I85PREP
⌘ K
Cisco 300-745 SDSI study materials
Cisco 300-745 SDSI study resources

Cisco 300-745 SDSI: Agent-Based and Agentless Workload Visibility and Inventory

Cisco 300-745 SDSI · Work through your exam, one topic at a time.

All guide sections

Agent-Based and Agentless Workload Visibility and Inventory

This domain tests how Secure Workload actually sees workloads: which telemetry source gives which attributes, and what each source can and cannot do. The exam likes scenarios where the correct answer is decided by a capability gap, not by preference.

Agent-based visibility

  • Linux agent installs as a package (RPM/DEB) as root and builds a kernel module; matching kernel headers are required.
  • Windows agent is an MSI and uses the Windows Filtering Platform for enforcement.
  • Kubernetes: a DaemonSet agent yields pod-level inventory with namespace, deployment and label context.
  • The agent reports the 5-tuple, byte/packet counts, process name and path, user identity, and container ID - context NetFlow cannot provide.
  • Agent modes are visibility (observe only) and enforcement (allow-list programmed into the host firewall).

Agentless visibility

  • NetFlow/IPFIX v9/v10 from switches, routers and firewalls: usually sampled, no process or user context.
  • ERSPAN/SPAN mirrored traffic for deeper analysis, at real capacity cost.
  • Cloud flow logs (AWS VPC Flow Logs, Azure NSG flow logs) plus cloud connectors that import resource tags.
  • Agentless is visibility only; enforcement must be pushed to FTD, ACI, or a load balancer.

Inventory

Inventory is built from discovered attributes (hostname, OS, IP/MAC, cloud tags, Kubernetes labels, installed packages and CVEs) plus curated annotations. Inventory filters are saved queries, and those same queries later define scope membership - a filter with a typo silently produces an empty scope, a classic failure.

Worked example

An estate has 200 RHEL VMs needing enforcement, one Kubernetes cluster, and 40 appliances that cannot take an agent. Design: agent scope for the VMs (enforced on the host), DaemonSet scope for pods selected by namespace/label filters, and a NetFlow-sourced visibility-only scope for the appliances with enforcement performed on the FTD in front of them. One tool, three telemetry sources, three enforcement answers.

Traps

  • Expecting process-level attribution from NetFlow.
  • Installing the agent without matching kernel headers and concluding the agent is broken.
  • Assuming agentless telemetry can enforce, or that sampled flows are accurate enough for byte-level chargeback.
  • Forgetting that a kernel upgrade may require reinstalling or updating the agent module.