SCAZT Practice Exam 1 — 20 Questions

Question 1

When configuring Cisco Duo for SaaS application access, which THREE conditions can be used in a 'Policy' to restrict access to a sensitive application?

Accepted Answer

Operating System version. Duo allows for granular access control based on user location, device security posture, and authentication methods.

Answer

File size limit

Answer

Application bandwidth usage

Question 2

When setting up a DLP policy for cloud storage, which TWO elements should be defined to ensure accurate classification of sensitive data?

Accepted Answer

Scope of the policy (e.g., specific folders or users).. DLP policies rely on content inspection patterns (regex/keywords) and scope (the folders/apps) to function correctly.

Answer

Hardware acceleration settings.

Answer

SaaS application uptime SLAs.

Answer

Physical server rack location.

Question 3

Which TWO components are essential for implementing a Zero Trust Network Access (ZTNA) model using Cisco Duo and Secure Access?

Accepted Answer

Duo Authentication Proxy. ZTNA requires both identity verification (Duo) and policy-based access control (Secure Access).

Answer

Cisco Secure Firewall Management Center

Answer

Cisco ISE

Answer

Umbrella Virtual Appliance

Question 4

What is the primary function of the 'CASB' category in Cisco Umbrella's web policy?

Accepted Answer

To govern application usage and control data movement.. The CASB category in Umbrella allows admins to enforce policies specifically for cloud applications, such as blocking uploads to unsanctioned tenants.

Answer

To scan emails for malware.

Answer

To filter malicious DNS queries.

Answer

To provide VPN connectivity to the cloud.

Question 5

Which feature in Cisco Cloudlock allows you to identify if a SaaS user is logging in from an anonymizer or TOR exit node?

Accepted Answer

User Behavior Analytics (UBA) anomaly detection.. Cisco Cloudlock's Threat Intelligence engine correlates user login logs with known malicious IP reputation lists.

Answer

SaaS application object mapping.

Answer

File content scanning.

Answer

Encryption key management.

Question 6

A network architect is deploying Cisco Umbrella SIG to enforce Zero Trust access. Which mechanism provides the initial posture assessment before allowing a user to access a SaaS application via the Secure Web Gateway?

Accepted Answer

AnyConnect/Secure Client Posture Module. The Cisco Umbrella Roaming Client or AnyConnect module performs device posture checks before establishing the tunnel.

Answer

Umbrella Virtual Appliance

Answer

Cloud-delivered Firewall

Answer

Umbrella DNS Policies

Answer

Umbrella SIG API

Question 7

In Cisco Cloudlock, what is the purpose of an 'Incident'?

Accepted Answer

To notify admins of a policy violation.. An incident is an alert generated when a specific policy rule is triggered by a user or data action within a protected SaaS app.

Answer

To record system uptime.

Answer

To manage app credentials.

Answer

To backup user data.

Question 8

When designing a Secure Access Service Edge (SASE) architecture, which principle best describes the shift from traditional hub-and-spoke networking?

Accepted Answer

Direct-to-cloud connectivity. SASE emphasizes connecting users directly to cloud resources rather than backhauling traffic to a central DC.

Answer

On-premise appliance chaining

Answer

Strict MPLS segmentation

Answer

Identity-agnostic security

Answer

Centralized backhauling

Question 9

To ensure compliance, you must ensure that all emails containing credit card numbers sent via O365 are encrypted. How is this achieved within the Cloudlock framework?

Accepted Answer

Configure a DLP policy to trigger an 'Apply Sensitivity Label' action.. Cloudlock policies can trigger automated actions such as applying sensitivity labels or encryption policies in the underlying SaaS application upon detecting sensitive content.

Answer

Reset the user's password.

Answer

Enable TLS 1.3 for all outgoing mail.

Answer

Create a firewall rule to block the email.

Question 10

Which feature in Cisco Cloudlock allows administrators to view a dashboard of users who are behaving outside of their normal baseline?

Accepted Answer

UBA. Cloudlock's UBA (User Behavior Analytics) module uses machine learning to establish a baseline and flag anomalies.

Answer

App Firewall

Answer

Policy manager

Answer

DLP engine

Question 11

When creating a policy in Cisco Cloudlock, what is the significance of setting a 'Threshold'?

Accepted Answer

To define the minimum number of occurrences to trigger an alert.. Thresholds allow you to define how many times a violation must occur (or how many instances of sensitive data are found) before an incident is triggered, reducing noise.

Answer

To limit the total number of files scanned.

Answer

To set the maximum file size for scanning.

Answer

To assign an expiration date to the policy.

Question 12

What is the main advantage of using a Secure Internet Gateway (SIG) over a traditional on-premises firewall?

Accepted Answer

Consistent protection for off-network users. A SIG provides security for users regardless of their location, unlike an on-premises firewall which only protects the office network.

Answer

Lower bandwidth costs

Answer

Faster internal LAN speed

Answer

Elimination of the need for DNS

Question 13

Which THREE items must be configured to successfully implement an Umbrella SIG tunnel?

Accepted Answer

Public IP address of the branch. A tunnel needs the remote IP address, the encryption parameters (IKEv2), and the traffic to be routed through the tunnel.

Answer

An active subscription to a VPN provider

Answer

Internal DNS server IP

Question 14

Which TWO pieces of information are required for a 'Network Identity' in Umbrella?

Accepted Answer

A friendly name for the location. A network identity is defined by the public IP address and a descriptive name to identify the location in reports.

Answer

The internal DHCP server IP

Answer

The local VLAN ID

Answer

The ISP account number

Question 15

Which Cisco technology should be used to provide visibility and threat detection for traffic traversing between cloud workloads in a VPC?

Accepted Answer

Cisco Secure Workload (Tetration). Cisco Tetration (Secure Workload) provides micro-segmentation and deep observability of traffic between workloads to detect anomalies and threats.

Answer

Cisco Umbrella

Answer

Cisco AnyConnect

Answer

Cisco Duo

Question 16

Which Cisco product facilitates 'Cloud-to-Cloud' security by monitoring activities in SaaS platforms like Microsoft 365?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock (part of the Secure Access suite) is a CASB that integrates via API to monitor and protect SaaS applications.

Answer

Cisco Firepower

Answer

Cisco Duo

Answer

Cisco Umbrella

Question 17

Which TWO are common 'secure access design patterns' in a hybrid cloud?

Accepted Answer

ZTNA for remote user access. Standard patterns include ZTNA for users and secure transit gateways for inter-cloud traffic.

Answer

Connecting all apps to the local LAN only

Answer

Open access for all traffic

Answer

Public internet bypass for all traffic

Question 18

What is the purpose of the 'Casebook' in Cisco SecureX?

Accepted Answer

Group observables for investigation. Casebook serves as an incident management workbench, allowing analysts to group observables and evidence for investigation.

Answer

Monitor network traffic

Answer

Configure firewall policies

Answer

Automate endpoint isolation

Question 19

When configuring an OAuth policy in Cisco Cloudlock, which TWO actions can be taken against third-party applications granted access to user data?

Accepted Answer

Quarantine the application. Cloudlock provides the ability to audit third-party app permissions and revoke them if the application is deemed risky.

Answer

Force an OS update on the app server

Answer

Update the app's source code

Answer

Enable two-factor authentication for the app

Question 20

When configuring visibility for SaaS applications in Cloudlock, which TWO of the following tasks are necessary to ensure the solution can inspect and protect the files in the SaaS environment? (Choose two.)

Accepted Answer

Deploy the Cloudlock policy engine to act on the data retrieved via API.. Cloudlock requires an OAuth-based integration (API connector) to gain visibility and the enabling of specific monitoring policies to trigger scans.

Answer

Install an agent on the end-user workstation.

Answer

Update the SaaS provider's DNS records.

Answer

Configure a GRE tunnel between the SaaS provider and the Cloudlock proxy.