SCAZT Practice Test 18 — 15 Questions

Question 1

Which Cisco technology provides visibility and control over SaaS applications using API-based integration to inspect data at rest?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is an API-based CASB that monitors data at rest in SaaS applications by connecting directly to the cloud provider's APIs.

Answer

Cisco Secure Firewall

Answer

Cisco Stealthwatch

Answer

Cisco Umbrella

Question 2

You are designing a secure hybrid cloud environment and need to ensure that traffic between the public cloud and private data center is inspected. Which architecture pattern is most effective?

Accepted Answer

Centralized inspection via a Transit Gateway with an integrated cloud firewall.. Centralized inspection via a Transit Gateway with an integrated cloud firewall ensures that all traffic between the public cloud and private data center is routed through a single inspection point. The Transit Gateway acts as a hub, and the cloud firewall enforces security policies on inter-VPC and hybrid traffic, providing consistent east-west and north-south inspection.

Answer

Use a public load balancer without any security policies.

Answer

Rely on the cloud provider's default security groups only.

Answer

Allow all traffic to bypass the firewall for maximum speed.

Question 3

Which TWO methods can be used to tunnel traffic from a branch office to the Cisco Umbrella SIG?

Accepted Answer

GRE tunnel. Options D and E are correct because Cisco Umbrella SIG (Secure Internet Gateway) supports tunneling branch-office traffic to its cloud security edge using GRE tunnels and IPsec tunnels, which encapsulate the branch traffic and forward it to Umbrella for inspection and policy enforcement. GRE (D) provides a lightweight, stateless tunnel that Umbrella commonly uses for redirecting traffic from branch routers or edge devices to the SIG. IPsec (E) is also supported and adds encryption and authentication, making it suitable when traffic must be protected in transit between the branch and the Umbrella SIG. DNS-over-HTTPS (A) is a DNS resolution privacy mechanism, not a general traffic-tunneling method to the SIG; Bluetooth (B) is a short-range personal-area wireless technology with no role in branch-to-cloud tunneling; and an explicit HTTP proxy (C) forwards web requests but is not one of the two tunnel methods Umbrella SIG uses for branch traffic redirection.

Answer

DNS-over-HTTPS

Answer

Bluetooth connectivity

Answer

HTTP Proxy (explicit)

Question 4

When configuring a SecureX integration for a third-party product, what is the 'Client ID' used for?

Accepted Answer

To authenticate the API request. In a SecureX integration for a third-party product, the 'Client ID' is used to authenticate the API request. It is part of the OAuth 2.0 client credentials or authorization code flow, identifying the application to the authorization server. It is not related to browser version, dashboard theme, or geographic mapping.

Answer

To identify the user's browser version

Answer

To set the dashboard theme

Answer

To map the integration to a specific geographic region

Question 5

Which TWO actions can a user take if a file is quarantined by Cisco Cloudlock?

Accepted Answer

Read the tombstone file. Option D is correct because when Cisco Cloudlock quarantines a file, it replaces the original with a tombstone file that the user can still read to see the quarantine notice and understand what happened to the content. Option E is correct because Cloudlock provides a remediation workflow in which the user can request a review of the quarantine decision, allowing an administrator or security team to re-evaluate and potentially restore the file. Options A, B, and C are not valid user actions on a quarantined file: moving, deleting the original, or changing permissions would require access to the original file, which Cloudlock has already removed and replaced with the tombstone, and those actions are not part of the standard quarantine remediation options presented to end users.

Answer

Move the file to another folder

Answer

Delete the original file directly

Answer

Change the file permissions

Question 6

Which TWO configuration parameters are required when setting up the Duo Authentication Proxy for an LDAP source?

Accepted Answer

The LDAP server hostname or IP address. Option B is correct because the Duo Authentication Proxy must know where to send LDAP bind and search requests, so the [ldap_server_auto] or [ldap_server] section requires the host parameter specifying the LDAP server's hostname or IP address. Option D is correct because the proxy authenticates to the directory to perform binds and lookups, requiring the service account's bind_dn (distinguished name) and bind_pass (password) in the configuration. Option A is wrong because a user's personal Duo device ID is not part of the proxy's LDAP source configuration; device enrollment and identification are handled by Duo's cloud service, not the proxy's LDAP stanza. Option C is wrong because a public DNS server address is not an LDAP source parameter; name resolution is handled by the host OS, not the Duo Authentication Proxy LDAP configuration. Option E is wrong because the Active Directory domain root password is never required or recommended; the proxy uses a least-privilege bind account, not domain administrator credentials.

Answer

The user's personal Duo device ID

Answer

The public DNS server address

Answer

The root password of the Active Directory domain

Question 7

Which TWO capabilities does Cisco Cloudlock bring to a SaaS environment?

Accepted Answer

Data Loss Prevention (DLP). Cisco Cloudlock is a cloud access security broker (CASB) that provides Data Loss Prevention (DLP) for SaaS environments, so option B is correct: it inspects content in sanctioned cloud apps (e.g., Microsoft 365, Google Workspace, Salesforce) and enforces policies to detect and protect sensitive data such as PII, PCI, and PHI. Option E is also correct because Cloudlock includes User and Entity Behavior Analytics (UEBA) that baselines user activity and detects account compromise indicators like impossible travel, anomalous mass downloads, or suspicious login patterns. The remaining options do not belong: power management for laptops (A) is endpoint hardware/firmware functionality, automatic server patching (C) is a vulnerability/patch management capability, and physical building access control (D) is a physical security function—none of which are Cloudlock SaaS security features.

Answer

Power management for laptops

Answer

Automatic server patching

Answer

Physical building access control

Question 8

Which TWO factors are critical when configuring an automated remediation workflow in Cisco Cloudlock to prevent data loss?

Accepted Answer

Action selection (e.g., Delete, Notify, Quarantine).. Effective remediation requires an action (what to do) and a trigger condition (when to do it based on policy severity).

Answer

Manual user approval for every file deletion.

Answer

Hardware firewall throughput settings.

Answer

Network bandwidth throttling configuration.

Question 9

In the context of cloud compliance, you are reviewing the Cisco Cloudlock dashboard. Which feature allows you to identify users who are sharing sensitive documents publicly across corporate SaaS applications like Google Workspace or Office 365?

Accepted Answer

Policy violations in the Exposure dashboard.. The Exposure dashboard in Cisco Cloudlock aggregates policy violations related to data exposure, including public sharing of sensitive documents across SaaS apps like Google Workspace and Office 365. When a policy is triggered by a user sharing a file publicly, the violation is surfaced in the Exposure dashboard with the user identity, file, and sharing scope. This is the purpose-built view for identifying who is exposing what.

Answer

App firewall configurations.

Answer

SaaS integration connectors.

Answer

DLP incident logs.

Answer

User Behavior Analytics (UBA).

Question 10

Which THREE types of data are commonly visualized in a Cisco Secure Cloud Analytics dashboard?

Accepted Answer

User authentication and identity context. Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) is a cloud-delivered network detection and response service that ingests flow telemetry and identity data to detect threats. Option B is correct because the dashboard correlates user authentication and identity context (e.g., Active Directory, ISE, or cloud IdP data) with observed activity to attribute behavior to specific users and detect compromised credentials. Option C is correct because a core function is modeling host behavior and surfacing anomalies, such as deviations from baseline communication patterns, beaconing, or data exfiltration, which are displayed as entity-level behavioral alerts. Option E is correct because traffic flow metadata (NetFlow/IPFIX, VPC flow logs, and similar records) is the primary telemetry source feeding the dashboards, enabling visibility into conversations, protocols, ports, and byte/packet counts without full packet capture. Option A does not belong because local printer spooler errors are endpoint print-subsystem events unrelated to network flow or identity analytics. Option D does not belong because physical chassis temperature is hardware environmental telemetry collected by device monitoring tools, not cloud security analytics dashboards.

Answer

Local printer spooler errors

Answer

Physical chassis temperature

Question 11

Which TWO methods can Cisco Cloudlock use to notify an administrator of a policy violation?

Accepted Answer

Email notification. Cisco Cloudlock can notify administrators of policy violations via Email notification (A), which sends an alert message to configured administrator email addresses, and via Webhook integration (C), which posts an HTTP callback to a configured external endpoint so that third-party systems (such as SIEM or ticketing platforms) can receive and act on the violation event. These two are the supported alerting/notification mechanisms Cloudlock exposes for policy violations. Physical alarm sound (B) is not a Cloudlock capability since it is a cloud service with no local hardware alerting. Automated phone call (D) and SMS text message (E) are also not supported notification channels in Cloudlock's policy violation alerting.

Answer

Physical alarm sound

Answer

Automated phone call

Answer

SMS text message

Question 12

Which THREE steps are involved in the standard SecureX orchestration lifecycle for a new workflow?

Accepted Answer

Configure credentials. In the SecureX orchestration lifecycle, configuring credentials (A) is a required step because workflows must authenticate to external systems such as Cisco SecureX, threat intelligence APIs, or on-premises tools using stored credential objects before any action can run. Defining workflow logic (D) is also essential, since the workflow's activities, triggers, conditions, and data mappings must be authored in the visual workflow editor to implement the intended automation. Executing and testing (E) is the third correct step, as the workflow must be run manually or via a trigger to validate behavior, inspect execution logs, and confirm outputs before production use. The remaining options do not belong: physical appliance installation (B) is not part of the standard SecureX orchestration workflow lifecycle because orchestration is a cloud-delivered capability, and manual firmware patching (C) is not a workflow lifecycle step since SecureX orchestration is a SaaS service updated by Cisco, not a customer-patched appliance.

Answer

Physical appliance installation

Answer

Manual firmware patching

Question 13

Which TWO actions can be taken in the SecureX 'Threat Response' investigation graph to aid in incident analysis?

Accepted Answer

Adding notes or tags to artifacts to document findings. Option C is correct because the Threat Response investigation graph lets analysts annotate artifacts with notes and tags, which documents findings and preserves investigative context directly within the case. Option E is correct because the graph is built for pivoting: selecting an observable such as an IP, domain, file hash, or URL lets you query integrated Cisco and third-party modules (e.g., AMP, Umbrella, Threat Grid, VirusTotal) to pull related indicators and logs for correlation. The unmarked options do not belong: A (deleting the original alert from the source system) is destructive and outside the graph's analysis scope, B (firmware upgrade on the endpoint) is a remediation action not an investigation action, and D (automatically formatting the infected disk) is a destructive endpoint operation unrelated to incident analysis in SecureX.

Answer

Deleting the original alert from the source system

Answer

Performing a firmware upgrade on the endpoint

Answer

Automatically formatting the infected disk

Question 14

When creating a policy in Cisco Cloudlock, what is the significance of setting a 'Threshold'?

Accepted Answer

To define the minimum number of occurrences to trigger an alert.. Thresholds allow you to define how many times a violation must occur (or how many instances of sensitive data are found) before an incident is triggered, reducing noise.

Answer

To limit the total number of files scanned.

Answer

To set the maximum file size for scanning.

Answer

To assign an expiration date to the policy.

Question 15

Which TWO of the following are required to successfully deploy a SecureX Orchestration workflow that interacts with a Cisco Secure Endpoint API?

Accepted Answer

A configured Orchestration workflow with an API-call activity. Option A is correct because a SecureX Orchestration workflow must contain an API-call activity (e.g., an HTTP Request activity) to actually invoke the Cisco Secure Endpoint REST API endpoints; without that activity the workflow cannot perform the interaction. Option E is correct because the Secure Endpoint API requires OAuth 2.0 authentication, so valid API credentials consisting of a Client ID and Client Secret (generated from the Secure Endpoint console) are mandatory to obtain an access token and authorize the API calls. Option B is not required because Orchestration does not depend on a local SQL server to run workflows. Option C is not required because the workflow interacts with the Secure Endpoint cloud API, not with the Windows endpoint agent, so administrative access to the agent is irrelevant. Option D is not required because a physical serial cable connection has no role in a cloud-based API integration.

Answer

A local SQL server instance

Answer

Full administrative access to the Windows endpoint agent

Answer

A physical serial cable connection