SCAZT Practice Test 20 — 15 Questions

Question 1

Which TWO features are part of the Cisco Secure Access suite for remote users?

Accepted Answer

Zero Trust Network Access (ZTNA). Option B, Zero Trust Network Access (ZTNA), is correct because Cisco Secure Access is a cloud-delivered security service edge (SSE) platform that includes ZTNA to provide identity- and context-based, least-privilege access to private applications for remote users without exposing them to the network. Option D, Secure Web Gateway (SWG), is correct because SWG is another core pillar of the Cisco Secure Access suite, filtering web traffic, enforcing acceptable-use and URL/content policies, and blocking malicious sites for remote users. The remaining options do not belong: A (Physical Router Management) and C (Wireless Controller provisioning) are on-premises network device administration functions unrelated to the Secure Access SSE suite, and E (Local DHCP Server) is a LAN IP-address assignment service, not a remote-user security feature.

Answer

Physical Router Management

Answer

Wireless Controller provisioning

Answer

Local DHCP Server

Question 2

You are configuring a Cisco Cloudlock policy to detect sensitive PII in a Salesforce instance. Which configuration step ensures that the policy specifically triggers when sensitive data is uploaded to a public-facing object?

Accepted Answer

Enable the PII inspection engine and set the exposure filter to 'Public'.. Cisco Cloudlock's PII inspection engine is the component that actually scans content for sensitive data patterns (SSNs, credit cards, etc.). The exposure filter is what scopes the policy to only fire when that data sits in a publicly accessible object, so combining the PII engine with the 'Public' exposure filter is what produces a targeted alert. Without the exposure filter, the policy would trigger on any PII regardless of visibility, generating noise.

Answer

Configure an API-based firewall rule to block all inbound traffic from Salesforce.

Answer

Apply a global blocklist for all Salesforce users.

Answer

Set the policy scan interval to 'Real-time' and enable TLS decryption.

Question 3

When deploying a secure remote access solution, how do you handle 'Split Tunneling' safely in a Zero Trust environment?

Accepted Answer

Use a ZTNA agent to tunnel only application-specific traffic while keeping web traffic direct.. By using a ZTNA agent, you can define specific application tunnels, effectively creating a 'split' where only authorized traffic goes through the secure path while general web traffic goes direct.

Answer

Disable split tunneling to ensure all traffic is inspected.

Answer

Force all traffic through the corporate VPN, regardless of destination.

Answer

Allow all traffic to the internet without any inspection.

Question 4

When investigating a file hash in SecureX Threat Response, which TWO sources can provide intelligence?

Accepted Answer

Cisco Talos. Cisco Talos (B) is correct because SecureX Threat Response aggregates threat intelligence from Cisco Talos, which provides reputation, signature, and behavioral data for file hashes (for example, via AMP and ClamAV verdicts). Third-party threat feeds (E) are also correct because SecureX Threat Response enriches observables such as file hashes with intelligence from integrated external providers, not just Cisco sources. Windows Update history (A) is not a threat-intelligence source; it only records installed OS patches. Local DNS logs (C) show name-resolution activity and do not provide file-hash reputation. System uptime logs (D) record host availability and are unrelated to hash intelligence.

Answer

Windows Update history

Answer

Local DNS logs

Answer

System uptime logs

Question 5

When configuring an OAuth policy in Cisco Cloudlock, which TWO actions can be taken against third-party applications granted access to user data?

Accepted Answer

Quarantine the application. In Cisco Cloudlock's OAuth policy configuration, the platform is designed to govern third-party applications that users have authorized to access corporate data, and two of the enforcement actions available are quarantining the application (option A) and revoking authorization (option C). Quarantining the application (A) is correct because Cloudlock can place a risky or non-compliant OAuth app into a restricted/quarantined state, blocking its access to protected data until an administrator reviews it. Revoking authorization (C) is correct because Cloudlock can remove the OAuth token/grant that the user previously issued to the third-party app, immediately terminating the app's access to the user's data. The remaining options are not Cloudlock OAuth policy actions: forcing an OS update on the app server (B) and updating the app's source code (D) are actions on the third-party provider's infrastructure that Cloudlock has no control over, and enabling two-factor authentication for the app (E) is an authentication control configured on the app or identity provider, not an enforcement action within a Cloudlock OAuth policy.

Answer

Force an OS update on the app server

Answer

Update the app's source code

Answer

Enable two-factor authentication for the app

Question 6

When setting up a DLP policy for cloud storage, which TWO elements should be defined to ensure accurate classification of sensitive data?

Accepted Answer

Scope of the policy (e.g., specific folders or users).. Option B is correct because defining the scope of the policy — the specific folders, users, or cloud storage locations it applies to — ensures the DLP engine only inspects and classifies the relevant data, preventing false positives or missed coverage outside the intended boundary. Option C is correct because data patterns such as regular expressions and predefined templates (e.g., credit card numbers, national ID formats, or PII templates) are the actual detection logic the DLP engine uses to identify and accurately classify sensitive content. Together, scope and data patterns form the two essential elements for accurate classification in a cloud storage DLP policy. Option A is incorrect because hardware acceleration settings affect performance, not data classification accuracy. Option D is incorrect because SaaS uptime SLAs are contractual availability metrics unrelated to how data is classified. Option E is incorrect because physical server rack location is a facilities concern and has no bearing on DLP content classification.

Answer

Hardware acceleration settings.

Answer

SaaS application uptime SLAs.

Answer

Physical server rack location.

Question 7

You are auditing a Cisco Cloudlock deployment for O365. Which TWO methods can be used to remediate a file that violates a Data Loss Prevention policy?

Accepted Answer

Delete the file. In a Cisco Cloudlock DLP deployment for O365, remediation actions operate directly on the offending file's permissions or existence, so option A (Delete the file) is correct because Cloudlock can remove the violating file from the O365 workload (e.g., OneDrive/SharePoint) to eliminate the exposure. Option D (Change sharing level to Private) is also correct because Cloudlock can revoke external/anonymous access by resetting the file's sharing so only the owner retains access, which directly mitigates the DLP violation. Option B (Block the user account in Active Directory) is not a Cloudlock file-level remediation action and would be handled by identity/AD tooling, not the DLP policy engine. Option C (Change the file owner) is not a standard Cloudlock remediation method and does not by itself stop the data exposure. Option E (Re-encrypt the file with a new key) is not a Cloudlock remediation capability for O365 files and does not address the sharing/permission violation.

Answer

Block the user account in Active Directory

Answer

Change the file owner

Answer

Re-encrypt the file with a new key

Question 8

When integrating Cisco Secure Endpoint with SecureX, which API key type is recommended for long-term integration stability?

Accepted Answer

OAuth 2.0 Client Credentials. OAuth 2.0 Client Credentials is the recommended API key type for long-term SecureX integrations because it issues short-lived access tokens from a client ID and secret, supports rotation, and does not depend on a human user's credentials or session. This makes it stable and secure for server-to-server automation. Cisco's SecureX and Secure Endpoint documentation explicitly recommend OAuth 2.0 for API integrations.

Answer

User-level personal access tokens

Answer

Hardcoded XML credentials

Answer

Temporary session tokens

Question 9

Which TWO methods are natively supported within Cisco SecureX Orchestration for passing data between disparate security tools in a single workflow?

Accepted Answer

Passing data through JSON variables across workflow activities.. Option A is correct because Cisco SecureX Orchestration workflows natively use JSON-based variables (including global, workflow, and activity-level variables) to store and pass structured data between activities from disparate security tools. Option E is correct because the workflow editor natively supports binding the output schema of one activity directly to the input fields of a subsequent activity, enabling seamless data flow without manual transformation. Option B is incorrect because exporting to a shared CSV on a local drive is not a native orchestration data-passing mechanism and would require external file handling. Option C is incorrect because physical USB keys are not a supported or practical data transfer method within an automated orchestration workflow. Option D is incorrect because hardcoding credentials into activity blocks is a security anti-pattern and not a data-passing method; SecureX Orchestration uses credential and target objects instead.

Answer

Exporting data to a shared CSV file on a local drive.

Answer

Using physical USB keys to transfer data between servers.

Answer

Hardcoding credentials into each individual activity block.

Question 10

During a Duo enrollment phase, a user is required to install the Duo Mobile app. What is the main security purpose of the app in the MFA flow?

Accepted Answer

To facilitate encrypted push notifications and act as a secure token. The Duo Mobile app serves as the second factor in MFA by receiving encrypted push notifications for authentication requests and generating time-based one-time passcodes (TOTP) as a secure token. It binds the user's identity to a specific device, so possession of the enrolled device is required to approve login attempts. This is the core security purpose of the app in the Duo MFA flow.

Answer

To track the user's location at all times

Answer

To scan the user's local network for unauthorized devices

Answer

To act as a remote desktop client for cloud apps

Question 11

Which Cisco product provides the primary telemetry source for endpoint-based threat response?

Accepted Answer

Secure Endpoint. Cisco Secure Endpoint (formerly AMP for Endpoints) is the endpoint detection and response (EDR) product that continuously collects telemetry — process executions, file hashes, network connections, and behavioral events — from managed endpoints. That telemetry feeds Cisco's threat response and SecureX platforms, making Secure Endpoint the primary endpoint-based telemetry source. The other products listed provide network, DNS, or email telemetry, not endpoint-level data.

Answer

Umbrella

Answer

Firepower Management Center

Answer

Stealthwatch

Question 12

When evaluating cloud security reference architectures, what is the primary purpose of a 'Cloud Access Security Broker' (CASB)?

Accepted Answer

To enforce security policies and provide visibility into SaaS and cloud applications.. A CASB sits between cloud service consumers and providers to enforce security policies, ensuring visibility, compliance, and threat protection.

Answer

To act as a secondary DNS server for the enterprise.

Answer

To manage physical access to cloud data centers.

Answer

To perform load balancing for cloud traffic.

Question 13

When setting up an automated response workflow in Cisco SecureX, which THREE of the following are valid trigger sources for initiating a playbook?

Accepted Answer

Webhooks from third-party security tools.. Option B is correct because SecureX playbooks can be initiated by webhooks, which allow third-party security tools to send HTTP POST requests to a SecureX API endpoint and trigger automated workflows. Option C is correct because SecureX provides a manual trigger capability directly from the SecureX dashboard, enabling analysts to launch a playbook on demand. Option E is correct because SecureX supports scheduled triggers, allowing playbooks to run automatically on a recurring cron-based schedule. Option A is not a valid trigger source, as SecureX does not use local workstation login notifications to initiate playbooks. Option D is also not valid, since a physical datacenter door sensor alarm is not an integrated trigger type within SecureX playbook automation.

Answer

An automated login notification from a local workstation.

Answer

A physical alarm triggered by a datacenter door sensor.

Question 14

When integrating Cisco Secure Firewall Management Center (FMC) with SecureX, which protocol is primarily used for the exchange of threat intelligence and orchestration commands?

Accepted Answer

REST API. SecureX utilizes APIs, primarily RESTful, to communicate with FMC for threat intelligence and orchestration.

Answer

NetFlow

Answer

SNMPv3

Answer

Syslog

Question 15

When designing a SOAR workflow, what is the best practice for handling errors in a network isolation script?

Accepted Answer

Implement an Error Catch block. The best practice for handling errors in a SOAR workflow script is to implement an Error Catch block, which gracefully handles exceptions, logs the failure, and allows the workflow to continue or take a remediation path. This prevents the entire workflow from failing silently and enables proper error reporting and recovery.

Answer

Set the workflow to loop on failure

Answer

Force terminate the workflow

Answer

Disable all notifications