サンプル問題 1： A restaurant distribution center recently suffered a password spray attack targeting the Cisco Secure Firepower Threat Defense VPN headend. The attack attempts to gain unauthorized access by trying common passwords across many accounts. The attack poses a significant security threat to the organization’s remote access infrastructure. To enhance the security of the VPN setup and minimize the risk of similar attacks in the future, the IT security team must implement effective mitigation measures. Which technique effectively reduces the risk of this type of attack?
A: Implement an access list to block addresses from the previous password spray attack.
B: Disable group aliases in the connection profiles.
C: Change the AAA authentication method from RADIUS to TACACS+.
D: Enable AAA authentication for the DefaultWEBVPN and DefaultRAGroup Connection Profiles.
正解：D
Explanation: In the context of Designing Cisco Security Infrastructure, protecting Remote Access VPN (RAVPN) against brute-force and password spray attacks is a critical objective. On Cisco Firepower Threat Defense (FTD) and Adaptive Security Appliance (ASA) platforms, the DefaultWEBVPNGroup and DefaultRAGroup are the landing points for any connection request that does not specify a valid Group Alias or Group URL. Attackers frequently target these default profiles because they are often left with "None" as the authentication method, allowing the attacker to probe for valid usernames without immediate rejection. By selecting Option D, the security designer ensures that any attempt to access the VPN via these default profiles requires valid AAA credentials. According to Cisco's hardened design guides, it is best practice to point these default profiles to a "sinkhole" AAA server or a local database with no users. This forces the password spray attack to fail at the initial authentication phase before any sensitive information is leaked or unauthorized access is granted. While Option A (ACLs) provides a temporary fix, it is ineffective against distributed attacks using rotating IP addresses. Option B (Disabling aliases) is a good obfuscation technique but doesn't stop an attacker from hitting the default profile. Option D provides a structural mitigation that aligns with the Cisco SAFE architectural principle of reducing the attack surface by securing every possible entry vector into the private infrastructure
サンプル問題 2： A product manager is focused on maintaining the security integrity of a microservice-based application as new features are developed and integrated. To ensure that known software vulnerabilities are not introduced into the product, it is crucial to implement a robust application security technique. The technique must be applied during the build phase of the software development lifecycle, which allows the team to proactively identify and address vulnerability risks before deployment. Which application security technique must be applied to accomplish the goal?
A: secret detection
B: container scanning
C: infrastructure as code scanning
D: Open API specification analysis
正解：B
Explanation: In a microservices-based architecture, applications are typically packaged into containers to ensure consistency across different environments. According to the Designing Cisco Security Infrastructure (SDSI) objectives, securing the software development lifecycle (SDLC) requires integrating security checks as far "left" as possible. Container scanning is the specific technique used during the build phase to inspect container images for known software vulnerabilities (CVEs) within the bundled libraries, binaries, and dependencies. When a developer initiates a build, the container scanning tool cross-references the layers of the image against vulnerability databases. If a high-risk vulnerability is detected in a base image or a third-party library, the build can be automatically failed, preventing the vulnerable code from ever reaching the registry or production environment. This directly addresses the product manager's goal of ensuring known vulnerabilities are not introduced. While Secret Detection (Option A) is vital for finding leaked API keys or passwords, and Infrastructure as Code (IaC) scanning (Option C) ensures the environment configuration is secure, neither specifically targets the software vulnerabilities within the application package itself. Similarly, Open API specification analysis (Option D) focuses on the contract and security of the interface rather than the underlying software vulnerabilities. By implementing container scanning, organizations align with Cisco’s DevSecOps framework, which emphasizes automated, policy-driven security within the CI/CD pipeline to maintain the integrity of cloud-native applications.
サンプル問題 3： A financial company is in the process of upgrading network access across the entire company. The solution must ensure: least privilege access control access across different network segments and increased security for employees. Which solution approach must the company take?
A: NetFlow
B: SNMP
C: PKI
D: RBAC
正解：D
Explanation: In the architecture of a modern secure infrastructure, achieving least privilege is a foundational requirement, especially for a financial institution where data sensitivity is high. Role-Based Access Control (RBAC) is the specific methodology used to restrict network access based on the roles of individual users within an enterprise. By implementing RBAC, the security team can ensure that employees only have access to the specific network segments and resources necessary for their job functions, effectively minimizing the internal attack surface. Within the Cisco Security ecosystem, RBAC is often operationalized through tools like Cisco Identity Services Engine (ISE) using Scalable Group Tags (SGTs). Instead of relying on static IP addresses or complex Access Control Lists (ACLs) that are difficult to maintain across different segments, RBAC allows for dynamic policy enforcement. For example, a "Financial Auditor" role would automatically be granted access to the accounting segment but blocked from the development segment, regardless of where they plug into the network. While PKI (Option C) provides strong authentication and encryption, and NetFlow (Option A) provides visibility, neither inherently defines the "least privilege" permission structure. RBAC is the architectural approach that directly maps business requirements to technical access policies, ensuring that security is maintained across segmented environments as required by the Cisco SDSI objectives for secure infrastructure design.
