SCAZT Practice Test 12 — 15 Questions

Question 1

A company wants to prevent users from using personal devices for work. Which Duo policy is most effective for this?

Accepted Answer

Trusted Endpoints policy with certificate requirement. Duo's Trusted Endpoints policy with certificate requirement verifies that the device accessing protected applications possesses a valid device certificate issued by your organization's MDM or Duo's own certificate authority. Personal devices that are not enrolled and do not have the certificate are denied access, effectively blocking BYOD. This is the most direct and enforceable control for restricting access to corporate-managed devices.

Answer

Browser version policy

Answer

Geographic location policy

Answer

MFA prompt frequency policy

Question 2

Which THREE factors influence the performance of a SASE deployment?

Accepted Answer

Encryption processing overhead. Encryption processing overhead (A) is correct because SASE relies heavily on IPsec and TLS tunnels between branches/users and the security service edge, and the CPU/ASIC cost of encrypting and decrypting that traffic directly limits throughput and adds latency. Internet circuit quality (C) is correct because SASE delivers security and networking from the cloud, so packet loss, jitter, and available bandwidth on the underlying WAN/ISP links determine the user experience regardless of the provider's capacity. Distance to the nearest cloud edge node (E) is correct because SASE points of presence (PoPs) terminate tunnels and enforce policy; greater geographic or network distance increases round-trip latency and reduces performance. The number of users logged into the console (B) affects only administrative sessions, not data-plane traffic, and the version of the office software (D) is an endpoint application concern unrelated to SASE transport or security processing.

Answer

The number of users logged into the console

Answer

The version of the office software

Question 3

An organization requires that users on iOS devices must have a passcode enabled to access cloud resources. Which Duo feature enforces this?

Accepted Answer

Duo Mobile Application Policy. Duo Mobile Application Policy allows administrators to define security requirements for the Duo Mobile app itself, including requiring a device passcode (screen lock) on iOS and Android before the app can be used to approve authentication requests. This directly enforces the passcode requirement for accessing cloud resources protected by Duo.

Answer

Active Directory GPO for iOS

Answer

MDM solution integration

Answer

Duo Authentication Proxy RADIUS rule

Question 4

Which THREE of the following are components of the Duo 'Trusted Endpoints' solution?

Accepted Answer

An MDM/UEM solution for device management. Option A (an MDM/UEM solution for device management) is correct because Duo Trusted Endpoints relies on an MDM/UEM platform (such as Intune, Jamf, or Workspace ONE) to enroll, manage, and report the compliance/management state of devices that Duo then evaluates. Option B (a Duo policy configured to require trusted endpoints) is correct because the enforcement mechanism is a Duo policy setting that requires the accessing device to be a trusted endpoint before granting access to the protected application. Option D (a device certificate on the endpoint) is correct because Duo Trusted Endpoints uses a client certificate issued to the managed device as the cryptographic proof of trust that the Duo service validates during authentication. Option C (local firewall on the endpoint) is not part of the solution, since host firewalls control network traffic and play no role in Duo's device trust verification. Option E (Active Directory domain controller) is not a component of Trusted Endpoints, as AD provides identity authentication and directory services rather than the device-trust management and certificate validation that the solution requires.

Answer

Local firewall on the endpoint

Answer

Active Directory domain controller

Question 5

You are reviewing the SecureX 'Threat Response' module. Which THREE actions can you perform directly from the investigation canvas once you have identified a malicious file hash? (Choose three.)

Accepted Answer

Search for the hash across integrated security products.. Option B is correct because the Threat Response investigation canvas lets you pivot a file hash across all integrated security products (e.g., Secure Endpoint, Umbrella, AMP) to see where else that indicator appears. Option D is correct because from the canvas you can pivot directly to the Secure Endpoint file trajectory view, which shows the hash's execution and propagation history on the endpoint. Option E is correct because the canvas provides a Secure Endpoint response action to isolate the affected endpoint, containing the threat while investigation continues. Option A is not a capability of the Threat Response module, as it cannot alter an ISP's global DNS configuration. Option C is not offered as a canvas action; remote shell execution for file deletion is not a supported Threat Response pivot or response action.

Answer

Modify the global DNS configuration for the ISP.

Answer

Execute a remote shell on the endpoint to delete the file.

Question 6

Which THREE criteria are used by Cisco Secure Access to determine if a connection should be allowed?

Accepted Answer

User identity. Cisco Secure Access enforces zero-trust access decisions based on who the user is, so User identity (A) is correct because the service authenticates the user and applies identity-based rules. Device posture (C) is correct because Secure Access evaluates endpoint security state (for example, OS patch level, disk encryption, and antivirus status) before granting access. Application-specific access policy (D) is correct because Secure Access applies granular policies per application or destination, determining whether that particular connection is permitted. The remaining options are not access criteria: the time of day the office was built (B) is irrelevant to security policy, and the user's favorite programming language (E) has no bearing on authentication, posture, or policy evaluation.

Answer

The time of day the office was built

Answer

The user's favorite programming language

Question 7

Which THREE components are critical to consider when designing a 'cloud security reference architecture'?

Accepted Answer

Identity and Access Management (IAM). Identity and Access Management (IAM) is correct because a cloud security reference architecture must define how identities are authenticated, authorized, and governed across cloud services, typically using centralized identity providers, federation (SAML/OIDC), and least-privilege role-based access control. Workload security is correct because the architecture must protect compute instances, containers, serverless functions, and their runtime environments through hardening, vulnerability management, segmentation, and workload-level policy enforcement. Secure Internet Gateway (SIG) is correct because it provides a cloud-delivered security control point for DNS-layer security, secure web gateway, firewall, and CASB functions, which are essential for governing internet-bound and SaaS traffic in a cloud architecture. Physical server cooling systems (A) and the brand of the office chair (E) are not architectural security components; cooling is a data center facilities concern typically abstracted away by the cloud provider, and office furniture has no bearing on cloud security design.

Answer

Physical server cooling systems

Answer

The brand of the office chair

Question 8

When migrating from an explicit proxy to the Umbrella SIG, what is the primary challenge for legacy applications?

Accepted Answer

Hardcoded proxy configurations may break. Legacy applications often have hardcoded proxy settings or require specific authentication methods that may not be supported by the cloud SIG.

Answer

The OS must be upgraded

Answer

The local DNS server will fail

Answer

The bandwidth requirement increases

Question 9

Which TWO of the following are primary benefits of Cisco Umbrella DNS-layer security?

Accepted Answer

Uses a cloud-native architecture. Option B is correct because Cisco Umbrella is built on a cloud-native architecture, meaning its DNS resolution and security enforcement are delivered from globally distributed cloud infrastructure rather than on-premises hardware, so protection follows users wherever they connect. Option E is correct because Umbrella inspects DNS queries and blocks malicious domains at the DNS layer, preventing the connection from ever being established to the attacker's infrastructure, which stops threats earlier than post-connection inspection. Option A is incorrect because Umbrella does not require manual firewall updates; policy is managed centrally in the cloud dashboard. Option C is incorrect because Umbrella is a cloud-delivered service and does not need a physical appliance at each site. Option D is incorrect because Umbrella can protect roaming users and unmanaged or BYOD devices via DNS settings or the roaming client, not only corporate-managed endpoints.

Answer

Requires manual firewall updates

Answer

Requires a physical appliance at every site

Answer

Only works on corporate-managed devices

Question 10

What is the primary benefit of the Cisco Umbrella 'Global Network' architecture?

Accepted Answer

It provides low-latency connectivity via Anycast. Cisco Umbrella's Global Network is built on a globally distributed Anycast DNS infrastructure. Anycast allows the same IP address to be advertised from multiple points of presence (PoPs) worldwide, so a user's DNS query is automatically routed to the nearest available PoP. This minimizes latency and ensures fast, reliable resolution and enforcement of security policies without backhauling traffic to a central data center.

Answer

It acts as an ISP replacement

Answer

It eliminates the need for bandwidth

Answer

It automatically updates the OS

Question 11

You notice that some of your users are bypassing the Umbrella SIG by using a personal VPN. What is the most effective way to prevent this with Cisco products?

Accepted Answer

Block 'Proxy and Filter Avoidance' categories in the Web Policy. Umbrella's Web Policy includes a 'Proxy and Filter Avoidance' category that blocks known VPN, proxy, and anonymizer services used to circumvent DNS-layer and SIG filtering. Blocking that category prevents users from reaching the very tools (personal VPNs, Tor, web proxies) that would let them bypass Umbrella. This is the native, scalable control within the Umbrella platform itself.

Answer

Install a local firewall on all machines

Answer

Set the TTL on DNS queries to 0

Answer

Disable the user's internet

Question 12

Which TWO identity sources can be integrated with Cisco Duo for user authentication?

Accepted Answer

OpenLDAP. Duo integrates with standard directories like Active Directory and LDAP.

Answer

Excel spreadsheet export

Answer

Local printer configuration file

Answer

Router configuration file

Question 13

Which Cisco Umbrella feature allows you to categorize destinations and apply custom block or allow lists?

Accepted Answer

Destination Lists. Destination Lists in Cisco Umbrella allow administrators to create custom lists of domains, URLs, or IPs that can be allowed or blocked regardless of content category. They are applied within Policy Rules to override default categorization. This is the feature specifically designed for custom block/allow lists.

Answer

Content Categories

Answer

Identity Providers

Answer

Policy Rules

Question 14

Which component of the Cisco SASE architecture provides the primary security enforcement point for remote users browsing the web from untrusted networks?

Accepted Answer

Cisco Umbrella SIG. The Cisco Umbrella Secure Internet Gateway (SIG) provides the cloud-native security stack for remote users.

Answer

Cisco Firepower Threat Defense (FTD)

Answer

Cisco Meraki MX

Answer

Cisco Identity Services Engine (ISE)

Question 15

Which feature in Cisco Cloudlock allows administrators to view a dashboard of users who are behaving outside of their normal baseline?

Accepted Answer

UBA. Cloudlock's UBA (User Behavior Analytics) module uses machine learning to establish a baseline and flag anomalies.

Answer

App Firewall

Answer

Policy manager

Answer

DLP engine