Cisco 300-745 SDSI flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Secure Workload cluster leader

The node that hosts the UI, API, analytics, and policy engine; configuration changes are made here and followers replicate data from it.

Secure Workload scope hierarchy

A tree of root, tenant, and child scopes where policy, users, and agents are assigned; child scopes inherit parent policy unless overridden.

Agentless visibility sources

NetFlow/IPFIX ingestion, ERSPAN mirroring, and the Secure Firewall connector; they provide IP-level flows without process-level context.

Application dependency mapping

A process that clusters observed flows into applications and displays nodes, edges, and ports over a chosen time window.

Policy simulation mode

Evaluation of proposed policy against historical flows without blocking traffic; results show which flows would be allowed or denied.

Agent-based enforcement mechanism

The agent inserts rules into the host firewall, iptables on Linux and WFP on Windows, with deny as the default action when enforced.

Forensics flow query

A retrospective search of retained flow and process data to reconstruct which workloads communicated during an incident window.

FTD deployment modes

Routed, transparent, and inline IPS-only; the mode determines whether data interfaces have IP addresses and how policy is applied.

FTD to FMC registration

The FTD initiates a connection to FMC on port 8305 using a registration key and NAT ID to establish management.

Prefilter policy function

Evaluated before access control, it handles tunnel and prefilter rules and can fastpath traffic around inspection.

Trust action in access control

An action that allows traffic while bypassing all further inspection, including intrusion and file policy.

Twice NAT

A single NAT rule that specifies both source and destination translation; manual NAT rules are evaluated before auto NAT.

Secure Workload firewall integration

A certificate-based connector publishes workload labels to FMC as dynamic objects that access control rules reference instead of static IPs.

Agent registration token

A secret generated in the Secure Workload UI that binds a newly installed agent to a specific scope during registration.

Policy version rollback

Each publish creates a version that can be compared and reverted; rolling back restores the prior enforced policy state.

FMC policy deployment

A transactional push of policy to a device; a failed deployment leaves the device running its previous policy.

NAT exemption

Identity NAT that prevents translation so traffic retains original addresses, commonly required for site-to-site VPN flows.

Passive identity

An identity method that maps IP addresses to users from Active Directory login events rather than active authentication.

Compliance drift detection

Comparison of intended policy with the enforced state on workloads that flags differences for investigation and remediation.

Secure Workload cluster VIP

A stable virtual IP for UI and API access that is independent of the current leader node address.

Packet tracer stages

The simulated flow passes prefilter, access control, NAT, and routing stages, and the output shows the matching rule at each.

Secure Workload API token

A short-lived bearer token obtained by exchanging an API key and secret; it is bound to a scope and must be refreshed.

Stateful failover state link

A dedicated link that replicates connection state between failover peers; without it, sessions drop when failover occurs.

Label-driven scope membership

Workloads join a scope when their key-value labels match the scope query; changes take effect on the next sync.

Smart Licensing evaluation mode

An unregistered device state that expires and can disable advanced inspection features until registration completes.

Route-based VPN

A VPN design using VTI interfaces that supports dynamic routing over the tunnel, preferred over policy-based crypto maps.

Secure Workload sizing inputs

Agent count, flows per second, retention period, and scope and policy count determine cluster capacity requirements.

Intrusion policy variables

Definitions of protected networks used by Snort rules; incorrect values cause false positives or false negatives.

Process context in flows

Metadata identifying the binary and user responsible for a connection, available only from agent-based collection.

FMC event retention

Local event storage is finite; external logging to syslog or a SIEM is required for long-term retention and compliance.

Absolute policy

A policy that overrides all other rules for a scope and is used sparingly because it bypasses normal evaluation.

Agentless firewall enforcement

Policy pushed from Secure Workload through FMC to the firewall, enforcing at the network boundary without an agent on the host.