Cisco Designing Cisco Security Infrastructure (SDSI) (300-745)

✅ Enable AAA authentication for the DefaultWEBVPN and DefaultRAGroup Connection Profiles.

Reasoning: Enabling AAA authentication ensures all VPN access attempts are validated against a robust, centralized system. This allows for features like account lockout, multi-factor authentication integration, and stronger password policies, which are critical in mitigating password spray attacks by preventing brute-force attempts on user accounts.

✅

Reasoning: Container scanning directly identifies known software vulnerabilities (CVEs) within container images, including OS packages and application dependencies. Applied during the build phase for microservices packaged in containers, it proactively flags risks before deployment, perfectly aligning with the goal of preventing known vulnerabilities from entering the product. ❌ Why the other choices are incorrect:

• Option A is incorrect: Secret detection focuses on finding hardcoded sensitive information in code or configurations. While critical, it doesn't primarily address known software vulnerabilities in libraries or OS components, which is the core concern for preventing CVEs in the application.
• Option C is incorrect: Infrastructure as code scanning checks security configurations of infrastructure definitions. It ensures secure deployment environments but does not scan for software vulnerabilities within the application code or its dependencies packaged in the microservice container.
• Option D is incorrect: Open API specification analysis evaluates API design and adherence to security policies. This technique focuses on API interface vulnerabilities and design flaws, not on detecting known software vulnerabilities in the underlying application components or libraries.

✅

Reasoning: Role-Based Access Control (RBAC) directly addresses least privilege by assigning permissions based on an employee's organizational role. This method ensures users access only the specific network segments required for their job functions, significantly increasing security and access control. ❌ Why the other choices are incorrect:

• Option A is incorrect: NetFlow is a technology for collecting IP traffic information, primarily used for network monitoring, anomaly detection, and capacity planning, not for enforcing access control.
• Option B is incorrect: SNMP (Simple Network Management Protocol) is used for managing and monitoring network devices. It does not provide a mechanism for user-based least privilege access control to network segments.
• Option C is incorrect: PKI (Public Key Infrastructure) provides secure identity management, authentication, and encryption services. While foundational for strong security, it does not define or enforce granular least privilege access control across network segments itself; RBAC mechanisms utilize such authentication.

✅

Reasoning: MITRE CAPEC (Common Attack Pattern Enumeration and Classification) is a dictionary of known attack patterns. It provides a common language and structured list of methods adversaries use to exploit systems, making it ideal for evaluating attack scenarios during threat modeling. ❌ Why the other choices are incorrect:

• Option A is incorrect: Cisco SAFE (Security Architectures for Enterprise) provides security reference architectures and design guidance, not a framework of attack patterns.
• Option B is incorrect: GDPR (General Data Protection Regulation) is a legal framework for data protection and privacy, not an attack pattern framework.
• Option D is incorrect: SOC2 (Service Organization Control 2) is an auditing report focused on controls related to security and data handling, not an attack pattern framework.

✅

Reasoning: IPS/IDS actively protects IoT devices from network-based attacks, provides deep visibility by analyzing communication patterns, and excels at anomaly detection for unusual IoT traffic behavior, directly addressing all specified requirements. ❌ Why the other choices are incorrect:

• Option A is incorrect: A zone-based firewall primarily segments networks and applies stateful access rules. While it offers protection, it lacks the deep communication pattern analysis and advanced anomaly detection capabilities specific to IoT security requirements.
• Option B is incorrect: A transparent firewall operates at Layer 2 for stateful inspection. It provides basic protection without network re-configuration but does not offer the advanced visibility or anomaly detection needed for IoT traffic.
• Option C is incorrect: A traditional firewall primarily provides perimeter security and rule-based access control. It lacks the sophisticated visibility features, detailed communication pattern analysis, and advanced anomaly detection capabilities crucial for securing IoT environments.