Cisco · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A user is attempting to access a cloud application protected by Duo SSO. The Duo prompt shows 'Access Denied: Your device is not running a supported browser'. Where is this restriction defined?
In the Active Directory GPO for the user
In the Duo Authentication Proxy configuration file
In the Duo Application configuration under 'Browser Restrictions'
Browser Restrictions in the Duo Application configuration define which browsers are permitted for that protected application. When the user's browser is unsupported, Duo SSO returns 'Access Denied', so this setting is where the restriction originates.
In the local browser settings of the client machine
A user's device is marked as 'Out-of-Date' in Duo. How does the system determine this status?
By analyzing the user's browser user-agent string
By querying the Active Directory server for the last patch date
By the Duo Device Health application reporting the OS version to the Duo Cloud
The Duo Device Health application collects the endpoint's OS version and reports it to Duo's cloud service, which compares it against the minimum version defined in your device health policy. That comparison produces the 'Out-of-Date' status, satisfying the stem's requirement for how Duo determines the flag.
By checking the device's public IP address geolocation
You are implementing Cisco Duo Device Health for a Windows fleet. Users report that they are blocked from accessing cloud apps despite having valid credentials. The Duo Health app reports a missing OS security patch. Which component is responsible for enforcing this posture check during the authentication flow?
Microsoft Conditional Access Policy
Duo Access Policy
The Duo Access Policy defines the device health posture requirements, including the OS patch check, and enforces them during authentication. It is the policy layer that evaluates the Health app's report and blocks access when the constraint is unmet.
Duo Authentication Proxy
Duo Device Health Application
Which Duo feature allows an administrator to visualize the percentage of users who have successfully registered their mobile devices?
Duo Authentication Log
Duo Dashboard
The Duo Dashboard presents enrolment and authentication statistics, including the proportion of users who have completed device registration. Its reporting widgets visualise that percentage, directly satisfying the stem's requirement to see how many users successfully registered their mobile devices.
Duo Policy Editor
Duo Trust Monitor
You are deploying Duo Passwordless authentication. Which factor must be verified on the endpoint before a user can successfully authenticate?
The user must be connected to the corporate VPN
The endpoint must have a Cisco AnyConnect client installed
The endpoint must have the Duo Authentication Proxy installed
The endpoint must have an active WebAuthn-compliant platform authenticator
Duo Passwordless binds authentication to a WebAuthn-compliant platform authenticator, such as Windows Hello or Touch ID, which generates a device-bound cryptographic key pair. Without that active authenticator the endpoint cannot produce the signed assertion, so the stem's verification requirement fails.
An organization uses Duo Access Gateway (DAG) to protect on-premises applications. They want to transition to Duo SSO. What is the primary difference in architecture?
Duo SSO eliminates the need for on-premises server infrastructure for the identity provider
Duo SSO is a cloud-hosted identity provider, so authentication is brokered by Duo's service rather than a local DAG server. This removes the on-premises DAG host and its maintenance, directly satisfying the transition's goal of eliminating local identity provider infrastructure while still protecting the same applications.
Duo SSO supports only SAML 1.0 protocols
Duo SSO requires a dedicated hardware appliance
Duo SSO requires the installation of the Duo Authentication Proxy on a local server
Want more User And Device Security practice?
Practice this domainYou are creating a custom dashboard in SecureX and need to display data from Cisco Secure Endpoint (AMP for Endpoints). Which component must be properly configured first?
Cisco Threat Intelligence Grid
DNS Layer Security Policy
Secure Endpoint Integration Module
The Secure Endpoint Integration Module must be configured first, as it establishes the authenticated API connection between SecureX and Cisco Secure Endpoint that populates dashboard tiles with endpoint data. Without this module, SecureX has no data source, so the dashboard cannot render any Secure Endpoint telemetry.
SecureX Orchestration Workflow
Which capability is provided by the Cisco Umbrella 'Reporting' tab?
Configuration of VPN tunnels
Visibility into blocked domains and security categories
The Reporting tab exposes granular DNS-layer telemetry, letting administrators review which domains were blocked and under which security categories. This directly satisfies the stem's requirement for visibility, since Umbrella logs every DNS request and its policy verdict, providing the audit trail needed to confirm enforcement and investigate suspicious activity.
Automated remediation of endpoint viruses
Real-time packet inspection of encrypted traffic
Where do you view the aggregate security posture score across all integrated Cisco cloud security products in the SecureX dashboard?
Cisco Defense Orchestrator
Cisco Stealthwatch Cloud
Cisco Umbrella Dashboard
SecureX Dashboard
The SecureX dashboard aggregates the security posture score across all integrated Cisco cloud security products, satisfying the stem's requirement to view a consolidated score. SecureX is the platform that normalises and correlates telemetry from integrated products, surfacing the combined posture metric directly on its dashboard rather than in individual product consoles.
You are troubleshooting a missing event in Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud). Which configuration should you verify to ensure the cloud gateway is successfully pushing traffic metadata?
Active Directory integration settings
The local firewall rules on the monitored instance
VPC Flow Logs enablement
Secure Cloud Analytics derives its cloud visibility from VPC Flow Logs, so if logging is disabled on the relevant VPCs or subnets, no metadata reaches the cloud gateway and events never appear. Verify flow log enablement first.
SecureX API token synchronization
You need to export compliance data from the Cisco Security Management Appliance (SMA) regarding web traffic policy violations. Which format ensures the most efficient ingestion into a SIEM via the SecureX orchestration workflow?
CSV
JSON
JSON preserves nested policy-violation fields as structured key–value pairs, so SecureX orchestration can map them directly into SIEM fields without parsing overhead. CSV flattens that hierarchy, and syslog lacks schema, both requiring custom extraction. This satisfies the stem's efficiency constraint for automated ingestion.
XML
When monitoring compliance in Cisco Defense Orchestrator (CDO), which action should you perform to identify out-of-sync configurations across your Cisco ASA and Firepower Threat Defense devices?
Perform a 'Check for Changes' operation
'Check for Changes' queries managed devices and compares their running configuration against the last known state held in Cisco Defense Orchestrator. Any divergence is flagged, which is precisely how out-of-sync configurations on ASA and Firepower Threat Defense devices are identified.
Run a packet capture on the ASA interface
Generate a Compliance Report in SecureX
Reset the device credentials
Want more Visibility And Assurance practice?
Practice this domainWhich component of Cisco's secure cloud access architecture is responsible for performing URL filtering and malware scanning on traffic destined for SaaS applications?
Cisco Secure Endpoint
Cisco Umbrella
Cisco Umbrella enforces DNS-layer and secure web gateway controls, performing URL filtering and malware scanning inline for SaaS-bound traffic. It satisfies the stem's requirement for a dedicated cloud security component, unlike identity brokers or CASB-only offerings, because inspection occurs at the DNS and web proxy layers before sessions reach the SaaS application.
Cisco Cloudlock
Cisco Adaptive Security Appliance
When configuring Cisco Duo for SaaS application access, which THREE conditions can be used in a 'Policy' to restrict access to a sensitive application?
File size limit
Operating System version
Duo policies can evaluate the endpoint's operating system version as a condition, allowing administrators to deny or step-up access from outdated or unpatched platforms. This satisfies the requirement to restrict sensitive SaaS application access based on device posture.
MFA strength
Duo policies support MFA strength as a condition, letting administrators require stronger authentication factors, such as verified push or WebAuthn, before granting access. This directly restricts sensitive SaaS applications to sessions meeting the defined assurance level.
Geographic location
Duo policies can evaluate geographic location, permitting or denying access based on the user's country or region. This satisfies the requirement by blocking logins from unexpected locations, adding a contextual restriction for sensitive SaaS applications.
Application bandwidth usage
In Cisco Umbrella, what is the primary purpose of defining a 'Cloud Application' in the 'App Discovery' dashboard?
To identify and govern Shadow IT usage across the enterprise.
Cloud Application definitions let App Discovery classify traffic to unsanctioned SaaS, exposing Shadow IT usage so it can be governed. This satisfies the requirement to identify and control applications users adopt without IT approval, rather than merely blocking domains.
To pre-authenticate users for that SaaS.
To increase bandwidth for authorized SaaS apps.
To bypass SSL inspection for the application.
You are auditing a Cisco Cloudlock deployment for O365. Which TWO methods can be used to remediate a file that violates a Data Loss Prevention policy?
Delete the file
Deleting the file removes the offending content from O365 entirely, eliminating exposure of the DLP-violating data. This satisfies the stem's remediation requirement because Cloudlock's response actions include deletion, applying directly to the file that breached policy.
Block the user account in Active Directory
Change the file owner
Change sharing level to Private
Changing the sharing level to Private revokes external and broad access while preserving the file, so the DLP violation is remediated without data loss. This satisfies the stem's remediation requirement, as Cloudlock supports modifying sharing permissions as a response action.
Re-encrypt the file with a new key
Which Cisco technology provides visibility and control over SaaS applications using API-based integration to inspect data at rest?
Cisco Cloudlock
Cisco Cloudlock connects to SaaS platforms through their APIs, scanning stored objects and sharing settings to detect sensitive data, malicious apps and risky permissions. This API-based inspection of data at rest satisfies the stem's requirement for visibility and control over sanctioned and unsanctioned SaaS usage.
Cisco Secure Firewall
Cisco Stealthwatch
Cisco Umbrella
You are configuring a Cisco Cloudlock policy to detect sensitive data in a Salesforce environment. You need to identify instances where credit card numbers are shared publicly. Which specific policy category should you configure?
User Behavior Analytics
Data Exposure
Data Exposure policies in Cisco Cloudlock inspect content shared publicly or externally, matching the requirement to detect credit card numbers exposed in Salesforce. Other categories cover malware, privileged users or compliance, not public sharing of regulated data.
Application Firewall
Threat Intelligence
Want more Application And Data Security practice?
Practice this domainYou need to ensure that an incident response playbook in Cisco SecureX automatically updates a case in the Casebook feature. Which action is required in the workflow design?
Post to Incident API
Update Evidence Store
Add Observation to Casebook
Adding an Observation to Casebook writes the workflow's findings into the case record, which is the mechanism that updates it. Without this node, the playbook executes but leaves the Casebook entry unchanged, failing the automatic update requirement.
Sync with Incident Management
When designing a SOAR workflow, what is the best practice for handling errors in a network isolation script?
Implement an Error Catch block
An Error Catch block intercepts failures thrown by the isolation script, preventing the workflow from terminating abruptly. It lets the playbook log the error and continue or retry, satisfying the best-practice requirement for graceful error handling.
Set the workflow to loop on failure
Force terminate the workflow
Disable all notifications
You are building a custom integration in SecureX orchestration to fetch identity data from an external IDP. If the IDP uses OAuth2, which field must be secured using the 'Credential' object type?
Redirect URI
Authorization URL
Client Secret
OAuth2 client credentials grant requires the client secret to authenticate the integration against the IDP's token endpoint. Storing it as a Credential object encrypts the value at rest and masks it in orchestration logs, satisfying the requirement to secure sensitive authentication data rather than exposing it as plaintext.
Client ID
When integrating Cisco Secure Firewall Management Center (FMC) with SecureX, which protocol is primarily used for the exchange of threat intelligence and orchestration commands?
NetFlow
SNMPv3
Syslog
REST API
SecureX integrates with Cisco Secure Firewall Management Center over its REST API, which exposes threat intelligence and orchestration endpoints. This satisfies the stem's requirement for the primary protocol exchanging threat intelligence and orchestration commands between the two platforms.
Which feature in Cisco SecureX allows for the visualization of threats across multiple security products, including cloud and on-premises tools?
Casebook
Orchestration
Threat Response
Threat Response aggregates and correlates observables from integrated cloud and on-premises security products into a single investigation view, satisfying the requirement to visualise threats across multiple disparate tools rather than within one product's own console.
Device Inventory
Which protocol and format are used for the payload when triggering an incoming webhook for a SecureX orchestration workflow?
HTTP POST with JSON
Incoming webhooks in SecureX orchestration accept an HTTP POST whose body carries JSON, satisfying the stem's requirement for both protocol and payload format. The workflow's trigger endpoint parses that JSON into variables, so the request method and content type must match exactly; Microsoft Entra ID authentication is separate from this payload mechanism.
MQTT with binary data
gRPC with Protobuf
HTTP GET with XML
Want more Threat Response practice?
Practice this domainYou need to ensure that all web traffic from a branch office is inspected by the Umbrella SIG. Which configuration step is mandatory on your perimeter router?
Install the Roaming Client on the router
Create a PBR (Policy Based Routing) to direct traffic to the tunnel
Policy-based routing forces branch-originated web traffic into the Umbrella SIG tunnel by matching source subnets and redirecting next-hop, rather than following the default route. This satisfies the stem's mandatory requirement that all web traffic be inspected, since standard destination-based routing would bypass the tunnel entirely.
Define an ACL to permit all traffic to Umbrella
Enable DNS-over-HTTPS on the router
You are implementing Cisco Secure Access and want to use PAC files for browsers. Where must the PAC file be hosted for automatic proxy configuration?
Inside the browser settings directly
On the Secure Access cloud gateway
On an accessible HTTP/HTTPS web server
Browsers retrieve PAC files over HTTP or HTTPS when configured for automatic proxy discovery, so the file must be published on a reachable web server. Cisco Secure Access does not host PAC files itself; it relies on an external HTTP/HTTPS endpoint.
In the local Windows Registry
You are configuring Cisco Umbrella to protect roaming users. Which component must be installed on the endpoint to ensure consistent policy enforcement when the user is off-VPN?
Secure Firewall Management Center
Umbrella Virtual Appliance
AnyConnect Management VPN Tunnel
Cisco Umbrella Roaming Client
The Umbrella Roaming Client installs on the endpoint and forwards DNS queries to Umbrella regardless of network location, so policy is enforced when the user is off-VPN. This satisfies the consistent-enforcement constraint by removing dependence on corporate network or VPN tunnel presence.
A user on a corporate laptop is unable to reach a specific SaaS application that is blocked by the Cisco Secure Access SIG. How can you verify the specific rule causing this block?
Use the Activity Search tool in the Secure Access dashboard
Activity Search in the Secure Access dashboard logs every request with its matched policy rule, so filtering by user and destination domain reveals the exact blocking rule. This directly satisfies the stem's requirement to identify the specific rule, unlike traffic captures or endpoint logs that show the block without naming the enforcing policy.
Check the firewall NAT table
Run 'nslookup' on the destination
Check the local endpoint hosts file
Review the Umbrella roaming client logs on the device
In Cisco Secure Access, you need to configure a Global Policy to block access to specific cloud applications based on risk levels. Where do you define this logic?
Policy > Global Policy > Access Rules
Global Policy Access Rules define the ordered rule logic that evaluates traffic and applies block or allow actions based on destination risk. Configuring cloud application risk conditions here satisfies the requirement to block apps by risk level.
Global Settings > Cloud Connectors
Connectors > Internet Gateway
Devices > Endpoint Profiles
You are troubleshooting an Umbrella SIG tunnel connection. The IPsec tunnel is up, but users report timeouts. What is the most likely cause if the tunnel MTU is not adjusted correctly?
MTU mismatch causing packet fragmentation
An unadjusted tunnel MTU lets large packets exceed the path limit, so they are dropped rather than fragmented, producing timeouts despite the IPsec tunnel showing up. Lowering the tunnel MTU prevents this black-holing, satisfying the scenario's requirement that oversized traffic traverse the tunnel successfully.
DNS resolution failure in the tunnel
Incorrect IKEv2 Phase 2 proposal
Missing Proxy PAC file
Want more Network And Cloud Security practice?
Practice this domainA user is attempting to access a SaaS application, but the session is blocked by Cisco Cloudlock due to a detected policy violation. Which component is responsible for analyzing the API calls and triggering the remediation?
Cloudlock CASB API engine
The Cloudlock CASB API engine connects out-of-band to the SaaS tenant's APIs, inspecting objects and activities for policy violations and triggering remediation such as blocking or quarantining. This satisfies the stem's requirement for the component analysing API calls.
Duo Authentication Proxy
AnyConnect SASE client
Umbrella SIG proxy
Which THREE factors should be considered when designing an IaaS security architecture using Cisco Secure Workload (formerly Tetration)?
Physical switch port mirroring
Global firewall rule consolidation
Identity-based policy enforcement
Cisco Secure Workload enforces microsegmentation using identity-based policies derived from workload labels, tags, and process behaviour rather than IP addresses. This satisfies the stem's IaaS design requirement, since dynamic cloud workloads change addresses frequently, making static IP rules unmanageable.
Application dependency mapping
Secure Workload builds behavioural baselines from flow telemetry, so application dependency mapping reveals actual workload-to-workload communication. This satisfies the IaaS design constraint of discovering east-west traffic that agentless cloud controls cannot see, letting policy be scoped to genuine dependencies rather than assumed ones.
Host-based sensor deployment
Host-based sensors on each workload capture process-level telemetry, including inter-process and inter-container flows. This satisfies the IaaS constraint where cloud-native flow logs lack process context, enabling Secure Workload to enforce microsegmentation policy at the workload itself.
When designing a Secure Access Service Edge (SASE) architecture, which principle best describes the shift from traditional hub-and-spoke networking?
On-premise appliance chaining
Strict MPLS segmentation
Direct-to-cloud connectivity
Direct-to-cloud connectivity removes the need to backhaul branch traffic through a central data centre, letting users reach SaaS and internet resources directly. This satisfies the SASE requirement for identity-aware, policy-driven access at the edge, with Microsoft Entra ID enforcing conditional access regardless of user location.
Identity-agnostic security
Centralized backhauling
You are configuring a SASE design to secure traffic from a branch office to the cloud. What is the recommended method for routing internet-bound traffic from the branch to the Cisco Umbrella SIG?
Configure DNS forwarding only.
Use an AnyConnect agent on every endpoint in the branch.
Deploy a local proxy server that intercepts all traffic.
Establish an IPsec tunnel from the branch edge device to the nearest Umbrella data center.
An IPsec tunnel from the branch edge to the nearest Umbrella data centre satisfies the stem's requirement for routing internet-bound branch traffic into the SIG. This is Umbrella's Tunnel-to-SIG model, which forwards all branch egress traffic to Umbrella for DNS-layer and secure web gateway inspection without requiring client agents on every endpoint.
When designing a Zero Trust architecture using Cisco Secure Access, how does the 'Device Posture' check specifically influence the access decision for a managed laptop?
It switches the user's connection to a VPN tunnel.
It forces a mandatory password reset if the device is out of compliance.
It checks the user's IP address against a geo-blocking database.
It requires the presence of an MDM-enrolled certificate or specific registry key before authorizing the session.
Device Posture evaluates endpoint state before granting access; requiring an MDM-enrolled certificate or specific registry key verifies the laptop is managed and compliant, so the trust decision reflects device health rather than user identity alone.
Which component of the Cisco SASE architecture provides the primary security enforcement point for remote users browsing the web from untrusted networks?
Cisco Umbrella SIG
Cisco Umbrella SIG is the cloud-delivered security enforcement layer, performing DNS-layer and full-proxy inspection plus policy enforcement for remote users on untrusted networks. It satisfies the stem's requirement for a primary enforcement point without backhauling traffic to headquarters.
Cisco Firepower Threat Defense (FTD)
Cisco Meraki MX
Cisco Identity Services Engine (ISE)
Want more Cloud Security Architecture practice?
Practice this domainThe vendor does not publish an exact question count for the SCAZT; the exam lasts 90 minutes. Always confirm current details on the vendor's official exam page.
CLI output interpretation, network topology analysis, routing behaviour, switching concepts, troubleshooting, and configuration questions.
The exam covers 6 domains: User And Device Security, Visibility And Assurance, Application And Data Security, Threat Response, Network And Cloud Security, Cloud Security Architecture. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Cisco SCAZT exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.