3.8 Cisco SAFE Model to Validate Network Security Design and to Identify Threats to Different PINs CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which security capability is most appropriate for the WAN PIN in the SAFE model?

   • AWeb application firewall (WAF)
   • BEncryption for data in transit
   • CEndpoint detection and response (EDR)
   • DData loss prevention (DLP)
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When validating a network security design using the SAFE model, what is the first step?

   • ASelect specific security products
   • BIdentify the Places in the Network (PINs) in the design
   • CCalculate return on investment (ROI)
   • DConduct a penetration test
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A retail company is expanding its network to include a new cloud-based point-of-sale system and a new branch office. The security architect is using the Cisco SAFE model to design the security posture. Which two PINs must be explicitly addressed in the design, and what is the primary threat focus for each?

   • ABranch PIN focuses on malware and ransomware; Cloud PIN focuses on misconfiguration and data exfiltration.
   • BBranch PIN focuses on physical theft; Cloud PIN focuses on misconfiguration and API abuse.
   • CCampus PIN focuses on insider threats; Cloud PIN focuses on DDoS and data exfiltration.
   • DData Center PIN focuses on DDoS; WAN PIN focuses on eavesdropping.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A service provider is designing a network for a large enterprise customer. The customer wants to ensure that management access to network devices is secure. Which SAFE design principle should be applied, and what is the recommended implementation?

   • ASecure management; use an out-of-band management network with strong authentication.
   • BResilience; deploy redundant management servers.
   • CVisibility; enable logging on all devices.
   • DSegmentation; put management interfaces on the user VLAN.
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A large enterprise is validating its network design against the SAFE model. The design includes a data center with strong DDoS protection, a campus with endpoint protection, and a branch with a simple firewall. However, the WAN is a single link from the branch to the data center, and the cloud PIN is not addressed. The architect must prioritize improvements. Which improvement should be made first?

   • AAdd segmentation between campus and data center.
   • BAdd a redundant WAN link to the branch to improve resilience.
   • CImplement a CASB for the cloud PIN.
   • DDeploy advanced malware protection at the branch.
   Reveal Solution Discussion Select an answer first