I85PREP
⌘ K
Cisco 300-745 SDSI study materials
Cisco 300-745 SDSI study resources

Cisco 300-745 SDSI practice questions

One question at a time. Build your Cisco 300-745 SDSI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Architecture, Components, and Deployment Models of Cisco Secure Workload

A security team is choosing between an on-premises appliance deployment and a SaaS deployment of Cisco Secure Workload. Which statement correctly reflects the role of the on-premises cluster in the overall architecture?

  1. The on-premises cluster runs the full analytics and policy engine locally, with customer-managed infrastructure Correct answer.
  2. The on-premises cluster functions exclusively as a flow collector with no policy computation capability
  3. The on-premises cluster only forwards telemetry to a mandatory cloud tenant and cannot enforce policy locally
  4. The on-premises cluster requires a separate SaaS tenant license for every enforcement agent installed

Explanation

In the on-premises deployment model the entire Secure Workload cluster, including the analytics engine, policy computation, and user interface, runs on customer-managed hardware or virtual infrastructure. No cloud tenant is required for core functionality, so enforcement and analysis happen locally. SaaS deployment instead offloads that processing to Cisco-operated infrastructure.

Question 2Architecture, Components, and Deployment Models of Cisco Secure Workload

Which Cisco Secure Workload component is responsible for collecting flow telemetry from the network fabric and host agents and feeding it into the analytics pipeline?

  1. The policy enforcement agent on the workload
  2. The ingestion layer of the cluster Correct answer.
  3. The reporting dashboard
  4. The external orchestration connector

Explanation

The ingestion layer receives telemetry from sources such as network flow exporters and host agents and normalizes it before storage and analysis. Enforcement agents act on policy but do not perform cluster-side ingestion. Orchestration connectors integrate with external systems rather than collecting flow data.

Question 3Architecture, Components, and Deployment Models of Cisco Secure Workload

An administrator needs to understand how Cisco Secure Workload labels workloads for policy scoping. Which mechanism provides the labels that identify workload attributes such as role, environment, and application?

  1. Static IP address ranges configured on the firewall
  2. SNMP traps generated by switching infrastructure
  3. DNS reverse-lookup records maintained by the cluster
  4. Inventory labels derived from agents, connectors, and user-defined rules Correct answer.

Explanation

Secure Workload uses a label-based inventory model in which labels are discovered from agents, orchestration connectors, and user-defined rules. Policy scopes reference these labels rather than raw addresses, which makes policy portable across changing IPs. Firewall ranges, DNS, and SNMP are not the labeling mechanism.

Question 4Architecture, Components, and Deployment Models of Cisco Secure Workload

Which statement accurately describes the relationship between a scope and a policy in Cisco Secure Workload?

  1. A scope is a backup of the cluster configuration
  2. A scope is a license tier that limits the number of agents
  3. A scope is a single firewall rule applied to one host
  4. A scope is a set of labels that defines the boundary within which policy rules are evaluated Correct answer.

Explanation

A scope is defined by label-based queries and establishes the boundary of workloads to which a policy applies. Policy rules are then authored and evaluated inside that scope. Scopes are not individual rules, backups, or licensing constructs.

Question 5Architecture, Components, and Deployment Models of Cisco Secure Workload

A customer wants enforcement that blocks traffic directly on the workload's operating system without relying on network devices. Which Cisco Secure Workload capability provides this?

  1. Host-based enforcement through the installed agent Correct answer.
  2. NetFlow export from the top-of-rack switch
  3. Load-balancer access control lists
  4. Spanning-tree topology analysis

Explanation

Host-based enforcement uses the Secure Workload agent on the workload to allow or deny traffic at the operating system level, independent of network device capabilities. This is the primary enforcement mode for workloads running supported operating systems. Switch flows, load balancers, and spanning tree do not provide host-level blocking.

Question 6Architecture, Components, and Deployment Models of Cisco Secure Workload

Which deployment consideration most directly favors the SaaS model of Cisco Secure Workload for a small security team?

  1. The customer must build a three-node cluster before onboarding agents
  2. The customer must supply all analytics hardware
  3. Cisco operates the cluster and the customer consumes it as a service Correct answer.
  4. The customer must maintain the underlying database layer

Explanation

In the SaaS model Cisco hosts and operates the Secure Workload cluster, so the customer does not procure or maintain analytics infrastructure. This reduces operational burden for teams without spare capacity. The other options describe on-premises responsibilities.

Question 7Architecture, Components, and Deployment Models of Cisco Secure Workload

What is the purpose of an orchestration connector in a Cisco Secure Workload deployment?

  1. To store raw flow records on disk
  2. To synchronize workload inventory and labels from platforms such as virtualization managers Correct answer.
  3. To serve the web user interface to administrators
  4. To encrypt agent-to-cluster traffic

Explanation

Orchestration connectors integrate Secure Workload with external systems such as hypervisor managers and cloud platforms to import inventory and label metadata. This enriches the label model so policy can be scoped accurately. Encryption, flow storage, and the web UI are handled by other components.

Question 8Architecture, Components, and Deployment Models of Cisco Secure Workload

Which statement best characterizes the Cisco Secure Workload agent's role in the architecture when policy is in a monitoring state?

  1. It blocks all traffic until policy is promoted to enforced
  2. It reports observed flows and policy compliance without dropping packets Correct answer.
  3. It disables the host firewall permanently
  4. It replaces the need for any cluster analytics

Explanation

In monitoring (visibility) state the agent observes and reports traffic and policy compliance but does not drop packets. This lets teams validate policy before enabling enforcement. It does not block by default, disable host firewalls, or replace cluster analytics.

Question 9Architecture, Components, and Deployment Models of Cisco Secure Workload

A team is planning an on-premises Cisco Secure Workload cluster. Which statement about cluster sizing is most accurate?

  1. A single small node is sufficient for any production workload volume
  2. Sizing is determined solely by the number of administrative users
  3. Sizing depends on factors such as flow volume, number of agents, and retention requirements Correct answer.
  4. Sizing is fixed and identical for every customer

Explanation

On-premises cluster sizing is driven by telemetry volume, agent count, retention period, and feature usage. Cisco provides sizing guidance so the cluster has adequate compute and storage. A one-size-fits-all or admin-count-based rule is incorrect.

Question 10Architecture, Components, and Deployment Models of Cisco Secure Workload

An engineer wants policy to follow workloads as they move between hosts with changing IP addresses. Which architectural feature makes this possible?

  1. Static NAT mappings maintained per host
  2. Label-based scopes that reference workload attributes instead of addresses Correct answer.
  3. Hard-coded IP tables in each policy rule
  4. MAC address sticky entries on switches

Explanation

Because scopes and rules are expressed in terms of labels such as role and environment, policy remains valid when addresses change. This is a core benefit of the label-based inventory model. Static NAT, hard-coded addresses, and MAC stickiness tie policy to infrastructure details and break on movement.

Question 11Architecture, Components, and Deployment Models of Cisco Secure Workload

A security architect must decide where to enforce policy for a legacy application that cannot run the agent. Which approach fits the Cisco Secure Workload architecture?

  1. Rely on network-based enforcement through integration with fabric devices Correct answer.
  2. Convert the application to containers before onboarding
  3. Install the agent anyway and accept unsupported operation
  4. Disable enforcement for the whole cluster

Explanation

When a workload cannot host the agent, enforcement can be pushed to network devices through fabric integration, allowing policy to be applied at the network layer. Installing an unsupported agent or disabling cluster enforcement is not a sound design. Replatforming is a separate decision, not an enforcement mechanism.

Question 12Architecture, Components, and Deployment Models of Cisco Secure Workload

Which Cisco Secure Workload capability helps an administrator understand which flows would be permitted or denied before turning on enforcement?

  1. Disk defragmentation scheduling
  2. SNMP polling of interface counters
  3. Policy analysis and simulation against observed traffic Correct answer.
  4. Spanning-tree loop detection

Explanation

Secure Workload can analyze policy against observed flow data to show the effect of rules before enforcement is enabled. This reduces the risk of an outage when policy moves to enforced state. The other options are unrelated infrastructure functions.

Question 13Architecture, Components, and Deployment Models of Cisco Secure Workload

An administrator is onboarding a VMware environment and wants labels such as VM name and cluster imported automatically. Which component should be configured?

  1. A syslog server pointing at the cluster
  2. A flow exporter on each ESXi host only
  3. An orchestration connector for the virtualization platform Correct answer.
  4. A DHCP relay on the management network

Explanation

An orchestration connector for the virtualization platform imports inventory and metadata that become labels for scoping policy. Flow exporters provide traffic data but not the rich inventory attributes. Syslog and DHCP relay do not supply workload labels.

Question 14Architecture, Components, and Deployment Models of Cisco Secure Workload

Which statement correctly distinguishes the roles of the Cisco Secure Workload cluster and the agent?

  1. Both perform identical functions with no division of responsibility
  2. The cluster enforces on hosts; the agent only stores raw flow records
  3. The agent computes cluster-wide analytics; the cluster only stores logs
  4. The cluster computes policy and analytics; the agent enforces and reports on the host Correct answer.

Explanation

The cluster hosts analytics, policy computation, and the UI, while the agent on each workload reports telemetry and enforces policy locally. This division lets centralized intelligence drive distributed enforcement. The other options invert or conflate these responsibilities.

Question 15Architecture, Components, and Deployment Models of Cisco Secure Workload

A customer wants to segment traffic between application tiers in a hybrid environment spanning on-premises data center and a public cloud. Which Cisco Secure Workload characteristic supports this?

  1. Policy limited to a single subnet per cluster
  2. Enforcement that only works on physical servers
  3. A single label-based policy model applied consistently across environments where agents or connectors are deployed Correct answer.
  4. Separate unrelated policy engines per environment with no shared model

Explanation

Secure Workload uses one label-based policy model that can span on-premises and cloud workloads, provided telemetry and enforcement are available in each environment. This delivers consistent segmentation across hybrid estates. Per-environment silos, subnet limits, and physical-only enforcement contradict the architecture.

Question 16Architecture, Components, and Deployment Models of Cisco Secure Workload

Which item is a prerequisite for host-based enforcement to function on a workload?

  1. A dedicated physical network tap on the host
  2. An SNMP community string configured on the host
  3. A supported operating system with the agent installed and communicating with the cluster Correct answer.
  4. A public IP address assigned to the workload

Explanation

Host-based enforcement requires the agent to be installed on a supported OS and to maintain connectivity with the cluster so it can receive policy. Without that channel the agent cannot enforce. Taps, SNMP, and public addressing are not prerequisites.

Question 17Architecture, Components, and Deployment Models of Cisco Secure Workload

An organization is evaluating the SaaS deployment of Cisco Secure Workload. Which responsibility remains with the customer rather than Cisco?

  1. Deploying and maintaining agents on their workloads and defining policy Correct answer.
  2. Patching the underlying cluster database
  3. Managing the physical data center hosting the cluster
  4. Operating the analytics cluster hardware

Explanation

In SaaS, Cisco operates the cluster and its supporting infrastructure, while the customer installs and maintains agents, defines scopes and policy, and manages their own workloads. This division of responsibility is central to the SaaS model. Cluster hardware, database patching, and hosting are Cisco responsibilities.

Question 18Architecture, Components, and Deployment Models of Cisco Secure Workload

Which statement about the Cisco Secure Workload data pipeline is accurate?

  1. Telemetry is ingested, processed into flow and inventory context, and then used for analysis, visualization, and policy evaluation Correct answer.
  2. Telemetry is discarded immediately after the agent sends it
  3. Policy is evaluated only on the agent with no cluster involvement
  4. Inventory labels are generated only from manual entry

Explanation

The pipeline ingests telemetry from agents and exporters, enriches and stores it with inventory context, and makes it available for analysis, visualization, and policy evaluation. Data is retained rather than discarded, and labels come from multiple automated sources, not only manual entry.

Question 19Architecture, Components, and Deployment Models of Cisco Secure Workload

A security team wants to enforce policy on bare-metal Linux servers and virtual machines using the same rule set. Which architectural property of Cisco Secure Workload enables this?

  1. Rules written against labels that resolve to members regardless of underlying platform Correct answer.
  2. Rules tied to physical switch port numbers
  3. Rules written against hypervisor UUIDs
  4. Rules bound to a single data center location

Explanation

Because rules reference labels rather than platform-specific identifiers, the same policy can apply to bare metal and virtual workloads alike. Hypervisor UUIDs, switch ports, and location bindings would prevent reuse across platforms. This label abstraction is a core design principle.

Question 20Architecture, Components, and Deployment Models of Cisco Secure Workload

Which statement about the Cisco Secure Workload agent's communication with the cluster is correct?

  1. The agent establishes an outbound connection to the cluster and receives policy updates over it Correct answer.
  2. The agent communicates only through email alerts
  3. The agent requires a full mesh peering with every other agent
  4. The cluster initiates inbound connections to agents on arbitrary ports

Explanation

Agents connect outbound to the cluster and use that channel to send telemetry and receive policy. This design avoids requiring inbound connections to workloads. Agents do not form full mesh peerings or communicate via email.

Question 21Architecture, Components, and Deployment Models of Cisco Secure Workload

An administrator is designing label taxonomy for a large estate. Which practice best supports scalable policy authoring in Cisco Secure Workload?

  1. Create a unique scope for every individual host
  2. Rely solely on IP address labels for all scopes
  3. Use free-form labels with no naming convention across teams
  4. Define a consistent, hierarchical label scheme covering role, environment, and application Correct answer.

Explanation

A consistent hierarchical label scheme lets teams compose scopes that are readable and reusable across the estate. Free-form labels, address-only scoping, and per-host scopes do not scale and undermine the label model. Good taxonomy is a design decision that pays off in policy maintenance.

Question 22Architecture, Components, and Deployment Models of Cisco Secure Workload

A customer operates an on-premises Cisco Secure Workload cluster and asks how high availability is typically addressed. Which statement is most accurate?

  1. A single node is sufficient because agents buffer indefinitely during outages
  2. High availability is provided solely by the agent's local firewall
  3. High availability is unnecessary because policy is stateless
  4. The cluster is deployed as a multi-node configuration so that component failures do not halt analytics or enforcement Correct answer.

Explanation

On-premises clusters are deployed with multiple nodes so that the failure of one component does not stop analytics or policy distribution. Agents may buffer telemetry briefly but cannot substitute for cluster redundancy. Local firewalls and statelessness do not provide cluster HA.

Question 23Architecture, Components, and Deployment Models of Cisco Secure Workload

An architect is mapping enforcement coverage for a mixed estate and finds some workloads run unsupported operating systems. Which design decision is most consistent with the Cisco Secure Workload architecture?

  1. Use network-based enforcement for those workloads while host-based enforcement covers the rest Correct answer.
  2. Abandon segmentation for the entire estate
  3. Force-install the agent on unsupported systems and ignore errors
  4. Rely on monitoring state alone for all workloads

Explanation

A sound design combines host-based enforcement where agents are supported with network-based enforcement for the remainder, achieving coverage without unsupported installs. Forcing agents, abandoning segmentation, or relying only on monitoring leaves gaps or risks instability. Mixed enforcement is an expected architectural pattern.

Question 24Architecture, Components, and Deployment Models of Cisco Secure Workload

A team observes that policy authored in a scope is not affecting a newly added workload. Which architectural explanation is most plausible?

  1. The cluster has run out of administrative user licenses
  2. The workload's labels do not match the scope query, so it is not a member of the scope Correct answer.
  3. Policy rules apply only to the first host in any scope
  4. The agent automatically excludes newly added hosts for 30 days

Explanation

Scope membership is determined by label queries, so a workload whose labels do not satisfy the query falls outside the scope and is unaffected by its policy. License counts, onboarding delays, and first-host-only rules are not part of the model. Correct labeling is essential for policy to take effect.

Question 25Architecture, Components, and Deployment Models of Cisco Secure Workload

An organization wants to minimize the blast radius of a compromised workload while keeping policy management centralized. Which architectural combination best achieves this?

  1. Monitoring-only agents with manual firewall changes after incidents
  2. Centralized enforcement at a single choke point with no host agents
  3. Centralized label-based policy in the cluster with distributed host-based enforcement at each workload Correct answer.
  4. Decentralized per-team policy engines with no shared label model

Explanation

Centralized policy authoring in the cluster combined with distributed host-based enforcement means a compromise is contained at the workload while management stays consistent. A single choke point, disconnected per-team engines, and manual response increase risk or operational overhead. This combination reflects the intended architecture.

Question 26Architecture, Components, and Deployment Models of Cisco Secure Workload

In a Cisco Secure Workload deployment, which architectural component is responsible for collecting flow telemetry from the network fabric and forwarding it to the cluster?

  1. The external flow collector or network device configured to export NetFlow/IPFIX records Correct answer.
  2. The Secure Workload agent installed on each workload
  3. The Secure Workload appliance that runs the policy enforcement engine
  4. The orchestration connector that imports inventory from virtualization managers

Explanation

Cisco Secure Workload can ingest flow telemetry from multiple sources, including agents and network devices that export NetFlow or IPFIX. The external flow collector or network device is the component that generates and exports those records to the cluster. Agents collect host-level telemetry but are not network fabric collectors, and orchestration connectors import inventory rather than flow data.

Question 27Architecture, Components, and Deployment Models of Cisco Secure Workload

An administrator is designing label taxonomy for a large estate and wants to ensure that policy scopes can be built from consistently named labels. Which practice best supports scalable policy authoring in Cisco Secure Workload?

  1. Allowing each team to define its own label keys without a naming standard
  2. Defining a governed label schema with agreed key names and value conventions before onboarding workloads Correct answer.
  3. Relying solely on automatically discovered IP addresses as the primary label
  4. Creating a separate scope for every individual workload to avoid label conflicts

Explanation

Scalable policy authoring depends on a consistent, governed label schema so that scopes can be defined once and reused across many workloads. Agreeing on key names and value conventions before onboarding prevents drift and duplicate labels. Ad hoc or per-workload approaches do not scale and undermine scope reuse.

Question 28Architecture, Components, and Deployment Models of Cisco Secure Workload

A security team wants to enforce policy on bare-metal Linux servers and virtual machines using the same rule set. Which architectural approach in Cisco Secure Workload supports this requirement?

  1. Deploy the Secure Workload agent on both bare-metal and virtual workloads so host-based enforcement applies uniformly Correct answer.
  2. Configure separate clusters for bare metal and virtual machines to avoid rule-set conflicts
  3. Use only network-based enforcement through the fabric because agents cannot run on bare metal
  4. Rely on the orchestration connector to enforce policy directly on the hypervisor

Explanation

Host-based enforcement in Cisco Secure Workload is delivered by the agent, which can be installed on supported bare-metal Linux servers and virtual machines alike. Because policy is expressed through labels and scopes rather than host type, the same rule set can apply to both. Network-based enforcement is an alternative for workloads that cannot run the agent, not a requirement for bare metal.

Question 29Architecture, Components, and Deployment Models of Cisco Secure Workload

An organization wants to minimize the blast radius of a compromised workload while keeping policy management centralized. Which Cisco Secure Workload architectural pattern best meets this goal?

  1. Enforce all policy only at the perimeter firewall and leave internal workload traffic unrestricted
  2. Use a single flat scope for the entire data center so that all workloads share one policy
  3. Deploy host-based enforcement with tightly scoped policies that isolate each application tier Correct answer.
  4. Disable enforcement and rely on flow visibility alone to detect compromise

Explanation

Minimizing blast radius requires limiting lateral movement through tightly scoped, least-privilege policy enforced close to the workload. Host-based enforcement with per-tier scopes keeps policy management centralized in the cluster while containing a compromised host. Perimeter-only or flat-scope approaches leave internal lateral paths open.

Question 30Architecture, Components, and Deployment Models of Cisco Secure Workload

A team observes that policy authored in a scope is not affecting a newly added workload. Which architectural explanation is most likely in Cisco Secure Workload?

  1. The agent must be reinstalled each time a new scope is created for the workload
  2. The cluster automatically disables enforcement for any workload added within the last 24 hours
  3. The workload's labels do not match the scope's label criteria, so the policy is not applied to it Correct answer.
  4. Policy scopes only apply to workloads that are imported through an orchestration connector

Explanation

Cisco Secure Workload applies policy through scopes defined by label criteria, so a workload is only covered when its labels match the scope. A newly added workload that lacks the expected labels falls outside the scope and receives no policy. Correcting the label assignment or scope criteria resolves the gap.

Question 31Cisco Secure Workload Installation, Initialization, and Cluster Management

A new Cisco Secure Workload cluster is being planned for a data center. Which three node roles must exist for the cluster to be functional?

  1. Controller, sensor, and external load balancer
  2. Controller, database, and sensor Correct answer.
  3. Controller, database, and external load balancer
  4. Sensor, database, and external load balancer

Explanation

A Secure Workload cluster is built from three functional roles: controllers that run the platform services, database nodes that store telemetry and policy data, and sensors that collect workload traffic information. The external load balancer is optional infrastructure for presentation, not a cluster node role.

Question 32Cisco Secure Workload Installation, Initialization, and Cluster Management

Which statement describes the supported deployment model for Cisco Secure Workload in an on-premises data center?

  1. It deploys as a scale-out cluster of nodes sized to the monitored workload count. Correct answer.
  2. It runs exclusively inside a hypervisor with no bare-metal option.
  3. It runs only as a cloud-hosted SaaS tenant with no on-premises component.
  4. It requires a single all-in-one appliance with no scale-out.

Explanation

On-premises Secure Workload is deployed as a horizontally scalable cluster whose node count and sizing are driven by the number of workloads and the telemetry volume to be processed. Sizing guidance maps monitored workload counts to controller, database, and sensor capacity.

Question 33Cisco Secure Workload Installation, Initialization, and Cluster Management

During initial configuration of Cisco Secure Workload, which account is used to perform the first-time setup of the cluster?

  1. An LDAP-bound account from the customer directory
  2. A pre-shared service account issued by Cisco TAC
  3. A site administrator account created on the cluster Correct answer.
  4. A read-only monitoring account

Explanation

First-time initialization is performed with the local site administrator account created during cluster bring-up. External identity integration such as LDAP or SAML is configured later, once the cluster is operational.

Question 34Cisco Secure Workload Installation, Initialization, and Cluster Management

An engineer needs to verify that a newly installed Cisco Secure Workload cluster is healthy before onboarding production sensors. Which check is most appropriate?

  1. Confirm that the external load balancer has a valid TLS certificate only
  2. Confirm that the cluster status page reports all services healthy and nodes in sync Correct answer.
  3. Confirm that the DNS record for the cluster resolves from a laptop
  4. Confirm that at least one sensor has been installed and is reporting

Explanation

Cluster health is verified by reviewing the built-in status and service health views, which confirm that platform services are running and that nodes are synchronized. Sensor onboarding and load balancer certificates are downstream concerns that do not by themselves prove cluster integrity.

Question 35Cisco Secure Workload Installation, Initialization, and Cluster Management

Which protocol and port does a Cisco Secure Workload sensor use to send telemetry to the cluster by default?

  1. TCP 22 to the controller management address
  2. UDP 123 to the database node
  3. UDP 514 to the cluster's syslog collector
  4. TCP 443 to the cluster's external data interface Correct answer.

Explanation

Sensors establish an outbound connection to the cluster over TLS on TCP 443, using the configured external interface address. This single encrypted channel carries telemetry and policy updates between the sensor and the cluster.

Question 36Cisco Secure Workload Installation, Initialization, and Cluster Management

What is the purpose of the external load balancer in a Cisco Secure Workload deployment?

  1. It replaces the need for controller nodes in large clusters.
  2. It distributes sensor installations across controllers.
  3. It load-balances telemetry traffic across database nodes.
  4. It provides a single stable address for user and API access to the cluster. Correct answer.

Explanation

The external load balancer presents a single virtual address for the web UI and API, distributing user and API sessions across the controller nodes. Telemetry from sensors connects to the cluster data interface, not through the load balancer.

Question 37Cisco Secure Workload Installation, Initialization, and Cluster Management

Which time synchronization approach is required across Cisco Secure Workload cluster nodes?

  1. Each node uses its own local hardware clock without external sync.
  2. Nodes synchronize only with each other using peer mode with no external source.
  3. Time synchronization is unnecessary because all timestamps are generated by sensors.
  4. Nodes synchronize to a common NTP source. Correct answer.

Explanation

All cluster nodes must synchronize to a reliable, common NTP source so that distributed services agree on time. Clock skew between nodes can cause certificate validation, token, and data consistency failures across the cluster.

Question 38Cisco Secure Workload Installation, Initialization, and Cluster Management

Before installing a Cisco Secure Workload sensor on a Linux workload, which prerequisite must be satisfied?

  1. The workload must resolve and reach the cluster's external interface over TCP 443. Correct answer.
  2. The workload must be rebooted into a signed kernel provided by Cisco.
  3. The workload must have the database role installed locally.
  4. The workload must be joined to the same LDAP domain as the controllers.

Explanation

A sensor needs network reachability to the cluster's external interface on TCP 443 and must be able to resolve its address. Kernel replacement and domain membership are not prerequisites for sensor installation.

Question 39Cisco Secure Workload Installation, Initialization, and Cluster Management

An administrator is sizing a Cisco Secure Workload cluster for a growing environment. Which factor most directly drives the number of database nodes required?

  1. The volume of flow telemetry and the number of monitored workloads Correct answer.
  2. The number of concurrent web UI sessions
  3. The count of LDAP groups mapped to roles
  4. The number of external load balancer virtual IPs

Explanation

Database tier sizing is driven by the telemetry ingestion rate and retained data volume, which scale with the number of monitored workloads. UI sessions, load balancer VIPs, and directory group counts do not materially affect database capacity.

Question 40Cisco Secure Workload Installation, Initialization, and Cluster Management

After adding a new controller node to an existing Cisco Secure Workload cluster, what must be verified to confirm the node joined correctly?

  1. That the node has its own independent administrative UI
  2. That the node has been promoted to the database role
  3. That the node appears in the cluster node inventory and reports services healthy Correct answer.
  4. That the node has been registered as a sensor

Explanation

A newly added node is validated by confirming it appears in the cluster inventory and that its services reach a healthy state and synchronize with peers. Role changes and sensor registration are separate operations.

Question 41Cisco Secure Workload Installation, Initialization, and Cluster Management

Which certificate consideration applies when deploying Cisco Secure Workload with a customer-provided certificate for the web interface?

  1. The certificate must be issued by a public CA and cannot be internal.
  2. The certificate must use a 1024-bit RSA key for compatibility.
  3. The certificate must be installed on every sensor rather than on the cluster.
  4. The certificate must match the hostname clients use to reach the cluster and include the full chain. Correct answer.

Explanation

A customer-provided certificate must contain a subject or SAN matching the name clients use to reach the cluster, and the intermediate chain must be supplied so browsers can validate it. Internal or public CAs are both acceptable, and modern key sizes are required.

Question 42Cisco Secure Workload Installation, Initialization, and Cluster Management

An engineer is planning sensor placement for a VMware environment. Which statement reflects the supported approach?

  1. Sensors are installed in the guest VMs or via a supported hypervisor-level integration. Correct answer.
  2. A single sensor installed on vCenter captures all guest traffic automatically.
  3. Sensors must be installed on the physical ESXi host console only.
  4. Sensors are unnecessary because the cluster infers traffic from NetFlow alone.

Explanation

Visibility in virtual environments is achieved by installing the agent inside guest workloads or by using a supported hypervisor integration that captures inter-VM traffic. Installing a sensor on vCenter itself does not provide guest-level flow visibility.

Question 43Cisco Secure Workload Installation, Initialization, and Cluster Management

What is the effect of configuring an offline or air-gapped Cisco Secure Workload cluster?

  1. The cluster pulls software updates from a local repository instead of the internet. Correct answer.
  2. The cluster disables all sensor connections until manually re-enabled.
  3. The cluster stops enforcing policy and operates in monitor-only mode.
  4. The cluster requires the load balancer to be removed.

Explanation

In an air-gapped deployment, the cluster does not reach the internet; update and signature content is obtained from a locally hosted repository or imported bundle. Sensor connectivity and policy enforcement continue normally.

Question 44Cisco Secure Workload Installation, Initialization, and Cluster Management

An administrator needs to back up Cisco Secure Workload cluster configuration. Which approach is appropriate?

  1. Copy the controller virtual machine snapshots weekly.
  2. Export the database files directly from the database node filesystem.
  3. Use the cluster's built-in configuration backup and restore capability. Correct answer.
  4. Rely on sensor-side caching of configuration as the backup.

Explanation

Configuration backup is performed through the platform's supported backup mechanism, which produces a restorable copy of cluster configuration. VM snapshots and raw database file copies are not supported backup methods and can corrupt a restore.

Question 45Cisco Secure Workload Installation, Initialization, and Cluster Management

Which statement best describes how Cisco Secure Workload handles high availability across controller nodes?

  1. High availability requires a third-party clustering product.
  2. Only one controller is active; the others remain cold standby.
  3. Controllers operate as a coordinated cluster so services remain available if a node fails. Correct answer.
  4. High availability is provided only by the external load balancer health checks.

Explanation

Controllers run as a coordinated cluster in which services are distributed and remain available when an individual node fails. The load balancer helps redirect client sessions but is not itself the high-availability mechanism.

Question 46Cisco Secure Workload Installation, Initialization, and Cluster Management

A security team wants to integrate Cisco Secure Workload with an external identity provider for user authentication. Which configuration is required on the cluster?

  1. Configure SAML or LDAP integration and map directory groups to cluster roles. Correct answer.
  2. Convert all local accounts to read-only before integration.
  3. Disable the site administrator account before enabling SSO.
  4. Install a sensor on the identity provider server.

Explanation

External authentication is enabled by configuring SAML or LDAP on the cluster and mapping directory groups or attributes to platform roles. Sensors are not installed on identity providers, and the local administrator is retained for recovery.

Question 47Cisco Secure Workload Installation, Initialization, and Cluster Management

What must be configured on the network so that sensors in remote subnets can reach the Cisco Secure Workload cluster?

  1. A dedicated VLAN with no routing to the cluster
  2. Routing and firewall rules permitting outbound TCP 443 from workloads to the cluster external interface Correct answer.
  3. Inbound TCP 443 from the cluster to each workload
  4. SNMP access from the cluster to each workload

Explanation

Sensors initiate outbound connections to the cluster, so routing must exist and firewalls must permit TCP 443 from the workload subnet to the cluster's external interface. The cluster does not initiate inbound connections to workloads for telemetry.

Question 48Cisco Secure Workload Installation, Initialization, and Cluster Management

An administrator is preparing to upgrade a Cisco Secure Workload cluster. Which practice is recommended before starting the upgrade?

  1. Delete the database nodes and re-add them afterward.
  2. Take a supported configuration backup and review the upgrade prerequisites. Correct answer.
  3. Remove all sensors to reduce load during the upgrade.
  4. Disable NTP so clocks do not change during the upgrade.

Explanation

Upgrades should begin with a supported configuration backup and a review of prerequisites such as health checks and available disk space. Removing sensors or database nodes, or disabling time sync, would disrupt the cluster rather than protect it.

Question 49Cisco Secure Workload Installation, Initialization, and Cluster Management

A cluster administrator observes that a sensor shows as disconnected in Cisco Secure Workload. Which troubleshooting step is most direct?

  1. Verify from the workload that the cluster external interface is reachable on TCP 443. Correct answer.
  2. Reinstall the database tier on the cluster.
  3. Replace the external load balancer certificate.
  4. Reboot all controller nodes simultaneously.

Explanation

A disconnected sensor most often indicates a connectivity or certificate-trust problem between the workload and the cluster external interface. Testing reachability on TCP 443 from the workload isolates the fault before any cluster-wide action is considered.

Question 50Cisco Secure Workload Installation, Initialization, and Cluster Management

Which statement correctly distinguishes the management interface from the data interface on a Cisco Secure Workload cluster?

  1. Both interfaces carry identical traffic and are interchangeable.
  2. The management interface carries sensor telemetry; the data interface is for administrators.
  3. The data interface carries sensor telemetry; the management interface is used for administrative access. Correct answer.
  4. The data interface is used only for NTP synchronization.

Explanation

The data interface is the endpoint sensors connect to for telemetry and policy exchange, while the management interface supports administrative access and platform operations. Keeping them distinct allows traffic separation and appropriate firewall policy.