SCAZT Practice Test 16 — 15 Questions

Question 1

In a Cisco Secure Access environment, you are applying an application-layer policy to restrict access to a specific SaaS application based on the user's geolocation. Which tool is used to define this access control rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Secure Access Policy rules.. Cisco Secure Access uses Access Policies that integrate with Identity and Context-Aware settings to enforce location-based access to SaaS applications.

Answer

Cloudlock API Gateway.

Answer

Web Security Appliance (WSA) Filter.

Answer

Identity Services Engine (ISE) Policy Sets.

Question 2

A user on a corporate laptop is unable to reach a specific SaaS application that is blocked by the Cisco Secure Access SIG. How can you verify the specific rule causing this block?

Accepted Answer

Use the Activity Search tool in the Secure Access dashboard. The Activity Search tool in the Cisco Secure Access dashboard provides detailed logs of all traffic events, including the specific rule that blocked a request. By searching for the user's identity and the destination SaaS application, you can see the exact policy rule that triggered the block. This is the primary troubleshooting tool for verifying policy enforcement in Secure Access.

Answer

Check the firewall NAT table

Answer

Run 'nslookup' on the destination

Answer

Check the local endpoint hosts file

Answer

Review the Umbrella roaming client logs on the device

Question 3

What is the primary function of the 'Reporting' section in Cisco Defense Orchestrator?

Accepted Answer

Providing visibility into policy usage and device status. The Reporting section in Cisco Defense Orchestrator (CDO) is designed to give administrators visibility into how policies are being used across managed devices and the current operational status of those devices. It aggregates telemetry from firewalls, ASA, FTD, and other managed devices so admins can audit policy deployment, detect drift, and confirm device health. This is distinct from configuration or remediation functions, which live in other CDO sections.

Answer

Configuring VPN settings

Answer

Scanning for malware on endpoints

Answer

Automating firmware updates

Question 4

Which menu in the SecureX dashboard allows you to manage the API clients for third-party integrations?

Accepted Answer

API Clients. The API Clients menu in the SecureX dashboard is where administrators create and manage API clients — credentials (client ID and secret) used by third-party integrations and external applications to authenticate to SecureX APIs. This is the correct location for managing programmatic access.

Answer

Global Settings

Answer

User Management

Answer

Integration Modules

Question 5

What is the primary benefit of deploying a 'Managed' SaaS application configuration in Cisco Umbrella?

Accepted Answer

Granular policy enforcement and visibility.. Managed applications allow for granular visibility and enforcement policies to be applied specifically to those apps, as opposed to generic web traffic.

Answer

Faster internet speed.

Answer

Reduced cloud storage costs.

Answer

Automatic software updates.

Question 6

A security team is deploying Cisco Duo to protect a set of internal web applications accessed through a reverse proxy. They require that users authenticate with Duo before the proxy forwards any request, and they want to enforce this at the network edge without modifying each application. Which Duo deployment component should they implement?

Accepted Answer

Duo Network Gateway (DNG). Duo Network Gateway is the only component that functions as a reverse proxy to protect internal web applications with Duo MFA without modifying each application. It intercepts requests at the network edge, enforces authentication, and then forwards traffic, providing centralized control. The other options either require per-app integration or serve different purposes such as federation or device posture.

Answer

Duo Device Health Application

Answer

Duo Single Sign-On (Duo SSO)

Answer

Duo Authentication Proxy

Question 7

You are analyzing an incident in SecureX. You see an 'Observable' marked in red. What does this indicate?

Accepted Answer

High-severity malicious indicator. Red observables typically indicate a high-severity threat or a known malicious indicator based on intelligence feeds.

Answer

Suspicious but unverified

Answer

Clean/Benign

Answer

Unknown status

Question 8

An analyst is triaging a phishing incident in Cisco SecureX Threat Response. The investigation shows that a user clicked a link, and the analyst wants to determine whether the destination domain has any known malicious associations before deciding whether to escalate. The analyst opens the domain observable and reviews the available intelligence modules. Which action best describes how Threat Response helps the analyst reach a verdict in this situation?

Accepted Answer

It correlates the domain against integrated intelligence sources and displays verdicts, sightings, and related observables in a single investigation view.. Threat Response is designed to accelerate triage by aggregating intelligence about observables such as domains into a single investigation view. It presents verdicts, sightings, and related observables from integrated sources so the analyst can judge whether a clicked domain is malicious and decide on escalation. Enforcement actions like blocking or endpoint isolation belong to separate response tools.

Answer

It automatically blocks the domain at the secure web gateway and records the enforcement action in the investigation timeline.

Answer

It quarantines the user's endpoint and isolates it from the network until the domain reputation is confirmed.

Answer

It decrypts the TLS session between the user and the destination domain to inspect the page content for phishing forms.

Question 9

How does Duo protect an application that does not support modern authentication protocols?

Accepted Answer

By using the Authentication Proxy to perform RADIUS/LDAP validation. For applications that lack modern authentication (no SAML, OIDC, or similar), Duo uses the Authentication Proxy. The proxy sits on-premises and speaks legacy protocols like RADIUS and LDAP to the application, while brokering the authentication to Duo's cloud for MFA. This lets Duo protect older or custom apps without modifying them.

Answer

By installing a local agent on the cloud application server

Answer

By redirecting the user to a SAML 2.0 gateway

Answer

By forcing the user to use a VPN

Question 10

An enterprise is migrating its internet-bound traffic from on-premises proxies to Cisco Umbrella SIG. The security team wants to inspect TLS-encrypted traffic for malware and data exfiltration without breaking certificate validation on managed endpoints. Which deployment consideration is MOST important for this design?

Accepted Answer

Deploy the Umbrella root certificate to all managed endpoints via Group Policy or MDM so that the SIG can perform TLS decryption without generating trust errors.. To inspect TLS traffic, the SIG must terminate and re-establish TLS sessions, which requires endpoints to trust the certificate the SIG presents. Distributing the Umbrella root certificate to managed endpoints through Group Policy or MDM is therefore the essential design step. Virtual appliances address DNS-layer client identification, DNSCrypt only protects DNS transport, and selective PAC-file routing undermines comprehensive inspection of internet-bound traffic.

Answer

Create a PAC file that sends all traffic directly to the internet and only routes known malicious domains through the Umbrella SIG.

Answer

Configure the Umbrella virtual appliances in each data center to forward all DNS queries to the Umbrella resolvers for policy enforcement.

Answer

Enable DNSCrypt on all managed endpoints so that DNS requests are encrypted between the client and the Umbrella resolvers.

Question 11

A network security engineer is configuring Cisco Secure Network Analytics (formerly Stealthwatch) to monitor traffic for a new data center subnet. The engineer needs to ensure that flow data from the Cisco Catalyst switches in that subnet is exported to the Secure Network Analytics Flow Collector. Which protocol should be enabled on the switches to send flow data?

Accepted Answer

NetFlow. Secure Network Analytics relies on flow data to provide network visibility and threat detection. NetFlow is the primary protocol used by Cisco switches to export flow information to a Flow Collector. Enabling NetFlow on the Catalyst switches ensures that the Flow Collector receives the necessary data to monitor the new subnet and establish a baseline for anomaly detection.

Answer

RADIUS

Answer

Syslog

Answer

SNMP

Question 12

In Secure Access, how are 'Traffic Forwarding' profiles used?

Accepted Answer

To define how traffic is routed to the cloud gateway. Traffic Forwarding profiles define which traffic (web, non-web, specific ports) should be sent to the Secure Access cloud.

Answer

To set up load balancing

Answer

To encrypt cloud storage

Answer

To define user roles

Question 13

When designing a Zero Trust architecture using Cisco Secure Access, how does the 'Device Posture' check specifically influence the access decision for a managed laptop?

Accepted Answer

It requires the presence of an MDM-enrolled certificate or specific registry key before authorizing the session.. Device posture checks in Cisco Secure Access verify the health and security configuration of the endpoint before granting access to protected applications.

Answer

It switches the user's connection to a VPN tunnel.

Answer

It forces a mandatory password reset if the device is out of compliance.

Answer

It checks the user's IP address against a geo-blocking database.

Question 14

A security team is designing an automated response for cloud workload alerts. They want the playbook to quarantine a compromised Amazon EC2 instance by changing its security group to a restrictive one, but only after confirming the instance is not tagged as a production asset. Which approach best fits this requirement within Cisco SecureX orchestration?

Accepted Answer

Use a condition node that evaluates the instance's tags, then call an AWS action to modify the security group only when the production tag is absent.. SecureX orchestration can branch on data such as EC2 tags and then execute AWS actions. Combining a condition node with a security group modification action satisfies both automation and the production guardrail. Unconditional termination, a Lambda without tag checks, or manual email approval all either violate the guardrail or abandon automation, so the conditional AWS action approach is correct.

Answer

Configure the playbook to terminate every EC2 instance that generates the alert and let the operations team restore production servers from backups.

Answer

Send an email notification to the cloud team and wait for a manual security group change before the playbook continues.

Answer

Create an AWS Lambda function that always applies the restrictive security group and invoke it from the playbook without any tag evaluation.

Question 15

A financial services company is designing a secure cloud access architecture for its hybrid environment, which includes on-premises data centers and AWS workloads. The security team wants to enforce zero trust network access (ZTNA) to private applications hosted in AWS without exposing those applications to the internet. They already use Cisco Identity Services Engine (ISE) for on-premises identity and Cisco Secure Access as their SASE platform. Which design approach best meets these requirements?

Accepted Answer

Deploy a Cisco Secure Access private resource connector in the AWS VPC, associate it with the private application, and define access policies based on user identity and device posture.. Deploying a private resource connector within the AWS VPC enables Cisco Secure Access to broker connections to private applications without exposing them to the internet. Access decisions are based on user identity and device posture, fulfilling zero trust requirements. This approach integrates with existing ISE and Secure Access components, providing a scalable and secure design for hybrid cloud access.

Answer

Use AWS Security Groups to allow traffic only from the corporate IP range, and deploy Cisco Secure Client with Umbrella Roaming Security on user endpoints.

Answer

Configure an AWS Application Load Balancer with an internet-facing endpoint and use Cisco Umbrella DNS policies to restrict access to authorized users.

Answer

Set up a site-to-site VPN between the on-premises data center and AWS, and use Cisco ISE to authenticate users before they access the application via the VPN.