A company is implementing SAFE and wants to ensure secure management across all PINs. They have a limited budget and need to prioritize. Which approach is most cost-effective while still aligning with SAFE?

Use a dedicated management VRF on existing devices

Deploy a separate physical management network

Use in-band management with strong encryption and ACLs

Rely on SSH for all management access

A security architect is using the SAFE model to assess a design for a financial trading firm. The firm has a high-performance data center and requires low latency. Which threat is most critical for the data center PIN, and how should it be mitigated without impacting performance?

DDoS attacks; deploy a DDoS mitigation service in the data center

Insider threats; use user behavior analytics (UBA)

Lateral movement of advanced threats; use micro-segmentation with hardware-based enforcement

Data exfiltration; use a cloud access security broker (CASB)

A financial services company is deploying a new cloud-based application. The security team is using the SAFE model to identify threats specific to the cloud PIN. Which threat should they consider as the most critical for this PIN?

Insider threats from disgruntled employees

Misconfiguration of cloud resources

DDoS attacks on the internet link

A large enterprise is implementing the SAFE model and needs to map security capabilities to the data center PIN. Which capability is most essential for the data center PIN?

Advanced malware protection on endpoints

Network segmentation and micro-segmentation

DDoS mitigation at the WAN edge

URL filtering at the internet edge

CCIE Security

Domain 3Objective 8

3.8 Cisco SAFE Model to Validate Network Security Design and to Identify Threats to Different PINs CCIE-SECURITY Practice Questions (Page 9)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

15%of the exam

Questions 41–45

41expert · hard
A company is implementing SAFE and wants to ensure secure management across all PINs. They have a limited budget and need to prioritize. Which approach is most cost-effective while still aligning with SAFE?
Select an answer first
42application · medium
A security architect is validating an existing network design against the Cisco SAFE model. The design has a strong perimeter firewall but no internal segmentation between the campus and data center. Which SAFE principle is most violated?
Select an answer first
43expert · hard
A security architect is using the SAFE model to assess a design for a financial trading firm. The firm has a high-performance data center and requires low latency. Which threat is most critical for the data center PIN, and how should it be mitigated without impacting performance?
Select an answer first
44application · medium
A financial services company is deploying a new cloud-based application. The security team is using the SAFE model to identify threats specific to the cloud PIN. Which threat should they consider as the most critical for this PIN?
Select an answer first
45application · medium
A large enterprise is implementing the SAFE model and needs to map security capabilities to the data center PIN. Which capability is most essential for the data center PIN?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.