliminate wrong answers

Option A is wrong because documenting incident costs is a financial/after-action reporting activity, not an architectural adaptation phase. Option B is wrong because updating network documentation for an annual audit is a compliance housekeeping task, not the purpose of adapting architecture post-incident. Option C is wrong because disciplining employees is an HR/management function and has nothing to do with architectural change; the phase is about technical and procedural improvements.

Practice this question →

58

MCQhard

Following a major data exfiltration incident, the design team needs to adapt the architecture to prevent lateral movement. Which Cisco Secure Firewall design modification is most effective for mitigating this risk while maintaining operational performance?

A.Enable all IPS signatures in blocking mode

B.Transition to transparent mode

C.Increase firewall inspection timeouts

D.Implement SGT-based micro-segmentation

AnswerD

Security Group Tag-based micro-segmentation enforces least-privilege flows between internal workloads, so a compromised host cannot reach unrelated segments. This directly limits lateral movement after exfiltration while preserving performance, since policy is applied by tag rather than by costly full traffic inspection.

Why this answer

SGT-based micro-segmentation using Cisco TrustSec assigns Security Group Tags to workloads and enforces policy based on those tags rather than IP addresses. This allows the firewall to apply granular east-west controls that prevent lateral movement between compromised and target systems, while keeping policy scalable and operationally efficient. It directly addresses lateral movement risk without the performance penalty of inspecting every signature.

Exam trap

SDSI often tests the confusion between IPS signature tuning (which addresses known threats) and micro-segmentation (which addresses lateral movement), tempting candidates to pick the 'more security' option rather than the architecturally correct one.

How to eliminate wrong answers

Option A is wrong because enabling all IPS signatures in blocking mode increases false positives and CPU load, and IPS signatures do not provide the identity-based east-west segmentation needed to stop lateral movement. Option B is wrong because transparent mode is a Layer 2 deployment mode that changes how the firewall is inserted, not how policy is enforced, so it does not mitigate lateral movement. Option C is wrong because increasing inspection timeouts only affects how long sessions are tracked; it does nothing to restrict traffic between internal segments.

Practice this question →

59

MCQmedium

An organization is updating its SOC incident response toolset. Which Cisco technology provides the ability to perform 'retrospective security' by tracking files that have entered the network in the past?

A.Cisco Secure Network Analytics (Stealthwatch).

B.Cisco Firepower IPS.

C.Cisco Secure Endpoint (AMP).

D.Cisco Umbrella.

AnswerC

Cisco Secure Endpoint continuously records file trajectory and prevalence data, letting analysts retrospectively query files that traversed the network previously and retroactively quarantine them. This satisfies the stem's requirement to track files that entered the network in the past.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) is built on a continuous file-tracking and retrospective-analysis model: every file that enters an endpoint is fingerprinted (SHA-256) and recorded in the cloud, so when new threat intelligence arrives, the system can retroactively query its historical file database and flag files that were previously deemed clean. This 'retrospective security' capability is the defining feature of the AMP/Secure Endpoint architecture and is what allows the SOC to identify past compromises without re-scanning every host.

Exam trap

The trap here is confusing network-visibility tools (Stealthwatch, Umbrella, Firepower) with endpoint file-tracking tools; candidates who equate 'tracking files' with 'inspecting network traffic' will pick Firepower or Stealthwatch instead of Secure Endpoint.

How to eliminate wrong answers

Option A is wrong because Cisco Secure Network Analytics (Stealthwatch) performs network-flow-based anomaly detection and behavioral analytics using NetFlow/IPFIX, but it does not maintain a historical file reputation database capable of retroactively reclassifying files that already entered the network. Option B is wrong because Cisco Firepower IPS is an inline prevention/detection engine that inspects traffic in real time; it does not store file trajectory records for retrospective lookup. Option D is wrong because Cisco Umbrella provides DNS-layer security and secure web gateway functions, blocking malicious domains at resolution time, but it has no file-tracking or retrospective file-reputation capability.

Practice this question →

60

MCQmedium

A security design requires that all outbound traffic be inspected for malware. Which Cisco solution feature should be included to achieve this at the DNS layer?

A.Cisco AnyConnect VPN tunnel.

B.Cisco Identity Services Engine.

C.Cisco Secure Firewall IPS.

D.Cisco Umbrella DNS-layer security.

AnswerD

Cisco Umbrella resolves DNS requests through its cloud infrastructure, blocking malicious domains before any connection is established, so outbound traffic is inspected at the DNS layer rather than only at the perimeter. This satisfies the stem's requirement to inspect all outbound traffic for malware.

Why this answer

Cisco Umbrella DNS-layer security is specifically designed to block malicious domains and IPs at the DNS resolution stage, before a connection is even established. It inspects DNS queries from all users and devices, regardless of location, and enforces security policies by redirecting malicious requests to a block page. This directly satisfies the requirement to inspect outbound traffic for malware at the DNS layer, as it stops threats like malware callbacks, phishing, and command-and-control communications early in the kill chain.

Exam trap

SDSI often tests the distinction between network-layer inspection (firewall/IPS) and DNS-layer security, causing candidates to overlook that DNS-layer blocking occurs before any connection is made and is not provided by traditional firewalls or VPNs.

How to eliminate wrong answers

Option A is wrong because Cisco AnyConnect VPN tunnel provides encrypted remote access but does not inherently inspect DNS traffic for malware; it secures the transport, not the content. Option B is wrong because Cisco Identity Services Engine is a network access control and policy platform for authentication and authorization, not a DNS-layer security inspection tool. Option C is wrong because Cisco Secure Firewall IPS inspects traffic at the network layer (IP/port/protocol) and application layer, but it does not operate at the DNS layer to block malicious domain resolutions before a connection is made.

Practice this question →

61

Multi-Selecthard

A security architect is designing a risk mitigation strategy for a multinational enterprise that uses Cisco Secure Firewall, Cisco ISE, and Cisco Secure Endpoint. The business requires that the design must detect and block advanced threats that evade traditional signature-based defenses, and must also provide detailed forensics for post-incident analysis. Which two Cisco design components should be included to meet these requirements? (Choose two.)

Select 2 answers

A.Cisco Identity Services Engine (ISE) with posture assessment and profiling

B.Cisco Secure Network Analytics (Stealthwatch) for network traffic analysis and anomaly detection

C.Cisco Secure Firewall with Snort 3 IPS and file policy for malware detection

D.Cisco Umbrella with DNS-layer security and intelligent proxy

E.Cisco Secure Endpoint with Exploit Prevention and Cisco SecureX threat response integration

AnswersB, E

Cisco Secure Network Analytics uses NetFlow and advanced analytics to detect anomalies and advanced threats that bypass signature-based defenses. It provides detailed flow records and forensic data, enabling post-incident analysis. This directly addresses the need for detection of evasive threats and forensics.

Why this answer

To detect and block advanced threats that evade signature-based defenses and provide detailed forensics, the design must include network traffic analysis and endpoint detection and response. Cisco Secure Network Analytics delivers network-wide anomaly detection and forensic flow data, while Cisco Secure Endpoint with Exploit Prevention and SecureX integration blocks endpoint threats and enriches forensics. Together they cover network and endpoint vectors, meeting both requirements.

Exam trap

The trap here is selecting a firewall or DNS security component as the primary advanced threat detection solution, overlooking the need for network traffic analytics and endpoint forensics to catch evasive threats.

Practice this question →

62

MCQmedium

Following a ransomware incident, an architect must modify the network segmentation strategy. What is the most effective approach to mitigate lateral movement using Cisco TrustSec?

A.Deploy extended ACLs on every core switch port to block peer-to-peer traffic.

B.Configure static port-security across the entire enterprise to prevent unauthorized devices.

C.Implement SGT-based micro-segmentation at the access layer to enforce policies based on identity rather than IP.

D.Transition all physical cabling to private VLANs without leveraging SGTs.

AnswerC

Security Group Tags decouple policy from IP addressing, letting TrustSec enforce least-privilege segmentation between workloads based on identity and role. Applied at the access layer, this contains compromised hosts and blocks the east-west lateral movement ransomware relies on.

Why this answer

Implementing SGT-based micro-segmentation at the access layer with Cisco TrustSec enforces policies based on identity (security group tags) rather than IP addresses, which effectively mitigates lateral movement by restricting communication between groups even within the same VLAN. This approach is dynamic and scalable, allowing granular control that follows the workload or user, not the IP.

Exam trap

The trap is opting for traditional segmentation methods like ACLs or private VLANs; candidates may overlook that TrustSec's SGT-based approach provides identity-based, scalable micro-segmentation that is specifically designed to stop lateral movement.

How to eliminate wrong answers

Option A is wrong because extended ACLs on core switch ports are static, IP-based, and difficult to manage at scale; they do not provide identity-based segmentation and can be bypassed by IP changes. Option B is wrong because static port-security prevents unauthorized devices but does not segment traffic between authorized devices, so lateral movement is still possible. Option D is wrong because private VLANs without SGTs provide Layer 2 isolation but lack the identity-based policy enforcement and scalability of TrustSec; they also require manual configuration and do not integrate with dynamic environments.

Practice this question →

63

MCQmedium

Which risk assessment methodology is best suited to guide a design modification for a cloud-native architecture relying on Cisco Secure Cloud Analytics?

A.ISO 27002 implementation guide.

B.OWASP Top 10 for all infrastructure components.

C.PCI-DSS compliance checklist.

D.NIST SP 800-30 for conducting the assessment.

AnswerD

NIST SP 800-30 provides a structured risk assessment process covering threat identification, likelihood, impact and risk determination, which suits evaluating a design modification for cloud-native architecture monitored by Secure Cloud Analytics. Its qualitative and quantitative approaches accommodate cloud-specific threat sources and vulnerabilities.

Why this answer

NIST SP 800-30 is a risk assessment methodology specifically designed to guide the assessment process, including identifying threats, vulnerabilities, likelihood, and impact. For a cloud-native architecture using Cisco Secure Cloud Analytics, it provides a structured approach to evaluate risks and inform design modifications. It is vendor-neutral and applicable to cloud environments.

Exam trap

SDSI often tests the difference between compliance checklists and risk assessment methodologies, so candidates who pick ISO 27002 or PCI-DSS confuse control frameworks with the actual assessment process.

How to eliminate wrong answers

Option A is wrong because ISO 27002 is an implementation guide for security controls, not a risk assessment methodology; it tells you what controls to consider, not how to conduct the assessment. Option B is wrong because OWASP Top 10 is a list of common web application vulnerabilities, not a comprehensive risk assessment methodology for infrastructure. Option C is wrong because PCI-DSS is a compliance checklist for payment card data, not a general risk assessment framework, and it may not apply to all cloud-native architectures.

Practice this question →

64

MCQmedium

A security architect is designing a SOC response workflow using Cisco SecureX Orchestration. Which mechanism is most effective for automated remediation of an endpoint identified as compromised via Cisco Secure Endpoint?

A.Triggering a workflow that executes the isolate endpoint action in Cisco Secure Endpoint via API.

B.Deploying an umbrella policy change to redirect the host traffic to a sinkhole.

C.Configuring a local script on the Cisco ASA to block the host IP address.

D.Using Cisco Defense Orchestrator to push a new access control policy to the endpoint.

AnswerA

SecureX Orchestration calls the Cisco Secure Endpoint API to run the isolate endpoint action, immediately cutting the host off from the network while preserving forensic state. This satisfies the requirement for automated remediation of a compromised endpoint.

Why this answer

Cisco SecureX Orchestration is designed to automate security workflows across Cisco and third-party products. The most direct and effective remediation for a compromised endpoint identified by Cisco Secure Endpoint is to isolate the endpoint using its native API. The isolate endpoint action in Secure Endpoint cuts off all network communication except for the management connection to the Secure Endpoint cloud, preventing lateral movement and data exfiltration while allowing further investigation.

This is a built-in, automated response that can be triggered via SecureX Orchestration, making it the correct choice.

Exam trap

SDSI often tests the distinction between endpoint-level remediation (native to Secure Endpoint) and network-level controls (Umbrella, ASA, CDO), so candidates may incorrectly choose a network-based solution when the question specifically asks for automated remediation of an endpoint identified via Cisco Secure Endpoint.

How to eliminate wrong answers

Option B is wrong because deploying an Umbrella policy change to redirect host traffic to a sinkhole is a network-level DNS or web proxy control, not an endpoint isolation mechanism; it does not prevent the compromised host from communicating over non-DNS protocols or to IP addresses directly, and it requires the host to use Umbrella for DNS resolution, which may not be the case. Option C is wrong because configuring a local script on the Cisco ASA to block the host IP address is a manual, perimeter-based mitigation that only blocks traffic at the firewall, not on the endpoint itself; the endpoint can still communicate laterally within the same network segment or via other paths, and this approach is not automated through SecureX Orchestration. Option D is wrong because Cisco Defense Orchestrator is a cloud-based management platform for firewall and security policies, not an endpoint remediation tool; pushing an access control policy to an endpoint is not a native capability of CDO, and it does not provide the immediate isolation that Secure Endpoint's isolate action does.

Practice this question →

65

MCQeasy

What is the primary goal of the 'Requirement Gathering' phase in the Cisco security design process?

A.To install the hardware.

B.To define the business and technical requirements for the security system.

C.To document the budget only.

D.To troubleshoot existing issues.

AnswerB

Requirement Gathering captures what the business needs and what the technical environment must support before any design work begins. This defines the scope, constraints and success criteria that every later phase — architecture, design and implementation — is measured against, ensuring the security system addresses real organisational needs rather than assumed ones.

Why this answer

The Requirement Gathering phase in the Cisco security design process is the foundational step where the security team collaborates with stakeholders to identify and document both business and technical requirements. This includes understanding business objectives, regulatory compliance needs, risk tolerance, and operational constraints, which then inform the technical specifications for the security system. Without this phase, the design lacks alignment with organizational goals and may fail to address critical security gaps.

Exam trap

SDSI often tests the distinction between phases of the Cisco security design process, and candidates may confuse Requirement Gathering with implementation or troubleshooting tasks, leading them to select options that describe later phases.

How to eliminate wrong answers

Option A is wrong because installing hardware occurs during the implementation or deployment phase, not during requirement gathering. Option C is wrong because documenting the budget is only one small part of requirement gathering; the phase encompasses a broader set of business and technical requirements, not just financial aspects. Option D is wrong because troubleshooting existing issues is part of operations and maintenance, not the initial design phase where the goal is to define requirements for a new or updated security system.

Practice this question →

66

MCQhard

A security design architect needs to ensure that all endpoints have the latest malware signatures. Which tool provides continuous, automated updates?

A.Cisco Secure Firewall.

B.Cisco ISE.

C.Cisco Secure Endpoint.

D.Cisco Umbrella.

AnswerC

Cisco Secure Endpoint cloud console continuously pushes signature and engine updates to enrolled endpoints without manual intervention, ensuring every agent holds current malware detection content, which satisfies the requirement for continuous automated signature updating across all endpoints.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) is the endpoint detection and response (EDR) agent that continuously updates malware signatures and cloud-based threat intelligence on managed endpoints. Its cloud reputation engine and signature sets are pushed automatically without administrator intervention, satisfying the requirement for continuous, automated updates.

Exam trap

SDSI often tests the distinction between network-layer security products (Firewall, Umbrella) and host-layer endpoint agents (Secure Endpoint), so candidates who see 'malware' and reflexively pick a firewall or DNS security tool get burned.

How to eliminate wrong answers

Option A is wrong because Cisco Secure Firewall is a network perimeter/inspection platform (NGFW/IPS) that does not install endpoint agents or manage host-based malware signatures. Option B is wrong because Cisco ISE is a network access control and policy platform for identity/802.1X, not an endpoint malware-signature distribution tool. Option D is wrong because Cisco Umbrella is a DNS-layer and secure web gateway service that blocks malicious domains but does not push malware signatures to endpoint operating systems.

Practice this question →

67

MCQmedium

A security architect is developing a requirements document for a SOC. Which Cisco capability allows the SOC to prioritize alerts by correlating threats across network, endpoint, and cloud?

A.Cisco SecureX cross-product correlation.

B.Cisco Stealthwatch alert grouping.

C.Cisco Secure Firewall management center alert correlation.

D.Cisco Identity Services Engine monitoring.

AnswerA

SecureX ingests telemetry from Cisco Secure Firewall, Secure Endpoint and Umbrella, then applies cross-product correlation to surface a single prioritised alert, satisfying the SOC's requirement to correlate threats across network, endpoint and cloud rather than triaging each console separately.

Why this answer

Cisco SecureX is the platform that aggregates and correlates threat intelligence and events across Cisco's portfolio — network (Secure Firewall, Umbrella), endpoint (Secure Endpoint), and cloud (Umbrella, cloud security) — into a single ribbon and threat response view. Its cross-product correlation is what lets a SOC prioritize alerts by seeing that an endpoint detection, a network flow, and a cloud log all relate to the same threat. The other options are single-domain tools that lack cross-domain correlation.

Exam trap

The trap is selecting a domain-specific tool (Stealthwatch, FMC, ISE) that correlates within its own silo, when the question explicitly requires cross-domain (network + endpoint + cloud) correlation.

How to eliminate wrong answers

Option B is wrong because Stealthwatch (now Secure Network Analytics) groups network flow alerts but does not correlate endpoint or cloud telemetry. Option C is wrong because Secure Firewall Management Center correlates events only within the firewall/IPS domain, not across endpoint and cloud. Option D is wrong because ISE monitors identity and network access events, not threats across network, endpoint, and cloud.

Practice this question →

68

MCQmedium

Which Cisco product is best for enforcing security policy based on the user's AD group membership?

A.Cisco Umbrella.

B.Cisco Secure Firewall.

C.Cisco Identity Services Engine (ISE).

D.Cisco Stealthwatch.

AnswerC

Cisco Identity Services Engine integrates with Active Directory, importing user and group attributes, then applies those groups within authorisation policies for wired, wireless and VPN access. This satisfies the requirement to enforce network policy based on AD group membership rather than IP address alone.

Why this answer

Cisco Identity Services Engine (ISE) is the product designed to enforce security policy based on user identity and AD group membership. ISE integrates with Active Directory to retrieve group memberships and uses that information in authorization policies, which can then be enforced on network devices via RADIUS, TrustSec, or pxGrid. This makes ISE the correct choice for identity-based policy enforcement tied to AD groups.

Exam trap

The trap is confusing enforcement with visibility — candidates pick Secure Firewall or Stealthwatch because they enforce or monitor traffic, but only ISE natively maps AD group membership to authorization policy.

How to eliminate wrong answers

Option A is wrong because Cisco Umbrella provides DNS-layer security and secure web gateway functions, not AD group-based policy enforcement. Option B is wrong because Cisco Secure Firewall enforces firewall and IPS policy but relies on ISE or AD Agent for identity context; it does not natively enforce AD group membership by itself. Option D is wrong because Cisco Stealthwatch is a network traffic analysis and anomaly detection tool, not a policy enforcement engine for AD group membership.

Practice this question →

69

MCQmedium

Which risk assessment technique involves evaluating the impact of an attack on the confidentiality, integrity, and availability of an asset?

A.CIA Triad Impact Assessment.

B.SWOT Analysis.

C.Network Penetration Testing.

D.Cost-Benefit Analysis.

AnswerA

The CIA Triad Impact Assessment maps each identified threat against confidentiality, integrity and availability, quantifying business harm per asset. This directly satisfies the stem's requirement to evaluate attack impact across those three security objectives, producing the risk ratings that drive subsequent control selection.

Why this answer

The CIA Triad Impact Assessment evaluates how an attack would degrade Confidentiality, Integrity, and Availability of a specific asset, which is the standard qualitative/quantitative risk technique for scoring asset-level impact. It directly maps threat events to business impact on the three core security pillars, producing the impact half of a risk calculation (Risk = Likelihood × Impact).

Exam trap

The trap here is confusing broad strategic or testing frameworks (SWOT, pen testing, cost-benefit) with the specific CIA-impact scoring technique that risk assessments use to quantify asset damage.

How to eliminate wrong answers

Option B is wrong because SWOT Analysis is a strategic business planning framework (Strengths, Weaknesses, Opportunities, Threats) that assesses organizational positioning, not the CIA impact of an attack on an asset. Option C is wrong because Network Penetration Testing is an active technical validation exercise that discovers and exploits vulnerabilities — it identifies weaknesses but does not itself quantify CIA impact on an asset. Option D is wrong because Cost-Benefit Analysis compares the monetary cost of a control against its expected benefit; it is a financial justification tool, not an impact-assessment technique for confidentiality, integrity, and availability.

Practice this question →

70

MCQhard

When conducting a risk assessment, what is the best way to determine the value of an asset to the organization?

A.Perform a Business Impact Analysis (BIA).

B.Check the manufacturer's list price.

C.Ask the IT department for their opinion.

D.Check the hardware replacement cost.

AnswerA

A Business Impact Analysis quantifies how disruption to each asset affects critical business processes, translating technical assets into financial and operational terms. This gives the risk assessment an objective, business-driven asset value rather than relying on subjective technical judgement, satisfying the stem's requirement for determining organisational value.

Why this answer

A Business Impact Analysis (BIA) is the formal process for determining the criticality and value of assets by assessing the operational, financial, legal, and reputational impact of their loss or disruption. It identifies critical business functions, dependencies, and recovery objectives (RTO/RPO), which directly translate into asset value for risk assessment. Manufacturer price, IT opinion, and hardware replacement cost reflect only acquisition cost, not business value.

Exam trap

The trap is equating asset value with acquisition or replacement cost, when risk assessment requires business impact — candidates pick the tangible cost option instead of the BIA.

How to eliminate wrong answers

Option B is wrong because manufacturer list price reflects purchase cost, not the business impact of losing the asset; a cheap server hosting a critical database is far more valuable than its price. Option C is wrong because IT opinion is subjective and may not reflect business priorities or regulatory impact. Option D is wrong because hardware replacement cost ignores downtime, data loss, and reputational damage, which are often the dominant components of asset value.

Practice this question →

71

Multi-Selecthard

To ensure effective post-incident architecture adaptation, which THREE items must be included in the design documentation for future reference? (Choose three)

Select 3 answers

A.User password policies

B.Modified security policy logic

C.Log correlation and alert rules

D.Hardware rack elevation diagrams

E.Automated response orchestration workflows

AnswersB, C, E

Recording modified security policy logic preserves the reasoning behind post-incident changes, letting architects trace which rules were altered, why, and how they affect future designs, which is essential for adapting the architecture after subsequent incidents.

Why this answer

Option B (Modified security policy logic) is correct because post-incident architecture adaptation requires documenting how security policies were changed in response to the incident, so future teams understand the rationale and can maintain or evolve those controls. Option C (Log correlation and alert rules) is correct because the detection engineering artifacts—correlation rules, thresholds, and alert logic—must be captured to preserve the improved detection capability and enable tuning after the incident. Option E (Automated response orchestration workflows) is correct because SOAR/automation playbooks encode the validated response actions and must be documented so the orchestration can be reused, audited, and updated as the architecture changes.

Option A (User password policies) is not a post-incident architecture adaptation artifact; password policy is a standing access-control baseline, not incident-derived design documentation. Option D (Hardware rack elevation diagrams) is physical infrastructure documentation unrelated to adapting the architecture based on incident lessons.

Exam trap

The trap is selecting generic IT documentation (password policies, rack diagrams) that sounds like 'documentation' but has no relationship to incident-driven architecture adaptation; the exam tests whether you understand that only detection, policy, and response artifacts are relevant.

Practice this question →

72

Multi-Selectmedium

A SOC manager requests a design that simplifies the incident investigation process. Which TWO Cisco tools should the design include for improved correlation of network traffic and endpoint events? (Choose two)

Select 2 answers

A.Cisco DNA Spaces

B.Cisco Secure Network Analytics

C.Cisco Smart Licensing

D.Cisco Nexus Dashboard

E.Cisco Secure Endpoint

AnswersB, E

Secure Network Analytics supplies the network side of the correlation: flow telemetry from NetFlow and IPFIX, behavioural analytics and detections that reveal anomalous traffic and command-and-control activity. Combined with endpoint telemetry, it lets investigators pivot between network and host evidence, satisfying the stem's correlation requirement.

Why this answer

Cisco Secure Network Analytics (formerly Stealthwatch) is correct because it provides network traffic visibility and behavioral analytics, using flow telemetry (NetFlow/IPFIX) and entity modeling to detect and correlate suspicious network activity across the infrastructure, which directly supports incident investigation. Cisco Secure Endpoint (formerly AMP for Endpoints) is correct because it delivers endpoint detection and response telemetry—file trajectory, process lineage, and threat verdicts—that can be correlated with network events to reconstruct an incident's scope and root cause. Together these two tools give the SOC the network-plus-endpoint correlation the manager requested.

Cisco DNA Spaces is a location analytics and indoor positioning platform, not a security correlation tool, so it does not belong. Cisco Smart Licensing is a license management framework and Cisco Nexus Dashboard is a data center operations and automation console, neither of which correlates network traffic with endpoint events.

Exam trap

SDSI often tests which Cisco tools are used for security correlation versus other purposes (e.g., location analytics, licensing, data center management). Candidates may pick tools that sound relevant but lack security correlation capabilities.

Practice this question →

73

MCQeasy

A security designer is choosing a tool for DNS-layer security. Which Cisco product is the standard choice?

A.Cisco Secure Endpoint.

B.Cisco Umbrella.

C.Cisco ISE.

D.Cisco Secure Firewall.

AnswerB

Cisco Umbrella resolves DNS requests through its global cloud infrastructure, blocking malicious domains and IPs before a connection is established. This satisfies the DNS-layer security requirement by enforcing policy at resolution time, covering roaming users and all device types without on-premises appliances.

Why this answer

Cisco Umbrella is Cisco's cloud-delivered DNS-layer security platform, blocking malicious domains and IPs before a connection is established. It is the standard Cisco product for DNS-layer security, providing recursive DNS with threat intelligence from Cisco Talos. This makes it the correct choice for DNS-layer protection.

Exam trap

The trap is confusing DNS-layer security with endpoint or firewall security; candidates may pick Secure Endpoint or Secure Firewall because they also block malicious traffic, but Umbrella is the dedicated DNS-layer product.

How to eliminate wrong answers

Option A is wrong because Cisco Secure Endpoint is an endpoint detection and response (EDR) product, not a DNS-layer security service. Option C is wrong because Cisco ISE is an identity and access control platform (NAC, 802.1X, profiling), not DNS security. Option D is wrong because Cisco Secure Firewall is a network firewall/IPS platform; while it can inspect DNS, it is not the dedicated DNS-layer security product that Umbrella is.

Practice this question →

74

Multi-Selectmedium

Which THREE steps are required for a successful security design process?

Select 3 answers

A.Ignoring all existing network infrastructure.

B.Developing a detailed architectural plan and implementation roadmap.

C.Requirements gathering from stakeholders.

D.Purchasing the most expensive hardware available.

E.Performing a risk assessment of the current environment.

AnswersB, C, E

A detailed architectural plan and implementation roadmap translates approved security requirements into concrete designs, control placements and sequenced deployment activities. It satisfies the design process step that moves from analysis into documented, actionable build guidance, ensuring controls are integrated rather than retrofitted.

Why this answer

Option B is correct because a security design must translate requirements and risk findings into a detailed architectural plan and an implementation roadmap that sequences controls, technologies, and milestones. Option C is correct because requirements gathering from stakeholders establishes business, regulatory, and operational needs that drive the security architecture and ensure alignment with organizational objectives. Option E is correct because performing a risk assessment of the current environment identifies assets, threats, vulnerabilities, and existing controls, providing the baseline needed to prioritize security measures.

Option A is incorrect because ignoring existing network infrastructure discards critical context such as topology, legacy systems, and existing controls, which undermines any realistic design. Option D is incorrect because purchasing the most expensive hardware is not a design step and does not guarantee security; solutions should be selected based on requirements and risk, not cost alone.

Exam trap

SDSI often tests whether candidates recognize the disciplined methodology (requirements → risk → architecture/roadmap) versus distractor 'shortcut' answers like ignoring existing infrastructure or buying the most expensive gear.

Practice this question →

75

Multi-Selecthard

Which TWO methods are used by Cisco Stealthwatch to detect anomalies in network traffic?

Select 2 answers

A.Signature-based matching for every packet.

B.Deep packet inspection of every payload byte.

C.Behavioral baseline modeling of host and network patterns.

D.Analysis of NetFlow, IPFIX, and other flow telemetry.

E.Manual input of all known malicious IP addresses.

AnswersC, D

Stealthwatch builds behavioural baselines of normal host and network activity, then flags deviations such as unusual data volumes, new peer connections or off-hours transfers. This detects anomalies without relying on static signatures, catching threats that match no known pattern.

Why this answer

Cisco Stealthwatch detects anomalies primarily through behavioral baseline modeling (option C), which learns normal host and network communication patterns over time and then flags deviations such as unusual traffic volumes, new peer connections, or atypical protocol usage. It also relies on analysis of NetFlow, IPFIX, and other flow telemetry (option D), since flow records exported by routers and switches provide the scalable metadata Stealthwatch uses for visibility and threat detection. These two methods work together: flow telemetry supplies the data, and behavioral baselining turns it into anomaly alerts.

Signature-based matching for every packet (A) and deep packet inspection of every payload byte (B) describe intrusion prevention or full-packet inspection approaches, not Stealthwatch's flow-based analytics. Manual input of all known malicious IP addresses (E) is not a detection method, as Stealthwatch does not depend on manually enumerating every bad IP.

Exam trap

The trap is conflating Stealthwatch with a signature-based IPS or DPI tool — candidates pick 'signature matching' or 'deep packet inspection' because those sound like security detection, but Stealthwatch's power is behavioral analytics on flow data.

Practice this question →

Page 1 of 2 · 79 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Risk Events And Requirements questions.

Start 20-question session