SCAZT Practice Test 17 — 15 Questions

Question 1

A multinational enterprise is deploying Cisco Secure Access to secure internet access for its branch offices and remote users. The security team wants to inspect all web traffic for malware and enforce acceptable use policies, but they are concerned about performance and user experience. They plan to use Cisco Secure Access with TLS decryption. Which consideration is most critical when designing the TLS decryption policy to balance security and performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exclude categories of traffic that are privacy-sensitive or not inspectable, such as banking and healthcare, from TLS decryption to avoid legal issues and performance overhead.. Selective TLS decryption is the recommended design to balance security and performance. By excluding privacy-sensitive categories, organizations avoid legal pitfalls and reduce the processing burden, while still inspecting the majority of web traffic for threats. This approach aligns with Cisco best practices for Secure Access and ensures a positive user experience without compromising essential security controls.

Answer

Use a third-party certificate authority for TLS decryption to avoid performance bottlenecks in Cisco Secure Access, and apply decryption to all HTTP and HTTPS traffic.

Answer

Configure TLS decryption only for traffic from remote users, not branch offices, because branch offices have higher bandwidth and can handle the load.

Answer

Enable TLS decryption for all traffic to ensure no malware can hide in encrypted sessions, accepting the performance impact as necessary for security.

Question 2

What are TWO primary ways to trigger an orchestration workflow in SecureX?

Accepted Answer

Manual triggering. Option C (Manual triggering) is correct because SecureX orchestration workflows can be started on demand by an analyst from the SecureX orchestration interface, which is a primary trigger method for ad-hoc response actions. Option D (Webhook ingestion) is correct because SecureX orchestration supports webhook triggers, allowing external systems to initiate a workflow by sending an HTTP request to a unique webhook URL, which is a core event-driven trigger mechanism. Option A (Scheduled reboot) is not a workflow trigger in SecureX; it describes a system action, not an orchestration initiation method. Option B (Console-based typing) is not a supported trigger; workflows are not launched by typing commands into a console. Option E (Direct database injection) is not a valid or supported way to trigger SecureX orchestration workflows and would bypass the intended API/webhook/UI mechanisms.

Answer

Scheduled reboot

Answer

Console-based typing

Answer

Direct database injection

Question 3

Which TWO aspects of threat response are improved by using SecureX orchestration?

Accepted Answer

Reduced response time. SecureX orchestration improves threat response by reducing response time (Option A), because automated workflows (playbooks) trigger remediation actions such as isolating an endpoint or blocking a hash immediately upon alert ingestion, eliminating the delay of manual analyst intervention. It also improves consistent execution (Option B), since the same predefined workflow runs identically on every matching incident, removing human variability and ensuring repeatable, standardized response steps. The remaining options do not belong: increased manual oversight (C) is the opposite of what orchestration provides, as it reduces manual effort; hardware performance (D) is unrelated to an orchestration platform's function; and network latency (E) is a network characteristic that orchestration does not directly improve.

Answer

Increased manual oversight

Answer

Hardware performance

Answer

Network latency

Question 4

During a cloud incident, an analyst needs to block a malicious domain across the organization's Secure Web Appliance and also record the block in the incident's casebook. The team wants a single automated action that performs both steps. Which SecureX orchestration design best achieves this?

Accepted Answer

Build one workflow that first calls the Secure Web Appliance action to add the domain to a block list, then adds a casebook entry with the result.. Chaining a Secure Web Appliance block action with a casebook update inside one workflow delivers both enforcement and documentation in a single automated action. Separate workflows, a mere sighting, or manual email all fail to guarantee both steps. Sequencing the casebook entry after the block also ensures the record reflects the true result.

Answer

Create two independent workflows, one for the block and one for the casebook entry, and rely on analysts to run them in the correct order.

Answer

Use a Threat Response investigation to add the domain as a sighting and assume the Secure Web Appliance will block it automatically.

Answer

Configure an email notification to the network team with the domain and let them block it and update the casebook manually.

Question 5

A security architect is integrating a cloud workload protection platform with Cisco SecureX Threat Response so that detections automatically create investigations. The architect must choose TWO elements that are required for the integration to enrich observables and trigger response actions. (Choose two.)

Accepted Answer

A SecureX orchestration workflow with a trigger that maps the platform's detection events to response actions.. Threat Response integrations need a registered module to declare and enrich observable types, and automated response needs an orchestration workflow bound to a trigger for the platform's events. Together they deliver enrichment and action. Packet capture appliances, dedicated SIEM retention, and custom DNS zones are not functional prerequisites, so they do not belong in the required set.

Answer

A full packet capture appliance deployed at every cloud region to record all east-west traffic.

Answer

A separate SIEM instance dedicated solely to storing the platform's logs for at least one year.

Answer

A public DNS zone that resolves the platform's API endpoints to static IP addresses.

Question 6

Which TWO ways does Cisco SecureX simplify the management of security operations?

Accepted Answer

By providing a centralized console for multi-product investigation. Option A is correct because Cisco SecureX provides a single, centralized console (the SecureX dashboard/ribbon) that aggregates threat intelligence and telemetry from multiple Cisco and third-party security products, enabling analysts to pivot across products during a single investigation rather than logging into each tool separately. Option D is correct because SecureX includes orchestration capabilities (via SecureX orchestration, built on Cisco's acquired automation technology) that let teams build workflows to automate repetitive tasks such as enrichment, containment, and case creation, reducing manual effort in security operations. Options B and C are incorrect because SecureX is a cloud-native security platform that unifies visibility, automation, and threat response; it does not hire personnel or schedule physical guards, which are staffing and physical-security functions outside its scope. Option E is incorrect because SecureX is not a hardware firewall replacement; it integrates with and orchestrates existing security products (including firewalls) rather than replacing firewall hardware.

Answer

By automatically hiring new security analysts

Answer

By providing physical onsite security guard scheduling

Answer

By acting as a hardware firewall replacement

Question 7

A retail company is adopting Cisco Secure Access to secure its cloud applications and internet access. The security team wants to implement a design that provides redundant and highly available connectivity from their branch offices to the Cisco Secure Access cloud. Which two design elements should be included to achieve this? (Choose two.)

Accepted Answer

Deploy multiple Cisco Secure Access tunnels from each branch using diverse underlay paths and configure them in an active/active configuration.. To achieve high availability for branch connectivity to Cisco Secure Access, deploying multiple tunnels over diverse paths in an active/active configuration ensures redundancy and load sharing. Additionally, Cisco Secure Access leverages anycast routing to direct traffic to the nearest available PoP, providing inherent failover. Together, these elements create a resilient design that minimizes downtime and maintains performance.

Answer

Deploy a Cisco Secure Access virtual appliance in each branch to locally terminate tunnels and provide caching.

Answer

Implement a backup VPN to a secondary cloud provider for failover if Cisco Secure Access experiences an outage.

Answer

Use a single Cisco Secure Access tunnel per branch but enable BGP routing to dynamically reroute traffic during failures.

Question 8

A company wants to use Cisco Cloudlock to protect data in a sanctioned cloud application. The security team needs to understand what type of data Cloudlock can inspect for policy violations. Which statement accurately describes Cloudlock's data inspection capability?

Accepted Answer

Cloudlock can inspect file content using predefined and custom regular expressions to detect sensitive data.. Cloudlock's DLP engine inspects file content using predefined and custom regular expressions to detect sensitive data. It scans files in connected cloud applications, both at rest and in motion, allowing enforcement of policies based on content. This capability enables organizations to protect data such as credit card numbers and PII, going beyond metadata inspection.

Answer

Cloudlock can inspect only files that are shared externally, not internal files.

Answer

Cloudlock can inspect only metadata such as file name and owner, not file content.

Answer

Cloudlock can inspect content only in real-time as files are uploaded, not at rest.

Question 9

Which THREE of the following are primary benefits of integrating Cisco products into the SecureX dashboard?

Accepted Answer

Unified visibility across the security portfolio. Option A is correct because SecureX aggregates telemetry from Cisco security products (e.g., Cisco Secure Firewall, Umbrella, Secure Endpoint, Email Security) into a single dashboard, giving unified visibility across the security portfolio. Option B is correct because SecureX includes orchestration capabilities such as Cisco Threat Response and SecureX orchestration workflows, which automate repetitive security actions and response tasks across integrated products. Option C is correct because SecureX correlates events and threat intelligence across products, simplifying threat investigation workflows by letting analysts pivot on observables in one console rather than switching between tools. Option D is not a SecureX benefit, as SecureX is a security analytics, visibility, and orchestration platform and does not perform physical hardware repair. Option E is not a SecureX benefit, since SecureX does not manage or reduce internet bandwidth consumption; that is unrelated to its security integration purpose.

Answer

Automatic hardware repair for Cisco appliances

Answer

Reduced internet bandwidth consumption

Question 10

Which THREE data types are commonly supported by the Cisco Cloudlock DLP engine for pattern matching?

Accepted Answer

Passport Numbers. Cisco Cloudlock's DLP engine is designed to detect and classify sensitive data in cloud applications, and it commonly supports structured personal and financial identifiers for pattern matching, including Passport Numbers (B), Credit Card Numbers (D), and Social Security Numbers (E). These data types have well-defined formats (for example, credit cards validated via the Luhn algorithm and SSNs matching the NNN-NN-NNNN pattern), which makes them ideal for regex- and checksum-based detection. Passport numbers are also included because Cloudlock maintains country-specific patterns for government-issued identity documents. The unmarked options do not belong: Unencrypted binary firmware images (A) and System BIOS versions (C) are not personal or sensitive data categories that Cloudlock's DLP engine targets for pattern matching, as they lack the structured, regulated formats the engine is built to identify.

Answer

Unencrypted binary firmware images

Answer

System BIOS versions

Question 11

Which TWO conditions must be met for a user to be effectively managed by the Umbrella Roaming Client?

Accepted Answer

The organization's policy must be configured in the dashboard. Option A is correct because the Umbrella Roaming Client only enforces protection when the organization's policy has been configured in the Umbrella dashboard; without an assigned policy the client has no rules to apply. Option B is correct because the roaming client software itself must be installed on the device for that device to be managed by Umbrella at all. Option C is incorrect because the roaming client is specifically designed to protect users off the local LAN, so being on the LAN is not a requirement. Option D is incorrect because the client runs as a service and does not require the user to be logged in as an administrator. Option E is incorrect because the roaming client is intended for endpoints such as laptops and workstations, not servers.

Answer

The device must be on the local LAN

Answer

The user must be logged in as an administrator

Answer

The device must be a server

Question 12

Which TWO settings must be correctly configured to ensure that Cisco Secure Access provides effective decryption and inspection of HTTPS traffic?

Accepted Answer

Install the Cisco Secure Access Root Certificate on all client devices.. Option B is correct because Cisco Secure Access performs TLS/SSL interception by acting as a man-in-the-middle, re-signing HTTPS sessions with its own certificate; for clients to trust those re-signed certificates without errors, the Cisco Secure Access Root Certificate must be installed in each device's trust store. Option C is correct because decryption and inspection are policy-driven: the SSL Inspection setting must be enabled in the relevant Web Policy rules so that Secure Access actually decrypts and inspects HTTPS flows rather than merely passing them through. Option A is incorrect because pointing DNS to the ISP's resolver has no bearing on TLS decryption and would bypass Secure Access's DNS-layer security. Option D is incorrect because disabling local firewall rules is unnecessary and weakens endpoint security without enabling HTTPS inspection. Option E is incorrect because manually configuring a browser proxy IP is not how Secure Access decrypts traffic and would not by itself provide certificate trust or SSL inspection policy.

Answer

Set the DNS server to the ISP's DNS resolver.

Answer

Disable all firewall rules on the local machine.

Answer

Configure the browser to use a specific proxy server IP.

Question 13

Which THREE factors influence the user experience when using Duo Passwordless?

Accepted Answer

The browser or platform's support for WebAuthn. Duo Passwordless relies on WebAuthn/FIDO2 to authenticate users, so option A is correct because the browser or platform must support the WebAuthn API (e.g., Chrome, Edge, Safari, Firefox) for the passwordless flow to work at all. Option B is correct because a platform authenticator such as Windows Hello, Touch ID, or Android biometrics is what actually verifies the user locally and produces the WebAuthn assertion, directly shaping whether the experience is smooth or unavailable. Option D is correct because Duo Policy settings for the application determine which authentication methods are permitted and how the passwordless prompt behaves, so they directly affect what the user sees and can do. Option C is not relevant because passwordless authentication does not use the Active Directory password, and option E is not relevant because network speed affects general latency but is not a defining factor in the Duo Passwordless user experience.

Answer

The user's active directory password strength

Answer

The user's network speed

Question 14

When configuring Cisco Duo for SaaS application access, which THREE conditions can be used in a 'Policy' to restrict access to a sensitive application?

Accepted Answer

Operating System version. Option B (Operating System version) is correct because Duo policies can include a device/OS-based condition that evaluates the operating system and version of the accessing endpoint, allowing administrators to block or require step-up authentication for outdated or unmanaged OS versions. Option C (MFA strength) is correct because Duo policies can enforce authentication strength by requiring specific factors or methods (e.g., Duo Push, WebAuthn, verified push, or phishing-resistant MFA), so access to a sensitive SaaS app can be restricted to stronger authentication. Option D (Geographic location) is correct because Duo policies support location-based conditions using geolocation/IP data, enabling administrators to allow, deny, or require additional verification based on the user's country or region. Options A (File size limit) and E (Application bandwidth usage) are not Duo policy conditions; Duo evaluates identity, device, authentication, and network/context signals, not file transfer size or SaaS bandwidth consumption.

Answer

File size limit

Answer

Application bandwidth usage

Question 15

Which TWO settings should be verified if a Cisco Cloudlock API connector to Google Workspace is showing a 'Warning' status?

Accepted Answer

Service account permissions. Option C (Service account permissions) is correct because the Cisco Cloudlock API connector authenticates to Google Workspace using a service account, and if that account lacks the required OAuth scopes or admin-granted domain-wide delegation, the connector cannot retrieve the necessary data and will report a Warning status. Option D (API Token expiration) is correct because Cloudlock's connector relies on OAuth credentials/tokens for the service account; if the token or its associated certificate/credential has expired or been revoked, authentication fails and the connector shows a Warning until the token is refreshed or reauthorized. Option A (Network bandwidth usage) is not a connector-specific setting and would not cause a Warning status for API authentication. Option B (Physical server cooling status) is irrelevant to a cloud-based API connector. Option E (Local DNS server settings) is not a Cloudlock connector configuration and would not typically produce this Warning.

Answer

Network bandwidth usage

Answer

Physical server cooling status

Answer

Local DNS server settings