SCAZT Practice Test 15 — 15 Questions

Question 1

You are building a custom integration in SecureX orchestration to fetch identity data from an external IDP. If the IDP uses OAuth2, which field must be secured using the 'Credential' object type?

Accepted Answer

Client Secret. In OAuth2, the Client Secret is the confidential credential issued to the client by the authorization server. It must be stored securely using the Credential object type in SecureX orchestration to prevent exposure. Client ID, Redirect URI, and Authorization URL are non-secret identifiers and endpoints.

Answer

Redirect URI

Answer

Authorization URL

Answer

Client ID

Question 2

When using Umbrella's 'Selective Proxy', how is the determination made to route traffic through the proxy vs. direct to destination?

Accepted Answer

Based on the domain categorization. The Selective Proxy uses a list of domains (like those known to host malware) to decide whether to route traffic through the proxy for deep inspection.

Answer

Based on the packet source IP

Answer

Based on the browser type

Answer

Based on the time of day

Question 3

How do you access the 'SecureX' suite from another Cisco security console like FMC?

Accepted Answer

Click the SecureX ribbon or icon in the navigation bar. From another Cisco security console such as FMC, you access the SecureX suite by clicking the SecureX ribbon or icon in the navigation bar. Cisco has integrated a consistent SecureX ribbon across its security products, allowing single sign-on and contextual pivoting into the SecureX platform. This ribbon provides direct access to SecureX dashboards, threat response, and orchestration without manually typing URLs or using CLI.

Answer

Run a command from the CLI

Answer

You must type the URL manually into the browser

Answer

Request access via email

Question 4

Where do you manage the Umbrella Roaming Client deployment configuration?

Accepted Answer

Dashboard > Deployments. The Umbrella Roaming Client deployment configuration is managed from Dashboard > Deployments. This section is where administrators download the roaming client installer, generate the associated deployment tokens/keys, and configure the identity and profile settings that the client will use when it registers with Umbrella. It is the dedicated console area for distributing and managing endpoint client rollouts.

Answer

Dashboard > Reporting

Answer

Dashboard > Policies

Answer

Dashboard > Settings > API

Question 5

Which THREE factors are evaluated by the Umbrella policy engine when processing a DNS request?

Accepted Answer

The time of the request. The Umbrella policy engine evaluates the time of the request (C) because policies can be scheduled to apply only during specific hours or days, so the timestamp of the DNS query is a factor in determining which policy applies. It evaluates the identity of the user or device (D) because Umbrella ties DNS requests to identities via the Roaming Client, AD Connector, or Virtual Appliance, allowing different policies per user, group, or device. It evaluates the destination of the request (E) because the requested domain is categorized (e.g., malware, phishing, or content categories) and matched against block/allow lists to decide the verdict. The local browser version (A) is not evaluated, since Umbrella operates at the DNS layer and does not inspect browser software. The color of the hardware (B) is irrelevant, as physical appearance has no bearing on DNS policy decisions.

Answer

The local browser version

Answer

The color of the hardware

Question 6

When a threat response workflow completes, what is the best practice for auditing the action?

Accepted Answer

Update Casebook with findings. Adding a note or updating the associated Casebook incident is the standard way to provide an audit trail of automated actions.

Answer

Send an email to all users

Answer

Take a backup of the database

Answer

Delete the workflow logs

Question 7

Which THREE items are included in a Cisco Cloudlock 'Incident' report?

Accepted Answer

Severity level. Cloudlock incidents provide detailed context including the user involved, the severity of the violation, and the specific file or resource affected.

Answer

BIOS version

Answer

User's home Wi-Fi SSID

Question 8

You are integrating Cisco Secure Access with an IdP. What protocol is used to facilitate this authentication?

Accepted Answer

SAML 2.0. SAML (Security Assertion Markup Language) is the standard protocol used by Cisco Secure Access for cloud-based identity federation.

Answer

LDAP

Answer

SNMP

Answer

ICMP

Question 9

When an alert is triggered in Cisco Secure Cloud Analytics, which action is most appropriate to perform first?

Accepted Answer

Verify the alert in the dashboard and investigate the activity scope. When Cisco Secure Cloud Analytics triggers an alert, the first step is to verify the alert in the dashboard and investigate the scope of the activity. This allows the analyst to confirm whether the alert is a true positive and understand the extent of the potential threat before taking any disruptive action. Immediate disconnection or firmware updates are premature without proper investigation.

Answer

Delete the alert to clear the dashboard

Answer

Immediately disconnect the device from the network

Answer

Update the device firmware

Question 10

What is the primary function of the 'CASB' category in Cisco Umbrella's web policy?

Accepted Answer

To govern application usage and control data movement.. The CASB category in Umbrella allows admins to enforce policies specifically for cloud applications, such as blocking uploads to unsanctioned tenants.

Answer

To scan emails for malware.

Answer

To filter malicious DNS queries.

Answer

To provide VPN connectivity to the cloud.

Question 11

In Cisco Cloudlock, why would you use a 'Custom Regex' pattern in a DLP policy?

Accepted Answer

To detect non-standard sensitive data formats.. Custom Regex patterns allow you to define organization-specific sensitive data formats, such as employee ID numbers or unique project code formats, that aren't in standard templates.

Answer

To increase the storage limit.

Answer

To scan files faster.

Answer

To bypass file encryption.

Question 12

You are configuring a Cisco Cloudlock policy to detect sensitive data in a Salesforce environment. You need to identify instances where credit card numbers are shared publicly. Which specific policy category should you configure?

Accepted Answer

Data Exposure. The Cisco Cloudlock Data Loss Prevention engine uses specific policy categories to identify PII/PCI data, and 'Data Exposure' is the correct category for monitoring sharing settings.

Answer

User Behavior Analytics

Answer

Application Firewall

Answer

Threat Intelligence

Question 13

A user is using a managed laptop. How does 'Device Posture' in the Cisco SASE model verify that an antivirus solution is active?

Accepted Answer

By querying the OS security APIs via the Secure Client agent.. The Cisco Secure Client (AnyConnect) periodically checks the system's security posture and reports status to the policy engine before allowing connectivity.

Answer

By requesting the antivirus vendor to send a status email.

Answer

By checking the user's browser history.

Answer

By scanning the user's files remotely.

Question 14

When configuring Cisco Umbrella for SaaS, how does SSL inspection impact the visibility of application traffic?

Accepted Answer

It enables deep packet inspection of SaaS content.. SSL inspection decrypts traffic, allowing the proxy to inspect the actual payload, which is essential for granular visibility and DLP enforcement within SaaS apps.

Answer

It blocks all encrypted traffic.

Answer

It decreases application performance.

Answer

It removes the need for DNS filtering.

Question 15

Which type of file allows you to import and share a complete workflow design between different SecureX organizations?

Accepted Answer

JSON File. SecureX workflows are exported and imported as JSON files, which serialize the entire workflow definition including nodes, edges, variables, and configuration. This JSON format is what the SecureX orchestration interface uses when you click 'Export' or 'Import' on a workflow, enabling portability between SecureX organizations. The JSON structure preserves the workflow's logic and metadata so it can be reconstructed in the target tenant.

Answer

YAML File

Answer

CSV File

Answer

XML File