A manufacturing company experienced a security breach that resulted in sales data being compromised. An engineer participating in the investigation must identify who logged into the sales system during the affected period. Which approach must be used to gather the information?
Answer : C
In the aftermath of a security breach, forensic investigators rely on the Accounting portion of AAA (Authentication, Authorization, and Accounting) to reconstruct a timeline of events. While Authentication verifies identity and Authorization defines permissions, Accounting is the specific framework used to track user activity, including login/logout times and the specific commands executed during a session.
According to Cisco Security Infrastructure design objectives, implementing a centralized AAA solution (such as Cisco Identity Services Engine (ISE) or a TACACS+/RADIUS server) is critical for accountability. In this scenario, the engineer would query the AAA logs to identify exactly 'who' accessed the sales system during the compromise period. SNMP (Option A) is primarily for network monitoring and performance data, not granular user access logs. NACM (Option B) is an access control model for NETCONF but doesn't provide the broad auditing required here. PKI (Option D) provides the certificates used for digital signatures and encryption but does not log the historical 'session' data needed for the investigation. Therefore, AAA is the fundamental architectural requirement for ensuring non-repudiation and providing the audit trail necessary to satisfy risk management and incident response requirements.
========
Question 2
A financial company is in the process of upgrading network access across the entire company. The solution must ensure: least privilege access control access across different network segments and increased security for employees. Which solution approach must the company take?
Answer : D
In the architecture of a modern secure infrastructure, achieving least privilege is a foundational requirement, especially for a financial institution where data sensitivity is high. Role-Based Access Control (RBAC) is the specific methodology used to restrict network access based on the roles of individual users within an enterprise. By implementing RBAC, the security team can ensure that employees only have access to the specific network segments and resources necessary for their job functions, effectively minimizing the internal attack surface.
Within the Cisco Security ecosystem, RBAC is often operationalized through tools like Cisco Identity Services Engine (ISE) using Scalable Group Tags (SGTs). Instead of relying on static IP addresses or complex Access Control Lists (ACLs) that are difficult to maintain across different segments, RBAC allows for dynamic policy enforcement. For example, a 'Financial Auditor' role would automatically be granted access to the accounting segment but blocked from the development segment, regardless of where they plug into the network. While PKI (Option C) provides strong authentication and encryption, and NetFlow (Option A) provides visibility, neither inherently defines the 'least privilege' permission structure. RBAC is the architectural approach that directly maps business requirements to technical access policies, ensuring that security is maintained across segmented environments as required by the Cisco SDSI objectives for secure infrastructure design.
========
Question 3
A retail company is facing a series of cyberattacks targeting web servers, which results in disruptions to online services. Upon investigation, the security team identified that these attacks involved invalid HTTP request headers, which were used to exploit vulnerabilities in the web application. To safeguard the company websites against similar threats in the future, the security team must deploy a security solution specifically designed to detect and block such malicious web traffic. Which security product must be used to protect the websites from similar attacks?
Answer : C
The cyberattacks described target the application layer (Layer 7), specifically exploiting vulnerabilities through malformed HTTP headers. A Web Application Firewall (WAF) is the specialized security solution required to mitigate these threats. Unlike standard firewalls that inspect traffic at the network and transport layers (IPs and Ports), a WAF performs deep inspection of HTTP/HTTPS traffic.
A WAF---such as those integrated into the Cisco Secure Firewall or cloud-native WAF services---understands the structure of web requests. It can identify and block sophisticated attacks like SQL injection, Cross-Site Scripting (XSS), and the specific 'invalid HTTP request headers' mentioned in the scenario. By applying a set of rules (often based on the OWASP Top 10), the WAF filters out malicious requests before they reach the web server. Antivirus software (Option A) and Host-based firewalls (Option D) protect the server's operating system from malware and unauthorized connections but cannot inspect the logic of a web request. A Traditional Firewall (Option B) would simply see the traffic as 'allowed' on Port 443 and pass it through. Implementing a WAF is a critical architectural requirement in the Cisco SDSI 'Applications' domain to protect customer-facing web services from exploitation.
Question 4
What does watermarking AI generated content prevent?
Answer : B
In the realm of Artificial Intelligence and DevSecOps, watermarking is a critical security technique used to identify the origin of synthetic media. As generative AI models become increasingly sophisticated, they can create highly realistic images, videos, and audio clips---often referred to as deep fakes. These deep fakes pose a significant risk to organizational security and public trust, as they can be used for sophisticated social engineering attacks, such as impersonating executives in 'Business Email Compromise' (BEC) scenarios or spreading misinformation.
By embedding a cryptographic or perceptible watermark into AI-generated content, security systems and users can verify the authenticity and provenance of the media. This proactive measure helps prevent the successful deployment of deep fakes by making it easier for automated security tools to flag synthetic content that lacks a valid 'signature' of origin. While watermarking does not inherently stop the creation of harmful content (Option C) or reduce resource consumption (Option A), it provides a layer of accountability and verification. Similarly, scale changes (Option D) are technical image manipulations that watermarking does not prevent. Within the Cisco SDSI framework, watermarking is viewed as an essential component of the AI security lifecycle, ensuring that generative technologies are used responsibly and that synthetic content is distinguishable from genuine data.
========
Question 5
A global energy company moved a monolithic application from the data center to public cloud. Over time, the company added many capabilities to the application, and it is now difficult for the application team to scale it. The application owner decided to modernize the application by moving to a Kubernetes cluster. However, he wants to ensure that the new application architecture provides a container network interface that is scalable, offers options for cloud-native security, and helps with visibility and observability. Which solution must be used to accomplish the task?
Answer : B
In the realm of modern application security and Kubernetes networking, Cilium has emerged as the industry-standard Container Network Interface (CNI) that leverages eBPF (extended Berkeley Packet Filter) technology. For a global company modernizing a monolithic app into microservices, Cilium provides the required scalability and high-performance networking by operating directly within the Linux kernel.
Unlike traditional Security Groups (Option A) which are often limited to IP-based rules at the cloud infrastructure level, or ENIs (Option C) which are AWS-specific hardware interfaces, Cilium provides identity-aware security. It understands Kubernetes labels and metadata, allowing for granular Layer 7 policy enforcement. Furthermore, Cilium addresses the 'visibility and observability' requirement through its Hubble component, which provides deep insights into network flows, application dependencies, and security events without the overhead of traditional sidecar proxies. An Ingress Gateway (Option D) manages external traffic entering the cluster but does not provide the comprehensive pod-to-pod networking, eBPF-based security, or internal observability that a CNI like Cilium offers. Designing with Cilium aligns with Cisco's focus on cloud-native security and the use of eBPF for distributed firewalling and telemetry in modern application environments.
========
Question 6
A company has been facing recurring issues with SQL injection vulnerabilities affecting the products, leading to significant disruptions for customers. To address the security concerns proactively, the company wants to integrate a tool into the CI/CD pipeline. The tool must be capable of identifying vulnerabilities such as SQL injection early in the development process, which allows developers to rectify issues before the code is deployed. Which solution must be implemented to meet the requirement?
Answer : A
In the framework of the Designing Cisco Security Infrastructure (300-745 SDSI) curriculum, the 'Shift-Left' security strategy is fundamental to modern DevSecOps. To identify vulnerabilities like SQL injection at the earliest possible stage---specifically before the code is even compiled or deployed---Static Application Security Testing (SAST) is the required solution. SAST tools analyze the application's source code, byte code, or binaries without actually executing the program.
By integrating SAST tools like Checkmarx or SonarQube into the CI/CD pipeline, the security team can automate the scanning of every code commit or pull request. These tools use sophisticated algorithms to trace data flows and identify dangerous patterns, such as user-controlled input being concatenated directly into SQL queries without proper sanitization or parameterization. This proactive approach allows developers to receive immediate feedback within their native workflow, enabling them to fix security flaws before they progress into later, more expensive stages of the development lifecycle.
In contrast, Dynamic Application Security Testing (DAST) (Option D) requires a running instance of the application and typically occurs much later in the pipeline, such as during the testing or staging phase. While DAST is excellent for finding runtime vulnerabilities, it does not meet the requirement of identifying issues 'early in the development process' as effectively as SAST. Build log observability tools (Option B) and workflow automation platforms (Option C) provide infrastructure and visibility but do not possess the specialized engine required to perform deep code analysis for application-layer vulnerabilities like SQL injection. Implementing SAST ensures that security is a foundational element of the code-writing phase, aligning with Cisco's vision for a secure, automated software supply chain.
Question 7
An employee of a pharmaceutical company accidentally checked in code that contains AWS secret keys to a public GitHub repository, which exposes production resources to attackers. Which mitigation strategy must a security engineer recommend to prevent future reoccurrence?
Answer : D
Accidental exposure of sensitive credentials, such as API keys or AWS secrets, is a major risk in modern DevOps environments. To prevent such incidents from occurring, the most effective technical control is the implementation of a Source Code Management (SCM) precommit hook. A precommit hook is a script that runs locally on a developer's machine before a commit is finalized and pushed to a remote repository.
According to Cisco's DevSecOps design principles, precommit hooks can be configured to scan the code for specific patterns that resemble secrets (e.g., regex for AWS Access Key IDs). If the scanner detects a secret, it automatically aborts the commit, forcing the developer to remove or properly encrypt the sensitive data before the code can leave their local machine. This provides an immediate 'shift-left' safety net that stops the leak at the source.
While a Web Application Firewall (WAF) (Option A) protects against external attacks and Port Security (Option B) manages Layer 2 access, neither can prevent a developer from pushing code to GitHub. A phishing education campaign (Option C) is beneficial for general security awareness but does not provide the automated, technical enforcement required to block credential leakage. By configuring precommit hooks, the pharmaceutical company establishes a proactive defense mechanism that significantly reduces the risk of credential exposure and aligns with the automation objectives of the Cisco SDSI curriculum.
All Official Question Types