A security architect is designing a new branch office that will have direct internet access. The company has a strict budget and wants to minimize on-premises hardware. Which approach best aligns with SAFE's guidance for branch PINs?

Deploy a full next-generation firewall stack at each branch

Use cloud-delivered security services (e.g., SASE) for branch traffic

Use a simple router with basic ACLs at the branch

Route all branch traffic through the central data center for security

A security architect is validating a network design for a hospital. The design includes a strong perimeter firewall, but the internal network is flat, and medical devices are on the same segment as administrative workstations. Which SAFE model gap is most critical?

No secure management for the firewall

Insufficient DDoS protection at the perimeter

Lack of segmentation between medical devices and other systems

Missing data loss prevention for patient records

A multinational company is adopting a cloud-first strategy and using the SAFE model. They have offices in multiple regions and use SaaS applications. Which threat is most relevant to the cloud PIN, and which control is most aligned?

Data exfiltration; use a VPN for all cloud traffic

Misconfiguration of cloud resources; use cloud security posture management (CSPM)

Insider threats; use DLP on all endpoints

DDoS attacks on cloud services; use a WAF

A security architect is designing a network for a government agency that requires high availability and strict security. The design must follow the SAFE model. Which combination of principles is most critical for this environment?

Visibility and secure management

Secure management and resilience

A security architect is validating a design for a retail company with many small branches. The design uses a centralized security stack at the data center and routes all branch traffic through it. Which SAFE model issue is most likely?

No secure management for branch devices

Increased latency and potential single point of failure

Lack of segmentation between branches

Insufficient visibility into branch traffic

CCIE Security

Domain 3Objective 8

3.8 Cisco SAFE Model to Validate Network Security Design and to Identify Threats to Different PINs CCIE-SECURITY Practice Questions (Page 8)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

15%of the exam

Questions 36–40

36expert · hard
A security architect is designing a new branch office that will have direct internet access. The company has a strict budget and wants to minimize on-premises hardware. Which approach best aligns with SAFE's guidance for branch PINs?
Select an answer first
37expert · hard
A security architect is validating a network design for a hospital. The design includes a strong perimeter firewall, but the internal network is flat, and medical devices are on the same segment as administrative workstations. Which SAFE model gap is most critical?
Select an answer first
38expert · hard
A multinational company is adopting a cloud-first strategy and using the SAFE model. They have offices in multiple regions and use SaaS applications. Which threat is most relevant to the cloud PIN, and which control is most aligned?
Select an answer first
39expert · hard
A security architect is designing a network for a government agency that requires high availability and strict security. The design must follow the SAFE model. Which combination of principles is most critical for this environment?
Select an answer first
40expert · hard
A security architect is validating a design for a retail company with many small branches. The design uses a centralized security stack at the data center and routes all branch traffic through it. Which SAFE model issue is most likely?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.