300-745 Exam Preparation Material | Designing Cisco Security Infrastructure

Explanation:
In the architecture of modern security, Artificial Intelligence (AI) and Machine Learning (ML) are leveraged to move beyond reactive, signature-based defenses. One of the most significant uses of AI in securing network infrastructure is the detection of zero-day attacks (often referred to in exam contexts as "day zero" attacks). A zero-day attack exploits a vulnerability that is unknown to the software vendor or the public, meaning no signature exists for traditional firewalls or antivirus software to block it.
AI identifies these threats through behavioral analysis and anomaly detection. By establishing a highly granular baseline of "normal" network traffic patterns―including flow direction, packet size, inter-packet arrival times, and protocol behavior―AI models can detect subtle deviations that indicate a malicious exploit. For example, Cisco Secure Network Analytics (formerly Stealthwatch) and Encrypted Threat Analytics (ETA) use ML to identify the cryptographic "fingerprints" of malware even within encrypted traffic, without the need for decryption. This allows the security infrastructure to identify and mitigate threats at the moment they appear, rather than waiting for a vendor to release a signature. While load balancing (Option B), traffic shaping (Option C), and Quality of Service (Option D) are critical for network performance and availability, they are traditional traffic engineering functions that do not inherently provide the advanced threat detection capabilities offered by AI-driven security models. Within the Cisco SDSI objectives, AI is positioned as the primary technology for achieving proactive visibility and reducing the "Mean Time to Detect" (MTTD) for previously unseen vulnerabilities.

Explanation:
In the context of Designing Cisco Security Infrastructure, protecting Remote Access VPN (RAVPN) against brute-force and password spray attacks is a critical objective. On Cisco Firepower Threat Defense (FTD) and Adaptive Security Appliance (ASA) platforms, the DefaultWEBVPNGroup and DefaultRAGroup are the landing points for any connection request that does not specify a valid Group Alias or Group URL. Attackers frequently target these default profiles because they are often left with "None" as the authentication method, allowing the attacker to probe for valid usernames without immediate rejection.
By selecting Option D, the security designer ensures that any attempt to access the VPN via these default profiles requires valid AAA credentials. According to Cisco's hardened design guides, it is best practice to point these default profiles to a "sinkhole" AAA server or a local database with no users. This forces the password spray attack to fail at the initial authentication phase before any sensitive information is leaked or unauthorized access is granted. While Option A (ACLs) provides a temporary fix, it is ineffective against distributed attacks using rotating IP addresses.
Option B (Disabling aliases) is a good obfuscation technique but doesn't stop an attacker from hitting the default profile.
Option D provides a structural mitigation that aligns with the Cisco SAFE architectural principle of reducing the attack surface by securing every possible entry vector into the private infrastructure.

Explanation:
In the context of the Cisco SDSI v1.0 blueprint, "shifting left" refers to the practice of integrating security testing as early as possible in the Software Development Life Cycle (SDLC). The most effective component of the pipeline for running these early tests is Source Code Management (SCM). By integrating security tools directly into the SCM system (such as GitHub, GitLab, or Bitbucket), developers can identify vulnerabilities while the code is still being written or during the initial commit phase.
Techniques such as Static Application Security Testing (SAST) and secret scanning are typically triggered at the SCM level through pull requests or commit hooks. This allows the security team to identify flawed logic or hardcoded credentials before the code is ever compiled or moved to the build stage. While Continuous Deployment (Option A) handles the final release of the software, it is too late in the pipeline for a "shift-left" approach to be most effective. Software Bill of Materials (SBOM) analysis (Option C) is a specific task focused on dependency management, and Cloud Security Posture Management (CSPM) (Option B) focuses on the runtime environment rather than the application code itself. Utilizing SCM as the primary checkpoint ensures that security becomes a foundational part of the development process, reducing the risk of vulnerable software reaching production environments.

Explanation:
The spread of malicious content between endpoints is a classic case of lateral movement. To control and restrict communication between individual endpoints―regardless of their physical location or IP address―Cisco TrustSec is the recommended architectural approach. TrustSec moves away from traditional, IP-based Access Control Lists (ACLs), which are difficult to manage and scale, and instead uses Scalable Group Tags (SGTs).
With TrustSec, every endpoint is assigned an SGT based on its role or security context (e.g., "Employee," "Contractor," or "HR"). Security policies are then defined in a centralized matrix (the egress policy matrix) that dictates which SGTs can talk to one another. For example, a policy can be set so that endpoints in the "Developer" group cannot communicate directly with endpoints in the "Sales" group, effectively preventing malware from hopping between machines. While RADIUS (Option A) is the protocol used for authentication, it does not perform the segmentation itself. Posture (Option C) checks the health of the device, and Profiling (Option D) identifies what the device is, but neither provides the policy-based traffic control of TrustSec. By implementing TrustSec, the company achieves micro-segmentation, significantly reducing the internal attack surface and containing potential breaches within a single group, which is a core goal of modern secure infrastructure design.

Explanation:
In modern secure infrastructure design, especially within high-performance testing and developer environments, the ability to observe and filter traffic at a deep level is crucial. eBPF (extended Berkeley Packet Filter) is a revolutionary technology that allows developers to run sandboxed programs within the Linux kernel. The primary advantage of eBPF is that it enables sophisticated tracing, monitoring, and network filtering capabilities without the need to modify the underlying kernel source code or load intrusive kernel modules.
In the context of the Cisco SDSI objectives, eBPF is highlighted as a key component of distributed firewalling and cloud-native security architectures. It operates by attaching programs to various "hooks" in the kernel, such as network events, tracepoints, or system calls. When a packet enters the system or a specific event occurs, the eBPF program can inspect the context and make high-speed decisions on whether to allow, drop, or redirect traffic. This provides a much more efficient and flexible alternative to traditional technologies like IPTables. Because eBPF programs are verified for safety by a JIT compiler before being executed, they do not risk crashing the kernel, making them ideal for dynamic developer environments. Unlike Vector Packet Processing (VPP) (Option D), which moves packet processing into userspace, or standard Next-Generation Firewalls (NGFW) (Option C), which are typically separate appliances, eBPF provides "in-kernel" observability and enforcement that is programmable and highly scalable for microservices and containerized applications.