Unit 6: Advanced security·Lesson 6.18 (11 of 11 in this unit)·13 of 25 in the Advanced Cisco SD-WAN course
Test: SD-WAN security fundamentals
Questions on the security layers, firewall, IPS, TLS proxy, URL filtering, AMP and DNS security, each with an explanation.
Advanced · 20 min read
You'll learn to check that you can choose and troubleshoot the right SD-WAN security layer for a given situation.
Technical definition
Defence in depth means using several independent security controls in layers, so that a failure or a gap in one layer does not leave the network open. In SD-WAN these layers include control-plane trust, IPsec tunnels, segmentation, the firewall, IPS, the TLS proxy, URL filtering, AMP, DNS-layer security and cloud security services.
Fifteen questions on the security lessons. The lab network is the one used in the course: BR-01 with service VPN 10 (corporate), VPN 30 (guest) and VPN 40 (point-of-sale), and the hubs HUB-01 and HUB-02. VPN numbers are examples. Each answer has an explanation, and each wrong option says why it does not fit. Features depend on the platform, release and licence, so treat the answers as the general behaviour.
Predict · scenario 1
1. Which control protects the trust between a WAN Edge router and the SD-WAN Controller before any user traffic is involved?
Predict · scenario 2
2. VPN 30 (guest) and VPN 10 (corporate) are members of one zone. What is true about traffic between them?
Predict · scenario 3
3. A rule from zone A to zone B uses pass. The replies from B to A are dropped. Why?
Predict · scenario 4
4. A new IPS policy is to be added to the payment flow. What is the sensible first mode?
Predict · scenario 5
5. An IPS signature keeps alerting on a business application that is known to be safe. What should you do?
Predict · scenario 6
6. What must be in place before the TLS proxy can decrypt user traffic without browser warnings?
Predict · scenario 7
7. An online banking site must not be decrypted by policy. How is that done?
Predict · scenario 8
8. After the TLS proxy is enabled, a mobile app that worked before shows connection errors, while the same service works in a browser. What is the likely cause?
Predict · scenario 9
9. Why does the use of QUIC (HTTP/3) matter for a TLS proxy and URL filtering design?
Predict · scenario 10
10. URL filtering is enabled for guests, with no decryption. A user opens https://video.example.com/watch?id=1 where the category video is blocked. What can the router base its decision on?
Predict · scenario 11
11. A file downloaded earlier was judged clean by AMP. A day later the file's verdict changes to malicious. What can AMP do?
Predict · scenario 12
12. DNS-layer security is on for guests. Users complain that intranet.corp.example no longer resolves for staff. What is the usual fix?
Predict · scenario 13
13. A cloud security service becomes unreachable. Branch internet traffic is steered to it. What is a fail-open versus fail-closed decision?
Predict · scenario 14
14. Terminals in VPN 40 cannot reach the payment gateway after a policy change. Which order of checks is sensible?
Predict · scenario 15
15. A manager asks whether the new firewall policy makes the branch compliant with a card-payment standard. What is the correct answer?
FAQ
Is this test based on a real exam?
No. The questions are original and written for this course. They follow the topics in the lessons, not the wording of any exam, and feature names or defaults can differ by release.
What if I get a question wrong?
Read the explanation, which names the idea involved, then go back to the matching lesson in the security section of the course and try the question again later.