SCAZT Practice Test 19 — 15 Questions

Question 1

Which THREE items are included in a Duo Authentication Log entry?

Accepted Answer

The result of the authentication (Success/Failure). Option B is correct because every Duo Authentication Log entry records the authentication result, showing whether the attempt was a Success, Failure, or another outcome such as Denied or Fraud. Option D is correct because each log entry includes the timestamp (date and time) of the authentication attempt, which is essential for auditing and correlating events. Option E is correct because the log identifies the username of the authenticated user, allowing administrators to trace activity to a specific account. Option A is not included because Duo never stores or logs the user's plain-text password; credentials are handled by the primary authentication source and Duo processes only the second factor. Option C is not included because browser history is unrelated to Duo's authentication logging and is never captured in these entries.

Answer

The user's plain-text password

Answer

The user's browser history

Question 2

What is the primary role of a Cloud Access Security Broker (CASB)?

Accepted Answer

To enforce security policies between cloud users and cloud applications.. A CASB sits between cloud users and cloud applications and enforces security policies such as DLP, access control, threat protection, and compliance monitoring. It is a policy enforcement point for cloud traffic, not an application development or infrastructure management tool.

Answer

To develop SaaS applications.

Answer

To manage physical server racks.

Answer

To provide internet connectivity.

Question 3

A user's device is marked as 'Out-of-Date' in Duo. How does the system determine this status?

Accepted Answer

By the Duo Device Health application reporting the OS version to the Duo Cloud. Duo determines device health, including 'Out-of-Date' status, through the Duo Device Health application installed on the endpoint. That agent collects OS version, patch level, firewall/antivirus status, and other attributes, then reports them to the Duo cloud, where policies evaluate the device and assign a status such as Out-of-Date.

Answer

By analyzing the user's browser user-agent string

Answer

By querying the Active Directory server for the last patch date

Answer

By checking the device's public IP address geolocation

Question 4

You need to export compliance data from the Cisco Security Management Appliance (SMA) regarding web traffic policy violations. Which format ensures the most efficient ingestion into a SIEM via the SecureX orchestration workflow?

Accepted Answer

JSON. JSON is the most efficient format for SIEM ingestion via SecureX orchestration because it is natively structured, easily parsed by APIs and automation workflows, and preserves hierarchical relationships without requiring custom parsing. SecureX orchestration workflows typically consume JSON payloads directly, minimizing transformation overhead.

Answer

CSV

Answer

XML

Answer

PDF

Question 5

In a SASE deployment, why is the integration between Cisco ISE and Cisco Secure Access considered a critical design pattern?

Accepted Answer

It enables context-aware policy enforcement based on user identity and device state across the hybrid environment.. Integrating ISE with Secure Access allows consistent policy application across both on-premises network resources and cloud-based applications.

Answer

It enables direct firewall inspection of internal traffic.

Answer

It allows ISE to act as a cloud proxy server.

Answer

It automates the deployment of AnyConnect agents.

Question 6

Which THREE items are typically included in a SecureX compliance report?

Accepted Answer

Summary of active security threats. A SecureX compliance report typically includes a summary of active security threats (A), because compliance reporting must surface current risks and incidents that could affect regulatory posture. It also includes an inventory of protected assets (D), since identifying which systems, data, and devices fall under compliance scope is foundational to any audit or assessment. Policy enforcement status (E) is likewise included, as it shows whether required security policies and controls are actually being applied and where gaps exist. Options B and C are incorrect because annual tax filing status and employee payroll information are financial/HR records, not security compliance reporting content, and would not normally appear in a SecureX compliance report.

Answer

The company's annual tax filing status

Answer

Employee payroll information

Question 7

Which THREE metrics are useful for assessing the security posture of an endpoint in Cisco Secure Endpoint?

Accepted Answer

Date of the last completed scan. Option C (Date of the last completed scan) is correct because the recency of the last scan directly indicates whether the endpoint is being actively inspected for threats, and stale scan dates reveal gaps in detection coverage. Option D (Policy version applied to the device) is correct because the applied policy version determines which protections, exclusions, and detection engines are enforced, so an outdated or mismatched policy signals a weakened security posture. Option E (Connector version and status) is correct because the Cisco Secure Endpoint connector must be current and in a healthy 'Connected' state to receive cloud updates and report telemetry; an outdated or disconnected connector leaves the endpoint unprotected. Option A (printer model) is irrelevant to endpoint security posture since peripheral hardware does not affect malware detection or policy enforcement. Option B (free hard drive space) is an operational/performance metric, not a security-posture indicator, and has no bearing on threat detection or policy compliance.

Answer

The printer model connected to the device

Answer

The amount of hard drive space left

Question 8

In Cisco Secure Access, you need to configure a Global Policy to block access to specific cloud applications based on risk levels. Where do you define this logic?

Accepted Answer

Policy > Global Policy > Access Rules. In Cisco Secure Access, global policies that block access to cloud applications based on risk levels are defined under Policy > Global Policy > Access Rules (A). This section allows you to create rules that apply to all users and devices, and you can specify conditions such as application risk level.

Answer

Global Settings > Cloud Connectors

Answer

Connectors > Internet Gateway

Answer

Devices > Endpoint Profiles

Question 9

What is the primary function of an 'atomic action' in the context of SecureX orchestration?

Accepted Answer

Perform a single, discrete task. An atomic action in SecureX orchestration is a single, discrete operation — such as an API call, a data transformation, or a utility step — that performs one task and can be chained with others to build a workflow. It is the smallest reusable building block of orchestration.

Answer

Provide a graphical dashboard

Answer

Aggregate logs from all sources

Answer

Define the overall workflow logic

Question 10

You are auditing your Cisco Defense Orchestrator (CDO) environment. Why would a device appear in 'Staging' mode instead of 'Managed'?

Accepted Answer

The device has been added to CDO but the onboarding process is incomplete. In Cisco Defense Orchestrator (CDO), 'Staging' mode indicates that a device has been added to CDO but has not yet completed the full onboarding process. During staging, CDO can read the device's configuration and perform limited actions, but it does not have full management control. Once onboarding is completed—which may involve deploying a configuration, accepting a license, or establishing a secure connection—the device transitions to 'Managed' mode, where CDO can push policies and manage the device comprehensively.

Answer

The device has a firmware mismatch

Answer

The device is offline

Answer

The device is protected by a local password

Question 11

You are using a 'Loop' node in a SecureX workflow to process a list of IPs. How do you access the current item within the loop iteration?

Accepted Answer

Reference the iterator variable. In a SecureX orchestration Loop node, the current item of each iteration is exposed as the iterator variable, which you reference in downstream nodes to access the value being processed. The Loop node automatically creates this variable and updates it on each pass through the list. Referencing the iterator variable is the correct way to use the current IP in the iteration.

Answer

Re-query the input node

Answer

Use a global pointer

Answer

Reference the original list index

Question 12

Where can you view the overall security posture and threat trends across your organization within the Umbrella dashboard?

Accepted Answer

Dashboard. The Umbrella dashboard's main 'Dashboard' section provides an overview of security posture and threat trends across the organization. It includes widgets showing top threats, blocked requests, security categories, and other metrics. This is the central location for a high-level view of overall security status.

Answer

Deployments > Core Identity

Answer

Policies > Security

Answer

Admin > Logs

Question 13

You have a branch office with a static IP. You want to secure it without a local virtual appliance. What is the best method?

Accepted Answer

Use an IP-based Network Identity. Configuring network identity in Umbrella by defining the public IP (Network Identity) allows the gateway to associate traffic with your organization without a tunnel or VA.

Answer

Use a PAC file

Answer

Use DNS-over-HTTPS

Answer

Use the Umbrella Roaming Client

Question 14

Which THREE criteria can be used to classify a 'Shadow IT' application in Cisco Umbrella?

Accepted Answer

Volume of traffic. In Cisco Umbrella, Shadow IT discovery classifies discovered cloud applications using criteria such as the volume of traffic (A), which helps identify how heavily an unsanctioned app is being used across the organization, and the application category (B), such as File Sharing or Collaboration, which groups apps by function for policy decisions. The risk level (E) is also a classification criterion, since Umbrella assigns a risk score to each discovered app to help prioritize which Shadow IT services pose the greatest threat. These three attributes—traffic volume, category, and risk level—are the standard dimensions Umbrella uses to report and filter Shadow IT applications. A user's password hash (C) is never used, as Umbrella does not collect or classify applications by credential data, and a device serial number (D) is not a classification criterion for Shadow IT apps in Umbrella.

Answer

User's password hash

Answer

Device serial number

Question 15

Which THREE items are necessary for troubleshooting a failed 'Umbrella AD Connector' sync?

Accepted Answer

Logs located on the server running the connector. Option A is correct because the Umbrella AD Connector writes diagnostic logs on the server hosting the connector (e.g., C:\Program Files (x86)\Cisco\Umbrella AD Connector\logs), and these logs reveal sync failures, authentication errors, and LDAP query issues. Option B is correct because the connector runs under a designated service account whose permissions must allow reading the required Active Directory objects (users, groups, OUs); insufficient rights cause sync failures. Option D is correct because the AD Connector must reach a Domain Controller over LDAP/LDAPS (TCP 389/636) to perform directory queries, so DC accessibility and network connectivity are essential to a successful sync. Option C is incorrect because the physical motherboard model is irrelevant to connector synchronization. Option E is incorrect because local printer drivers have no bearing on AD Connector operations or directory synchronization.

Answer

The physical server motherboard model

Answer

The local printer driver version