A global enterprise is redesigning its network and wants to apply the Cisco SAFE model. The security architect must ensure that the branch office PIN has appropriate security controls. Which two capabilities should the architect prioritize for the branch PIN?

DDoS mitigation and stateful firewall at the branch edge

Network segmentation and micro-segmentation within the branch

Advanced malware protection and URL filtering at the branch egress

Data loss prevention and encryption for all branch traffic

A healthcare organization is moving to a hybrid cloud model and using the SAFE model to assess threats. They are concerned about data exfiltration from the cloud PIN. Which control is most aligned with SAFE for this threat?

Deploy a web application firewall (WAF) in front of the cloud app

Implement cloud access security broker (CASB) with DLP capabilities

Enable multi-factor authentication (MFA) for cloud users

Use a VPN for all cloud traffic

A manufacturing company has a campus network with IoT devices on the factory floor. Using the SAFE model, which capability is most important for the campus PIN?

DDoS mitigation at the campus edge

Data loss prevention for all campus traffic

Advanced malware protection on all servers

Network segmentation to isolate IoT devices

A large enterprise has a distributed network with many branches, a central data center, and cloud services. The security team is using the SAFE model to prioritize threat mitigation. They have limited budget and must choose between enhancing security at the branch PIN or the data center PIN. Which threat should drive their decision?

Data center PIN: lateral movement of advanced threats

Data center PIN: physical theft of servers

Branch PIN: DDoS attacks on the internet link

Branch PIN: malware from web browsing

CCIE Security

Domain 3Objective 8

3.8 Cisco SAFE Model to Validate Network Security Design and to Identify Threats to Different PINs CCIE-SECURITY Practice Questions (Page 7)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

15%of the exam

Questions 31–35

31application · medium
A global enterprise is redesigning its network and wants to apply the Cisco SAFE model. The security architect must ensure that the branch office PIN has appropriate security controls. Which two capabilities should the architect prioritize for the branch PIN?
Select an answer first
32application · medium
A healthcare organization is moving to a hybrid cloud model and using the SAFE model to assess threats. They are concerned about data exfiltration from the cloud PIN. Which control is most aligned with SAFE for this threat?
Select an answer first
33application · medium
A manufacturing company has a campus network with IoT devices on the factory floor. Using the SAFE model, which capability is most important for the campus PIN?
Select an answer first
34application · medium
A security architect is validating a design for a financial institution. The design includes a strong perimeter defense but lacks internal segmentation between the campus and data center. Which SAFE model principle is most directly violated?
Select an answer first
35expert · hard
A large enterprise has a distributed network with many branches, a central data center, and cloud services. The security team is using the SAFE model to prioritize threat mitigation. They have limited budget and must choose between enhancing security at the branch PIN or the data center PIN. Which threat should drive their decision?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

3.8 Cisco SAFE Model to Validate Network Security Design and to Identify Threats to Different PINs CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

A global enterprise is redesigning its network and wants to apply the Cisco SAFE model. The security architect must ensure that the branch office PIN has appropriate security controls. Which two capabilities should the architect prioritize for the branch PIN?

A healthcare organization is moving to a hybrid cloud model and using the SAFE model to assess threats. They are concerned about data exfiltration from the cloud PIN. Which control is most aligned with SAFE for this threat?

A manufacturing company has a campus network with IoT devices on the factory floor. Using the SAFE model, which capability is most important for the campus PIN?

A security architect is validating a design for a financial institution. The design includes a strong perimeter defense but lacks internal segmentation between the campus and data center. Which SAFE model principle is most directly violated?

Keep studying — 3.0 Security Infrastructure