SCAZT Practice Test 11 — 15 Questions

Question 1

Which THREE pieces of information are displayed in the Umbrella 'Activity Search' report?

Accepted Answer

Identity that initiated the request. Option A is correct because the Umbrella Activity Search report shows the identity (the user or internal IP/identity) that initiated the DNS request, allowing admins to attribute traffic to a specific person or device. Option B is correct because the report displays the action taken on each request, such as Allowed or Blocked, based on the applied security policy. Option E is correct because each entry includes a timestamp showing when the request occurred, which is essential for chronological investigation and correlation with other logs. Option C is not included because the report concerns DNS/web request metadata, not endpoint hardware details like a hard drive serial number. Option D is not included because passwords are never displayed in reporting; Umbrella logs authentication identities, not credentials.

Answer

Internal hard drive serial number

Answer

User's password

Question 2

Which THREE types of activities are commonly used in SecureX orchestration playbooks for threat containment?

Accepted Answer

Update firewall access policy. In SecureX orchestration playbooks, threat containment typically involves taking direct, automated actions against the affected assets or access paths. Option A (Update firewall access policy) is correct because modifying firewall rules to block malicious IPs, domains, or ports is a standard containment action that limits an attacker's ability to communicate with command-and-control infrastructure or move laterally. Option C (Isolate endpoint) is correct because isolating a compromised endpoint via EDR or network quarantine cuts off the host from the network while preserving it for forensic investigation, which is a core containment technique. Option E (Disable user account) is correct because disabling a compromised or suspicious user account prevents further unauthorized access and stops the attacker from using those credentials to pivot or persist. Option B (Clear browser cache) is not a containment activity — it is a remediation or hygiene step that does not stop an active threat. Option D (Restart the operating system) is not containment either; rebooting may disrupt volatile evidence and does not reliably prevent an adversary from continuing their activity.

Answer

Clear browser cache

Answer

Restart the operating system

Question 3

You are designing a secure remote access solution for a hybrid cloud environment. Which Cisco technology should you implement to replace a traditional VPN while enforcing Zero Trust principles?

Accepted Answer

Cisco Secure Access (ZTNA). Cisco Secure Access (the ZTNA offering) provides per-application access based on identity and posture, replacing the broad network access of a VPN.

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Meraki Client VPN

Answer

Cisco Firepower VPN

Question 4

Which THREE factors can be evaluated by Duo Device Health during an access request?

Accepted Answer

OS version and patch level. Duo Device Health evaluates endpoint posture attributes at access time, and OS version and patch level (B) is one of its supported checks, allowing policies to require a minimum OS build or patch state before granting access. Disk Encryption status (D) is also a native Device Health signal, so administrators can block or step-up authentication for devices whose drives are not encrypted (e.g., BitLocker, FileVault). Antivirus status (E) is likewise collected, letting policies verify that a recognized AV product is installed, running, and up to date. The remaining options are not Device Health factors: active Internet connection speed (A) is a network performance metric, not a posture attribute Duo reports, and the user's current GPS location (C) is not gathered by Duo Device Health for access evaluation.

Answer

Active Internet connection speed

Answer

User's current GPS location

Question 5

In a SOAR playbook, which THREE types of data can be used to enrich an incident within a case?

Accepted Answer

File hash analysis. In a SOAR playbook, enrichment adds context to an incident by querying threat-intelligence and analysis services. Option A (File hash analysis) is correct because submitting an MD5/SHA-256 hash to services like VirusTotal or a sandbox returns detections, malware family, and prevalence data that directly enrich the case. Option D (Domain age and ownership) is correct because WHOIS/RDAP lookups return registrar, creation date, and registrant details, and newly registered or privacy-shielded domains are strong indicators of malicious infrastructure. Option E (IP Reputation) is correct because reputation feeds (e.g., AbuseIPDB, VirusTotal, Talos) return geolocation, ASN, and threat scores for an IP observed in the incident. Option B (Browser version history) is not a standard enrichment data type in SOAR playbooks; it is endpoint inventory/patch data, not threat context. Option C (User physical location) is not typically used for enrichment in this context; identity/asset context such as department or manager may be pulled from a CMDB or directory, but physical location is not a standard enrichment source.

Answer

Browser version history

Answer

User physical location

Question 6

Which THREE settings are part of the 'Authentication Policy' in the Duo Admin Panel?

Accepted Answer

MFA prompt behavior (e.g., auto-push). In the Duo Admin Panel, the Authentication Policy is a global policy that governs how users authenticate, and it explicitly includes the MFA prompt behavior setting (B), such as auto-push and whether users can choose among push, phone call, or passcode, which controls the second-factor experience. It also includes Authorized networks (C), which define IP ranges or CIDR blocks from which users can authenticate without MFA or with reduced requirements, directly shaping authentication enforcement. It further includes Remembered devices duration (E), which sets how long a device can be trusted to skip Duo MFA (for example, 1 to 30 days), a core element of the authentication policy. Hardware token assignment (A) is managed under device/token management and user enrollment rather than the Authentication Policy, and AD forest trust configuration (D) belongs to Active Directory or directory integration settings, not the Authentication Policy.

Answer

Hardware token assignment

Answer

AD forest trust configuration

Question 7

An organization is using Cisco Duo for MFA and wants to monitor for suspicious administrative activity. Which report type in the Duo dashboard provides the most granular visibility into changes made to global settings by an administrator?

Accepted Answer

Administrator Actions Log.. The Administrator Actions Log in the Cisco Duo dashboard records administrative changes such as modifications to global settings, user/group changes, integration updates, and policy edits, along with the admin identity and timestamp. This is the report specifically designed to provide granular visibility into administrative activity, making it the correct answer for monitoring suspicious admin behavior.

Answer

Device Insights Report.

Answer

Telephony Usage Report.

Answer

Integration Health Check.

Answer

Authentication Logs.

Question 8

You are configuring a SASE design to secure traffic from a branch office to the cloud. What is the recommended method for routing internet-bound traffic from the branch to the Cisco Umbrella SIG?

Accepted Answer

Establish an IPsec tunnel from the branch edge device to the nearest Umbrella data center.. IPsec tunnels from the branch edge device (such as a Cisco ISR or Meraki MX) to the Cisco Umbrella SIG provide a secure, encrypted transit for all traffic.

Answer

Configure DNS forwarding only.

Answer

Use an AnyConnect agent on every endpoint in the branch.

Answer

Deploy a local proxy server that intercepts all traffic.

Question 9

A user is experiencing 'SSL Certificate Mismatch' errors. You suspect it is caused by the Umbrella proxy. How do you resolve this permanently?

Accepted Answer

Install the Umbrella Root CA certificate on the endpoint. The 'SSL Certificate Mismatch' error occurs because the Umbrella proxy intercepts SSL traffic and presents its own certificate, which the endpoint does not trust. Installing the Umbrella Root CA certificate on the endpoint allows the endpoint to trust the proxy's certificate, resolving the mismatch permanently.

Answer

Disable SSL decryption in the policy

Answer

Update the browser

Answer

Add the domain to the 'Always Allow' list

Question 10

Which THREE features are provided by the Cisco Umbrella 'Deployments' menu?

Accepted Answer

Virtual appliance setup. The Cisco Umbrella Deployments menu is where administrators configure the various ways endpoints and networks connect to Umbrella's resolvers. Option A (Virtual appliance setup) is correct because the Deployments section provides the virtual appliance (VA) for on-premises DNS forwarding to Umbrella, including its download, registration, and configuration. Option D (Network tunnel configuration) is correct because Deployments lets you create and manage network tunnels (IPsec/Umbrella tunnels) that forward DNS traffic from a network to Umbrella. Option E (Roaming client configuration) is correct because the same menu hosts roaming client (Umbrella Roaming Client) deployment, including identity, profile, and download settings for endpoints. Option B (Custom logo upload for the login page) is not part of Deployments; branding is handled under Admin/Account settings, not deployment configuration. Option C (Hardware firmware update schedule) is not an Umbrella Deployments feature, as Umbrella is a cloud-delivered service and does not manage hardware firmware schedules.

Answer

Custom logo upload for the login page

Answer

Hardware firmware update schedule

Question 11

You are troubleshooting an Umbrella SIG tunnel connection. The IPsec tunnel is up, but users report timeouts. What is the most likely cause if the tunnel MTU is not adjusted correctly?

Accepted Answer

MTU mismatch causing packet fragmentation. When an IPsec tunnel's MTU is not adjusted, large packets get encapsulated with additional IPsec headers, exceeding the path MTU and requiring fragmentation. If DF (Don't Fragment) is set and ICMP is blocked, packets are silently dropped, causing the timeouts users report even though the tunnel shows as up.

Answer

DNS resolution failure in the tunnel

Answer

Incorrect IKEv2 Phase 2 proposal

Answer

Missing Proxy PAC file

Question 12

What does the 'Umbrella dashboard' allow you to do regarding DNS security?

Accepted Answer

Configure global security policies and view reports. The Umbrella dashboard is the central management interface for configuring global security policies, viewing reports, and managing all aspects of DNS security. It allows administrators to set block lists, allow lists, and custom policies that apply across the organization. Additionally, it provides detailed reporting and analytics on DNS requests and security events.

Answer

Provision new ISP links

Answer

Manage local server hardware

Answer

Flash router firmware

Question 13

What is the primary benefit of the Duo Universal Prompt compared to the traditional iframe-based prompt?

Accepted Answer

It is a hosted redirect that provides a more secure and consistent experience. The Duo Universal Prompt is a hosted, redirect-based authentication experience that replaces the traditional iframe-based prompt. Because it is hosted by Duo rather than embedded in the customer's page, it provides a more secure and consistent experience across browsers and devices, and it is not subject to the restrictions and security risks of iframes (e.g., clickjacking, third-party cookie blocking). This design also simplifies integration and future feature rollouts.

Answer

It supports offline authentication only

Answer

It removes the need for mobile devices

Answer

It requires less bandwidth

Question 14

You are investigating a security incident and need to correlate logs from Cisco Secure Endpoint and Cisco Umbrella. What is the key piece of information needed to link these two sets of logs in SecureX?

Accepted Answer

A shared identifier like an internal IP address or user identity. To correlate logs from Cisco Secure Endpoint and Cisco Umbrella in SecureX, a shared identifier such as an internal IP address or user identity is essential. SecureX uses these identifiers to link events across different security products, enabling a unified view of the incident. Without a common identifier, correlation is not possible.

Answer

The browser version used by the user

Answer

The source MAC address only

Answer

The time the laptop was manufactured

Question 15

You need to ensure that all web traffic from a branch office is inspected by the Umbrella SIG. Which configuration step is mandatory on your perimeter router?

Accepted Answer

Create a PBR (Policy Based Routing) to direct traffic to the tunnel. To ensure all web traffic from a branch office is inspected by Umbrella SIG, the perimeter router must be configured with Policy Based Routing (PBR) to redirect traffic into the IPsec tunnel that connects to Umbrella's SIG infrastructure. PBR overrides the default routing table and forces traffic matching specific criteria (e.g., all HTTP/HTTPS) through the tunnel interface. Without PBR, traffic would follow normal default routes and bypass the tunnel.

Answer

Install the Roaming Client on the router

Answer

Define an ACL to permit all traffic to Umbrella

Answer

Enable DNS-over-HTTPS on the router