A security architect is validating a network design for a retail chain with many small branch locations. The design places a next-generation firewall at each branch but no centralized visibility or management. Which SAFE model gap is most critical?

Lack of segmentation between branch and campus

Insufficient visibility across the distributed network

Missing DDoS protection at branches

No secure management for the firewalls

A university campus network is being redesigned using the SAFE model. The campus PIN includes student dorms, administrative buildings, and research labs. Which threat is most relevant to the campus PIN?

DDoS attacks on the internet link

Data exfiltration from the data center

Misconfiguration of cloud resources

A company is implementing the SAFE model and wants to ensure secure management across all PINs. Which approach aligns with SAFE's secure management principle?

Use the same credentials for all devices

Allow management from any internal network

Use a dedicated management VRF or out-of-band network

Use in-band management with strong encryption

A security architect is using the SAFE model to validate a design for a multi-site enterprise. The design includes a centralized data center, remote branches, and cloud access. Which aspect of the design should the architect check first to ensure alignment with SAFE?

Check that all traffic is encrypted end-to-end

Verify that each PIN has appropriate security capabilities based on its threat profile

Ensure all branches have the same security stack as the data center

Confirm that the internet edge is protected by a single firewall

A company is designing a new branch office and wants to apply SAFE principles. The branch will have limited IT staff and direct internet access. Which design decision best aligns with SAFE's resilience principle?

Use a cloud-delivered security service for the branch

Rely on the central site for all security enforcement

Deploy a single firewall with failover to the central site

Implement redundant WAN links and automatic failover

CCIE Security

Domain 3Objective 8

3.8 Cisco SAFE Model to Validate Network Security Design and to Identify Threats to Different PINs CCIE-SECURITY Practice Questions (Page 10)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

15%of the exam

Questions 46–50

46application · medium
A security architect is validating a network design for a retail chain with many small branch locations. The design places a next-generation firewall at each branch but no centralized visibility or management. Which SAFE model gap is most critical?
Select an answer first
47application · medium
A university campus network is being redesigned using the SAFE model. The campus PIN includes student dorms, administrative buildings, and research labs. Which threat is most relevant to the campus PIN?
Select an answer first
48application · medium
A company is implementing the SAFE model and wants to ensure secure management across all PINs. Which approach aligns with SAFE's secure management principle?
Select an answer first
49application · medium
A security architect is using the SAFE model to validate a design for a multi-site enterprise. The design includes a centralized data center, remote branches, and cloud access. Which aspect of the design should the architect check first to ensure alignment with SAFE?
Select an answer first
50application · medium
A company is designing a new branch office and wants to apply SAFE principles. The branch will have limited IT staff and direct internet access. Which design decision best aligns with SAFE's resilience principle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.