Cisco Designing Cisco Security Infrastructure 300-745 SDSI Exam Questions

Answer : C

A flow collector (such as Cisco Secure Network Analytics, formerly Stealthwatch) is a critical tool within a Security Operations Center (SOC) for providing 'pervasive visibility' into the network. Instead of capturing every full packet---which is resource-intensive---a flow collector ingests NetFlow or IPFIX data, which contains metadata like source/destination IPs, ports, and the volume of data transferred.

The SOC leverages this data for threat detection and response by establishing a baseline of normal network behavior. When a flow collector identifies an anomaly---such as an endpoint suddenly sending gigabytes of data to an unusual external IP (data exfiltration) or scanning internal ports (lateral movement)---it flags the incident for analysis. Unlike Real-time content filtering (Option D), which happens at the gateway (e.g., Cisco Umbrella or WSA), flow collectors provide a historical record and behavioral analysis of all internal and external traffic. They do not perform load balancing (Option B) or backup/recovery (Option A). In the Cisco SDSI framework, flow analysis is essential for identifying the 'unknown unknowns' and providing the forensic evidence needed to understand the scope and path of a security breach.

Answer : A

The spread of malware across a sensitive segment like the management network highlights a failure in host-level security and internal visibility. To detect and mitigate the spread of such threats and protect the overall network, Endpoint Detection and Response (EDR) is the most effective choice among the options. In the Cisco security ecosystem, the endpoint is often the last line of defense and the most critical source of telemetry for malware incidents.

By deploying an EDR solution like Cisco Secure Endpoint, the manufacturing company gains the ability to identify the 'patient zero' of the infection. EDR uses advanced features like Device Traversal and Lateral Movement detection to see how malware moves from one machine to another over the management network. Once detected, the security team can use the EDR platform to initiate a 'host isolation' command, effectively cutting off the infected device's communication with the rest of the network without physically unplugging it. While Encrypted Threat Analytics (ETA) (Option C) is a powerful network-based feature for detecting malware in encrypted traffic without decryption, EDR provides the most granular control and response capabilities specifically for malware residing on and spreading between hosts. RADIUS (Option B) and IPsec VPNs (Option D) focus on access control and encryption of data in transit, respectively, but do not provide the behavioral analysis needed to stop a running malware outbreak once the network has already been accessed.

Answer : B

In a microservices-based architecture, applications are typically packaged into containers to ensure consistency across different environments. According to the Designing Cisco Security Infrastructure (SDSI) objectives, securing the software development lifecycle (SDLC) requires integrating security checks as far 'left' as possible. Container scanning is the specific technique used during the build phase to inspect container images for known software vulnerabilities (CVEs) within the bundled libraries, binaries, and dependencies.

When a developer initiates a build, the container scanning tool cross-references the layers of the image against vulnerability databases. If a high-risk vulnerability is detected in a base image or a third-party library, the build can be automatically failed, preventing the vulnerable code from ever reaching the registry or production environment. This directly addresses the product manager's goal of ensuring known vulnerabilities are not introduced. While Secret Detection (Option A) is vital for finding leaked API keys or passwords, and Infrastructure as Code (IaC) scanning (Option C) ensures the environment configuration is secure, neither specifically targets the software vulnerabilities within the application package itself. Similarly, Open API specification analysis (Option D) focuses on the contract and security of the interface rather than the underlying software vulnerabilities. By implementing container scanning, organizations align with Cisco's DevSecOps framework, which emphasizes automated, policy-driven security within the CI/CD pipeline to maintain the integrity of cloud-native applications.

Answer : B

The spread of malicious content between endpoints is a classic case of lateral movement. To control and restrict communication between individual endpoints---regardless of their physical location or IP address---Cisco TrustSec is the recommended architectural approach. TrustSec moves away from traditional, IP-based Access Control Lists (ACLs), which are difficult to manage and scale, and instead uses Scalable Group Tags (SGTs).

With TrustSec, every endpoint is assigned an SGT based on its role or security context (e.g., 'Employee,' 'Contractor,' or 'HR'). Security policies are then defined in a centralized matrix (the egress policy matrix) that dictates which SGTs can talk to one another. For example, a policy can be set so that endpoints in the 'Developer' group cannot communicate directly with endpoints in the 'Sales' group, effectively preventing malware from hopping between machines. While RADIUS (Option A) is the protocol used for authentication, it does not perform the segmentation itself. Posture (Option C) checks the health of the device, and Profiling (Option D) identifies what the device is, but neither provides the policy-based traffic control of TrustSec. By implementing TrustSec, the company achieves micro-segmentation, significantly reducing the internal attack surface and containing potential breaches within a single group, which is a core goal of modern secure infrastructure design.

Answer : D

According to the Cisco SDSI v1.0 objectives, Artificial Intelligence and Machine Learning (ML) provide significant benefits in automating the identification of complex security weaknesses. One of the primary benefits is the ability of AI to perform Encrypted Threat Analytics (ETA). AI models can analyze the metadata and initial handshake patterns of encrypted traffic---without needing to decrypt it---to identify vulnerabilities associated with weak TLS algorithms or outdated cipher suites.

By recognizing specific fingerprints in the TLS handshake, AI-driven tools can alert administrators to non-compliant encryption standards that might be susceptible to interception. While AI is a powerful force multiplier, it does not replace a comprehensive defense-in-depth strategy (Option B); rather, it enhances it. It does not directly speed up data transmission (Option A), as that is a function of hardware and bandwidth. Furthermore, while AI helps mitigate DDoS attacks, it rarely provides 'complete' protection (Option C) on its own, as DDoS mitigation requires a multi-layered approach involving massive bandwidth and specialized scrubbing. The ability to identify cryptographic weaknesses at scale is a core functional benefit of AI in modern security infrastructure, aligning with the Cisco goal of maintaining a hardened and compliant network posture through automated visibility.

Answer : A

The scenario described---where high CPU utilization prevents administrators from accessing device management interfaces---is a classic indication that the device's Control Plane is being overwhelmed by malicious or malformed traffic (such as a DoS attack or a routing loop). To protect the 'brains' of the network device, Control Plane Policing (CoPP) must be implemented.

CoPP allows an engineer to define filter and rate-limit policies specifically for traffic destined for the CPU. By categorizing traffic into different classes (e.g., routing protocols, management traffic like SSH, and 'catch-all' untrusted traffic), CoPP ensures that critical management and control traffic is prioritized while excessive or suspicious traffic is dropped before it can impact the device's performance. This maintains operational efficiency even during a traffic spike or attack. While AAA (Option B) handles authentication and RBAC (Option D) manages permissions once a user is logged in, neither can prevent the CPU exhaustion that blocks the login attempt in the first place. SNMP (Option C) is used for monitoring but does not provide active traffic policing. Within the Cisco SDSI framework, CoPP is a fundamental 'Self-Defending Network' feature required to ensure the availability and resilience of the core infrastructure.

========

Answer : A

In a DevSecOps environment, 'shifting left' means identifying risks before a single line of application code is even executed. Open API Specification (OAS) Analysis is a proactive technique where the 'contract' of the API (the YAML or JSON file defining its endpoints, methods, and data structures) is audited for security flaws.

By analyzing the OAS, security tools can proactively identify if 'destructive' methods---like DELETE or PATCH---lack proper authorization scopes or if sensitive fields (like PII or passwords) are being exposed in responses where they shouldn't be. This allows the developer to 'score' the risk based on the API's design before moving into the implementation phase.

While SAST (Static Application Security Testing) (Option B) is vital for finding vulnerabilities in written source code, it occurs after the code is written. SBOM (Software Bill of Materials) Generation (Option C) tracks third-party libraries but doesn't analyze API logic. CSPM (Cloud Security Posture Management) (Option D) focuses on the misconfiguration of the cloud infrastructure (like open S3 buckets) rather than the internal logic of the API itself. OAS Analysis specifically addresses the developer's need to validate access controls and sensitive data handling during the design and definition stage of API development.