Free Designing Cisco Security Infrastructure Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Designing Cisco Security Infrastructure practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A web application requires passwordless authentication that also resists credential phishing. Which Duo authentication design meets both requirements?

   1. A. SMS passcodes following a directory password
   2. B. FIDO2 passkeys with user verification
   3. C. Unverified push following a directory password
   4. D. Voice callback following a directory password

   Answer: B

   Explanation: Duo lists "Phishing-resistant FIDO2 passkey authentication." FIDO2 passkeys meet the stated passwordless and phishing-resistance requirements; password-plus-SMS, ordinary push, and callback retain the password-based design.

   Reference: Duo Passwordless — Overview; Why Go Passwordless?; Supported Authentication Methods

2. 2Managed browsers report an untrusted issuer only when FTD Decrypt–Resign is enabled. The external site's certificate is valid, and the inspection CA is missing from client trust stores. Which change enables the intended inspection without disabling certificate validation?

   1. A. Add the inspection CA only to FTD's trusted-server CA list
   2. B. Replace the external site's valid server certificate
   3. C. Distribute the inspection CA to managed client trust stores
   4. D. Generate a new self-signed inspection CA on FTD

   Answer: C

   Explanation: Cisco directs administrators to "add the CA certificate to the organization's domain root trusted certificates store or the client trusted certificates store." Clients must trust the CA signing the substituted certificate. FTD's own server-validation trust list serves a different trust direction; replacing a valid external certificate or generating another untrusted inspection CA does not establish client trust in the re-signing issuer.

   Reference: Cisco Secure Firewall Decryption Policy Guidance — Special Considerations — Browser Errors related to Untrusted Certificates

3. 3A SOC receives related detections from email security, endpoint protection, and network monitoring. How does Cisco XDR help analysts investigate the combined attack?

   1. A. It groups incidents only by the product that originated each event
   2. B. It aggregates alerts by severity without linking their shared entities
   3. C. It correlates related events into incidents across integrated products
   4. D. It keeps cross-product event associations only in analysts' notes

   Answer: C

   Explanation: Cisco describes XDR as "utilizing powerful event correlation capabilities to produce detailed incidents that pull data from multiple security products." It automatically combines related evidence and entities across integrations. Product-only grouping, severity-only aggregation, and associations confined to manual notes do not describe that cross-product incident correlation.

   Reference: Cisco Breach Protection Suite Design Guide — Breach Protection Suite Product Capabilities — Extended Detection and Response

4. 4A network security team wants machine-learning-assisted threat detection in encrypted flows while preserving payload confidentiality. What role can Cisco Encrypted Traffic Analytics perform?

   1. A. Terminate TLS sessions to inspect their plaintext payloads
   2. B. Analyze enhanced flow telemetry without bulk decryption
   3. C. Classify encrypted application behavior solely by destination port
   4. D. Match plaintext content signatures directly against ciphertext

   Answer: B

   Explanation: Cisco states, "the integrity of the encrypted traffic is maintained because there is no need for bulk decryption." ETA analyzes enhanced telemetry with security analytics. TLS termination is a different inspection approach; destination-port-only classification omits ETA's enhanced flow features, and plaintext content signatures cannot directly inspect encrypted payload content.

   Reference: Encrypted Traffic Analytics with the New Cisco Network and Secure Network Analytics At-a-Glance — Encrypted traffic analytics — enhanced telemetry and analytics

5. 5An organization uses Duo Advantage and Universal Prompt. It wants suspicious authentication attempts to trigger stronger authentication while leaving normal attempts under the usual factor policy. Which approach meets this requirement?

   1. A. Extend the fixed remembered-device duration
   2. B. Allow SMS as the only authentication method
   3. C. Apply Risk-Based Factor Selection policies
   4. D. Keep ordinary push as the only permitted factor

   Answer: C

   Explanation: Duo states, "Duo Risk-Based Factor Selection analyzes authentication requests and adaptively enforces the most secure factors in response to risk." This provides the requested adaptive step-up. A fixed duration and fixed factor choices do not adapt authentication strength to detected risk.

   Reference: Duo Risk-Based Authentication — Overview; Risk-Based Factor Selection

6. 6A native application pins its server certificate and fails when FTD re-signs that certificate. The application cannot be changed, and approved policy permits a targeted decryption exception. Which design preserves this application's connectivity?

   1. A. Exempt the pinned application from outbound decryption
   2. B. Use a different inspection CA to re-sign the pinned certificate
   3. C. Renew the inspection CA while retaining certificate substitution
   4. D. Increase the connection timeout while retaining re-signing

   Answer: A

   Explanation: Cisco states that with pinning and outbound decryption, "the client application does not accept the server certificate causing the TLS connection to fail." The approved targeted exception avoids substitution. A different CA, renewed CA, or longer timeout does not satisfy a pin to the original certificate.

   Reference: Cisco Secure Firewall Decryption Policy Guidance — Special Considerations — Exceptions from Decryption

7. 7In a Cisco XDR investigation, an analyst pivots on a suspicious file hash and an IP address. How are these raw elements classified in the guide's incident model?

   1. A. Observables
   2. B. Indicators
   3. C. Response actions
   4. D. Incident priorities

   Answer: A

   Explanation: Cisco states, "Observables are the raw elements used as indicators in the reporting products". Its examples include IP addresses and file hashes. Indicators are the actual detections, while response actions and priorities represent different parts of incident handling.

   Reference: Cisco Breach Protection Suite Design Guide — Cisco XDR Validation Tests — Test Case #1, Incident Manager Workflow, Step 5

8. 8An encrypted-traffic analytics model needs the sizes and interarrival timing of the first several packets in a flow. Which ETA telemetry element provides those features?

   1. A. Sequence of Packet Lengths and Times
   2. B. Byte distribution
   3. C. TLS-specific handshake features
   4. D. Initial Data Packet extraction

   Answer: A

   Explanation: Cisco states, "SPLT conveys the length (number of bytes) of each packet’s application payload for the first several packets of a flow, along with the interarrival times of those packets". SPLT supplies the requested sequence. Byte distribution describes byte-value probabilities, TLS-specific features describe handshake properties, and Initial Data Packet extraction obtains the first packet rather than the requested multi-packet timing sequence.

   Reference: Encrypted Traffic Analytics with the New Cisco Network and Secure Network Analytics At-a-Glance — Encrypted traffic analytics — 1. Sequence of Packet Lengths and Times

9. 9A file initially passes inspection on a managed laptop but later exhibits malicious behavior. Which endpoint protection capability addresses this change in disposition?

   1. A. Retrospective detection using recorded file activity
   2. B. A one-time reputation check limited to download time
   3. C. A static allowlist based on the original file verdict
   4. D. A rescan that skips files previously marked clean

   Answer: A

   Explanation: Cisco states, "If at a later date a file behaves suspiciously, Cisco Secure Endpoint retrospectively detects it and sends an alert." Continuous recorded file activity supports detection after an initial clean verdict. A download-only check, static initial allowlist, or rescan that skips previously clean files cannot provide that later behavioral reassessment.

   Reference: Cisco Breach Protection Suite Design Guide — Breach Protection Suite Product Capabilities — Endpoint Security

10. 10An Application Load Balancer terminates client HTTPS connections. Security requirements also demand encryption from the load balancer to its EC2 targets. Which target-group design meets the second requirement?

    1. A. HTTP targets with HTTPS enabled only on the front-end listener
    2. B. HTTPS targets with server certificates installed on the targets
    3. C. HTTP targets with port 443 selected as an unencrypted port
    4. D. HTTP targets with HTTPS health checks as the only TLS use

    Answer: B

    Explanation: AWS states, "The load balancer establishes TLS connections with the targets using certificates that you install on the targets." An HTTPS target group encrypts backend application traffic. Front-end HTTPS, a port number, or encrypted health checks alone do not change HTTP application forwarding into HTTPS.

    Reference: Target groups for your Application Load Balancers — Routing configuration — HTTPS target connections