SCAZT Practice Test 2 — 10 Questions

Question 1

Which THREE items are considered primary components of the Cisco Umbrella 'Identity' structure when creating security policies?

Accepted Answer

Roaming Computer. In Cisco Umbrella, the Identity structure used when building policies is built around three primary identity types: Roaming Computers (A), which are endpoints running the Umbrella Roaming Client/SIG agent and are identified by their registered identity; Networks (B), which are defined by public IP addresses/subnets (or dynamic IPs via the Umbrella network device/AD integration) so all traffic egressing that IP is attributed to the network identity; and Active Directory User/Group (D), which ties DNS requests to AD users or groups via the AD Connector or Virtual Appliance for user-based policy enforcement. These three map directly to Umbrella's policy identity selectors (Roaming Computers, Networks, and AD Users/Groups) and are the standard building blocks for differentiated security policies. A printer's MAC address (C) is not an Umbrella identity construct—Umbrella identities are based on roaming client registration, public IP/network, or AD user/group, not endpoint MAC addresses. A public cloud instance ID (E) is likewise not a primary Umbrella identity type; cloud workloads are typically covered via network/IP identities or the Umbrella SIG/cloud firewall integrations rather than an instance-ID identity.

Answer

MAC Address of the Printer

Answer

Public Cloud Instance ID

Question 2

When performing automated threat hunting, you need to query multiple cloud platforms. Which SecureX feature enables this unified query?

Accepted Answer

Federated Search. SecureX Federated Search allows security analysts to run a single query across multiple integrated cloud platforms and products, aggregating results into a unified view. It connects to various Cisco and third-party sources (e.g., Umbrella, AMP, Threat Grid, Firepower) and returns correlated data, enabling efficient threat hunting without switching consoles. This directly addresses the need for a unified query across cloud platforms.

Answer

Snapshot Analysis

Answer

Centralized Dashboard

Answer

Aggregated Logging

Question 3

In Cisco Secure Cloud Analytics, what is the function of the 'Host Group' configuration?

Accepted Answer

To organize network segments into logical entities for analysis. In Cisco Secure Cloud Analytics, Host Groups are logical containers that let you organize monitored hosts (on-premises, cloud, or hybrid) into meaningful groupings such as by department, VPC, business unit, or security zone. This grouping drives the analytics engine's baselining and anomaly detection, because traffic behavior is evaluated relative to peers within the same group. Without Host Groups, the system would treat all hosts as one flat population, producing noisy and less accurate detections.

Answer

To define the cloud VPC boundaries

Answer

To automate patch deployment

Answer

To increase the polling frequency

Question 4

In Cisco Defense Orchestrator, why would an object show a 'Read Only' status?

Accepted Answer

The object was imported from a device and is not yet managed as a CDO object. In Cisco Defense Orchestrator (CDO), objects that are discovered on a managed device but have not yet been onboarded into CDO's own object database are shown with a 'Read Only' status. This indicates the object is device-local and CDO is only reading it from the device, not managing it as a shared, reusable CDO object. Once the object is imported/claimed into CDO, it becomes editable and can be shared across devices and policies.

Answer

The object is stored on a read-only disk partition

Answer

The object is currently being used in a policy

Answer

The user lacks administrator privileges

Question 5

Which component is required to enable Active Directory integration with Umbrella for user-level reporting?

Accepted Answer

Umbrella AD Connector. The Umbrella AD Connector is a lightweight Windows service that synchronizes user and group information from on-premises Active Directory to the Umbrella dashboard. It enables user-level reporting by mapping internal IP addresses to AD user identities, which is essential for granular visibility and policy enforcement. Without the AD Connector, Umbrella can only report on network-level data, not per-user activity.

Answer

SAML Provider

Answer

Virtual Appliance

Answer

AnyConnect Agent

Answer

Cisco Secure Firewall

Question 6

Which THREE factors are typically considered when evaluating 'Device Posture' in a Zero Trust environment?

Accepted Answer

Disk encryption status. Device Posture in a Zero Trust environment assesses the security hygiene and configuration state of an endpoint before granting access, so option B (Disk encryption status) is correct because full-disk encryption such as BitLocker or FileVault protects data at rest and is a standard compliance signal. Option C (Antivirus status) is correct because the presence, currency, and real-time protection state of endpoint anti-malware (e.g., Defender, CrowdStrike) indicates whether the device can detect and resist threats. Option E (Operating system patch level) is correct because missing OS security updates expose known vulnerabilities, so posture checks verify patch compliance via tools like Intune, Jamf, or conditional access policies. Option A (The user's home internet speed) is not a security posture attribute but a network performance metric, and option D (The user's favorite website) is irrelevant personal preference data with no bearing on device trust.

Answer

The user's home internet speed

Answer

The user's favorite website

Question 7

A global company needs to ensure that users in different regions have the lowest latency when accessing cloud applications. How should the SASE architecture be configured?

Accepted Answer

Ensure users are routed through the global anycast network to the nearest Umbrella data center.. Cisco Umbrella uses a globally distributed anycast network, which automatically routes users to the nearest data center, minimizing latency.

Answer

Manually configure the proxy settings for each user based on their country.

Answer

Install an on-premises proxy server in every region.

Answer

Direct all traffic to a single corporate data center before cloud access.

Question 8

Which Cisco technology should be used to provide visibility and threat detection for traffic traversing between cloud workloads in a VPC?

Accepted Answer

Cisco Secure Workload (Tetration). Cisco Tetration (Secure Workload) provides micro-segmentation and deep observability of traffic between workloads to detect anomalies and threats.

Answer

Cisco Umbrella

Answer

Cisco AnyConnect

Answer

Cisco Duo

Question 9

What is the primary goal of the 'Cisco SASE' framework?

Accepted Answer

To converge networking and security services into a single cloud-delivered offering.. Cisco SASE combines networking and security capabilities into a single cloud-native service to provide secure, optimized access to users wherever they are.

Answer

To increase the cost of cloud services.

Answer

To replace all physical firewalls in the data center.

Answer

To provide a new type of internet provider service.

Question 10

Which THREE mechanisms are commonly used by a CASB to enforce access control to SaaS applications?

Accepted Answer

API-based integration.. A CASB commonly enforces access control to SaaS applications through three primary deployment modes. API-based integration (C) connects directly to the SaaS provider's REST APIs to scan content, apply DLP policies, and enforce access rules without inline traffic inspection. Reverse Proxy (D) sits between users and the SaaS app, intercepting sessions so the CASB can apply authentication, authorization, and policy controls inline. Forward Proxy (E) routes user traffic from the endpoint through the CASB, enabling inline enforcement of access policies for SaaS sessions. Local host firewall rules (A) operate at the OS/network layer and cannot inspect SaaS application context or user identity, so they are not a CASB enforcement mechanism. Direct switch-to-server connection (B) is a network topology concept, not an access-control mechanism used by a CASB.

Answer

Local host firewall rules.

Answer

Direct switch-to-server connection.