A healthcare organization is using the SAFE model to validate its network design. The design includes a separate DMZ for public-facing web servers, but the internal user network has direct access to the database servers in the data center. What gap does the SAFE model identify?

Missing DDoS protection at the internet edge.

Lack of segmentation between the user network and the data center.

No secure management network for network devices.

Insufficient endpoint protection on user devices.

A multinational corporation is designing a new WAN PIN to connect branch offices to the data center. The architect wants to apply SAFE design principles. Which principle is most critical for the WAN PIN, and what capability supports it?

Secure management; use out-of-band management for WAN devices.

Resilience; implement redundant WAN links and failover.

Segmentation; use MPLS VPNs to separate traffic.

Visibility; deploy NetFlow on all WAN routers.

A university is deploying a new branch campus. The security team is using the SAFE model to identify threats. Which threat is most likely to be a top concern for the branch PIN, and what control should be prioritized?

DDoS attacks; deploy a cloud-based DDoS mitigation service.

Malware and ransomware; deploy advanced endpoint protection and web filtering.

Insider threats; implement user behavior analytics.

Physical theft; install locks and cameras.

A company is moving some workloads to a public cloud. The architect is mapping security capabilities to the cloud PIN. Which capability is essential for the cloud PIN, and why?

Network-based intrusion prevention system (IPS) in the data center.

Physical security controls at the cloud provider's data center.

Cloud access security broker (CASB) to enforce policy and visibility.

Legacy VPN concentrator for remote access.

A manufacturing company has a network with a flat design. The security architect is using the SAFE model to validate the design. Which finding is most likely to be identified as a gap?

No segmentation between the IT and OT networks.

No encryption for data at rest.

Lack of a firewall at the internet edge.

CCIE Security

Domain 3Objective 8

3.8 Cisco SAFE Model to Validate Network Security Design and to Identify Threats to Different PINs CCIE-SECURITY Practice Questions (Page 6)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

15%of the exam

Questions 26–30

26application · medium
A healthcare organization is using the SAFE model to validate its network design. The design includes a separate DMZ for public-facing web servers, but the internal user network has direct access to the database servers in the data center. What gap does the SAFE model identify?
Select an answer first
27application · medium
A multinational corporation is designing a new WAN PIN to connect branch offices to the data center. The architect wants to apply SAFE design principles. Which principle is most critical for the WAN PIN, and what capability supports it?
Select an answer first
28application · medium
A university is deploying a new branch campus. The security team is using the SAFE model to identify threats. Which threat is most likely to be a top concern for the branch PIN, and what control should be prioritized?
Select an answer first
29application · medium
A company is moving some workloads to a public cloud. The architect is mapping security capabilities to the cloud PIN. Which capability is essential for the cloud PIN, and why?
Select an answer first
30application · medium
A manufacturing company has a network with a flat design. The security architect is using the SAFE model to validate the design. Which finding is most likely to be identified as a gap?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.