SCAZT Practice Test 13 — 15 Questions

Question 1

An administrator needs to ensure that only managed devices can access sensitive data in Box. Which Cisco solution feature enables this verification?

Accepted Answer

Secure Access device posture check.. Cisco Secure Access with device posture checks ensures that only devices meeting minimum security requirements can access defined SaaS applications.

Answer

SAML assertion mapping.

Answer

Cloudlock custom regex matching.

Answer

OAuth token rotation.

Question 2

You are integrating a cloud-native security tool with SecureX. Which authentication method is generally preferred for the API integration?

Accepted Answer

Credential Object. A Credential Object is generally preferred for API integration with SecureX because it securely stores credentials (such as API keys or tokens) in a centralized, encrypted manner and allows for easy rotation and access control. It abstracts the authentication details from the integration code.

Answer

Client-side certificates

Answer

Username/Password in headers

Answer

Hardcoded strings

Question 3

When designing a Secure Access Service Edge (SASE) architecture, which principle best describes the shift from traditional hub-and-spoke networking?

Accepted Answer

Direct-to-cloud connectivity. SASE emphasizes connecting users directly to cloud resources rather than backhauling traffic to a central DC.

Answer

On-premise appliance chaining

Answer

Strict MPLS segmentation

Answer

Identity-agnostic security

Answer

Centralized backhauling

Question 4

A security architect is designing a SASE solution. What is the significance of 'Identity-Based Segmentation' in this design?

Accepted Answer

It allows for access control based on user identity rather than network topology.. Identity-Based Segmentation in SASE decouples access control from physical network location, using user identity (often via IdP integration) to define which resources a user can reach. This is a core Zero Trust principle: never trust, always verify, and enforce least privilege regardless of whether the user is on-prem or remote. It allows consistent policy enforcement across cloud and on-prem environments, which is essential for SASE's converged network and security architecture.

Answer

It allows for faster internet speeds by bypassing the firewall.

Answer

It enables automatic IP address assignment for cloud users.

Answer

It reduces the complexity of managing VLANs.

Question 5

Which feature in Cisco SecureX allows for the visualization of threats across multiple security products, including cloud and on-premises tools?

Accepted Answer

Threat Response. The Threat Response feature in SecureX provides a unified view of threats, correlating data from various integrated tools.

Answer

Casebook

Answer

Orchestration

Answer

Device Inventory

Question 6

You are auditing your Cisco Secure Cloud Analytics environment. Which metric is most critical for identifying potential data exfiltration attempts?

Accepted Answer

Unusual outbound data transfer volumes. Data exfiltration is defined by data leaving the environment, so the most direct indicator is an abnormal spike or pattern in outbound data transfer volume — especially to unfamiliar destinations or at unusual times. Cisco Secure Cloud Analytics baselines normal egress per host and flags deviations, making outbound volume anomalies the primary exfiltration signal.

Answer

CPU usage on cloud instances

Answer

Inbound SSH connection attempts

Answer

Number of active user accounts

Question 7

When integrating Duo with an application that uses the OIDC protocol, where are the 'Client ID' and 'Client Secret' configured?

Accepted Answer

In the Duo Admin Panel application settings. For OIDC integrations, Duo acts as the identity provider and the Client ID and Client Secret are generated and stored in the Duo Admin Panel under the application's settings. These credentials are then copied into the relying application's configuration to establish the OIDC trust.

Answer

In the local workstation registry

Answer

In the user's browser settings

Answer

In the Duo Authentication Proxy config file

Question 8

You are deploying Duo Passwordless authentication. Which factor must be verified on the endpoint before a user can successfully authenticate?

Accepted Answer

The endpoint must have an active WebAuthn-compliant platform authenticator. Duo Passwordless authentication requires the endpoint to have an active WebAuthn-compliant platform authenticator (e.g., Windows Hello, Touch ID, or a security key) to verify the user's identity without a password. This hardware-backed authenticator is the core factor that enables passwordless login.

Answer

The user must be connected to the corporate VPN

Answer

The endpoint must have a Cisco AnyConnect client installed

Answer

The endpoint must have the Duo Authentication Proxy installed

Question 9

During the design of a SOAR playbook for cloud incident response, you need to ensure that evidence collection is preserved in a compliant manner. Which action is recommended when integrating with Cisco Secure Endpoint for forensic data collection?

Accepted Answer

Execute 'Get Forensic Snapshot' through the Secure Endpoint integration.. Executing 'Get Forensic Snapshot' through the Secure Endpoint integration is the recommended action because it captures a point-in-time snapshot of the endpoint's memory and disk state in a forensically sound manner, preserving evidence integrity. This method is automated, compliant, and minimizes disruption.

Answer

Manually SSH into the VM to copy /var/log files.

Answer

Copy files to a local public-facing FTP server for review.

Answer

Delete the VM and restore from a known good backup.

Answer

Trigger a full disk wipe of the instance.

Question 10

Which feature of the Cisco Umbrella SIG is specifically designed to prevent 'Command and Control' (C2) callbacks from infected endpoints?

Accepted Answer

DNS-layer security. The Umbrella DNS layer security identifies and blocks requests to malicious domains associated with C2 infrastructure.

Answer

Firewall-as-a-Service

Answer

SSL Decryption

Answer

Data Loss Prevention

Question 11

You are troubleshooting a workflow where an API call to Cisco Secure Email fails with a 401 error. What is the most likely cause?

Accepted Answer

Expired credentials. A 401 error indicates an authorization issue, likely due to expired or incorrect credentials in the Credential object.

Answer

Network timeout

Answer

Payload syntax error

Answer

Invalid API endpoint URL

Question 12

A firm is adopting SASE and needs to secure mobile devices. Which component of the Cisco SASE suite is best suited to protect mobile endpoints?

Accepted Answer

Cisco Secure Client (formerly AnyConnect) with Umbrella roaming module.. The Cisco Umbrella roaming client (integrated with the AnyConnect/Cisco Secure Client) provides consistent protection for mobile devices off-network.

Answer

Cisco Meraki Systems Manager.

Answer

Cisco Cloudlock.

Answer

Cisco Stealthwatch.

Question 13

When designing for high availability in a SASE architecture, which THREE strategies are recommended?

Accepted Answer

Dual ISP connections at the branch. Option A is correct because dual ISP connections at the branch provide physical path redundancy, so if one carrier or link fails, traffic can fail over to the second ISP and maintain SASE connectivity. Option B is correct because anycast lets the same service IP be advertised from multiple points of presence, so BGP routing automatically steers users to the nearest healthy SASE PoP and reroutes around failures. Option C is correct because redundant IPsec tunnels to different Umbrella data centers ensure that if one tunnel or data center becomes unavailable, the branch can fail over to an alternate tunnel and maintain secure connectivity. Option D is not recommended because assigning static IPs to all cloud users does not improve availability and adds management overhead. Option E is incorrect because disabling security features reduces protection and violates the purpose of a SASE architecture, not high availability.

Answer

Assigning static IPs to all cloud users

Answer

Disabling all security features to improve uptime

Question 14

You are setting up cloud network segmentation. In the context of Secure Access, how are groups of resources isolated from each other?

Accepted Answer

By using Access Rules and Policies. Security Policies and Access Rules are used to control traffic flows between segments in the cloud environment.

Answer

By assigning different DNS suffixes

Answer

By physical VLANs

Answer

By physical cable separation

Question 15

How do you verify if your cloud-native security posture meets a specific compliance framework like PCI-DSS within the Cisco platform ecosystem?

Accepted Answer

Utilize the 'Compliance Dashboard' or report templates in Secure Cloud Analytics. Secure Cloud Analytics (formerly Stealthwatch Cloud) includes a Compliance Dashboard and pre-built report templates that map observed cloud workload behavior and network flows to frameworks such as PCI-DSS, CIS, and NIST. This gives continuous, automated evidence of compliance posture across AWS, Azure, and GCP rather than point-in-time manual checks. The dashboard surfaces control-level pass/fail status and generates exportable reports for auditors.

Answer

Manually verify each firewall rule

Answer

Enable all security features in Umbrella

Answer

Ping all endpoints