Designing Cisco Security Infrastructure (SDSI) Free Sample Questions

Continuous trust (or continuous adaptive risk and trust assessment - CARTA) moves away from point-in-time authentication. Instead of verifying a user or device only at the initial login, the system continuously evaluates the device's security posture, location, and user behavior throughout the session. If the risk level changes (e.g., malware is detected or the user moves to a high-risk location), access can be dynamically revoked or restricted.

To combat BEC (which relies heavily on domain spoofing), DMARC with a 'p=reject' policy is the industry standard, as it ensures that emails claiming to be from the organization actually align with SPF and DKIM validations. To combat ransomware via zero-day attachments, Cisco Secure Email Threat Defense (which integrates via API to cloud providers like Microsoft 365) provides advanced malware analysis, sandboxing, and retrospective security to catch payloads that bypass native cloud email filters.

False. Passwordless authentication (such as FIDO2/WebAuthn) heavily relies on asymmetric cryptographic keys. The biometric data is used locally on the device to unlock a private key stored in a hardware enclave (like a TPM). The biometric data itself is never transmitted to the central authentication server; instead, the device signs a cryptographic challenge to prove the user's identity.

A Cloud Access Security Broker (CASB) is specifically designed to discover Shadow IT, monitor SaaS usage, and enforce data security policies (like DLP) on cloud applications. Because the users are remote and bypassing the VPN, integrating the CASB with an endpoint-based Secure Web Gateway (SWG) roaming client (such as Cisco Umbrella) ensures that the traffic is inspected and policies are enforced regardless of the user's physical location.

Legacy OT devices (like PLCs) cannot run agents, making host-based solutions impossible. Cisco Cyber Vision uses passive network monitoring to discover industrial assets and their communication flows without disrupting them. By integrating this visibility with Cisco Identity Services Engine (ISE), the architect can enforce TrustSec (SGT-based) microsegmentation, restricting the PLCs to communicate only with authorized engineering workstations, effectively preventing lateral movement from a general IT compromise.

Cisco Secure Workload provides consistent, zero-trust microsegmentation across on-premises data centers and public clouds (AWS, Azure, GCP). By utilizing software agents on the workloads themselves (or integrating with cloud APIs), it enforces identity-driven policies consistently at the workload level, agnostic of the underlying network infrastructure. Managing disparate native cloud security groups manually would violate the requirement for a unified, consistent policy approach.