SCAZT Practice Exam 3 — 20 Questions

Question 1

Which report in Cisco Umbrella provides the most direct view of security threats identified in your environment?

Accepted Answer

Security Activity. The Security Activity report details all blocked threats, including malware, phishing, and command-and-control attempts.

Answer

Top Identities

Answer

Application Usage

Answer

Web Activity

Question 2

What is the primary function of the Duo 'Telephony Credits'?

Accepted Answer

To cover the costs of SMS and voice call authentication. Duo Telephony Credits are a prepaid balance used to pay for out-of-band authentication methods that incur per-use carrier charges — specifically SMS passcodes and voice call callbacks. When a user authenticates via SMS or phone call, Duo deducts credits from the account's balance to cover the telecom cost. This is why Duo recommends migrating users to the Duo Mobile app (push notifications or TOTP), which consumes no telephony credits because it uses data/IP instead of the PSTN.

Answer

To unlock premium reporting features

Answer

To provide hardware tokens to employees

Answer

To pay for the monthly Duo license fee

Question 3

When designing a SOAR playbook for cloud security incidents, which TWO factors are critical for ensuring successful execution?

Accepted Answer

Input validation logic. Input validation logic (A) is critical because SOAR playbooks consume data from alerts, tickets, and external feeds; validating and normalizing that input prevents malformed or malicious values from breaking conditional branches, causing failed API calls, or triggering unintended automated actions. Correct API permissions for integrated tools (D) is equally critical because each playbook action (e.g., isolating an EC2 instance, disabling an IAM key, posting to Slack) executes under a service account or integration credential, and least-privilege scopes must be granted for those specific APIs or the steps will fail with 401/403 errors. Full administrative privileges (B) is not required and violates least privilege, increasing blast radius if the playbook or credential is compromised. Manual intervention steps (C) are optional and can even reduce automation value, so they are not a critical success factor. Frequent database reindexing (E) is unrelated to playbook execution and addresses search performance, not SOAR workflow reliability.

Answer

Full administrative privileges

Answer

Manual intervention steps

Answer

Frequent database reindexing

Question 4

An administrator notices that sensitive data is being shared via Microsoft Teams. Where in the Cloudlock dashboard should they navigate to identify which specific users are sharing the files?

Accepted Answer

Platform > Incidents dashboard.. The Cloudlock Incidents dashboard is where DLP and other policy violations are surfaced, showing details such as the offending file, the policy matched, and the users involved. To identify which specific users are sharing sensitive files via Teams, the administrator reviews the incident details in Platform > Incidents. This is the central triage view for policy violations.

Answer

Platform > Users > Provisioning.

Answer

Platform > Settings > API Configuration.

Answer

Platform > Threat Intelligence.

Question 5

Which component of Cisco's secure cloud access architecture is responsible for performing URL filtering and malware scanning on traffic destined for SaaS applications?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the secure internet gateway component that performs DNS-layer security, URL filtering, and malware/file inspection on traffic destined for SaaS and internet applications. It is the cloud-delivered secure web gateway in Cisco's secure cloud access architecture.

Answer

Cisco Secure Endpoint

Answer

Cisco Cloudlock

Answer

Cisco Adaptive Security Appliance

Question 6

A administrator wants to implement 'Strict' device health checks. What happens if a device reports an unknown OS version?

Accepted Answer

The access attempt is blocked by the policy. In Duo's device health/trusted endpoint policies, the 'Strict' enforcement mode means any device that fails to meet the defined health criteria — including an unrecognized or unknown OS version — is denied access entirely. Because Duo cannot evaluate the posture of an OS it does not recognize, the safe default under Strict is to block the connection rather than downgrade or redirect. This is the defining behavior that separates Strict from permissive or report-only modes.

Answer

The user is redirected to a temporary guest portal

Answer

The user is prompted to upgrade the OS manually

Answer

The user is granted read-only access

Question 7

A company is using Cisco Tetration (Secure Workload) for data center visibility. They need to generate a compliance report that shows communication flows between 'PCI-scoped' and 'Non-PCI-scoped' workloads. Which feature should be used to define this boundary?

Accepted Answer

Scopes.. In Cisco Tetration (Secure Workload), Scopes are used to define logical boundaries for workloads, such as PCI-scoped vs. Non-PCI-scoped. Scopes allow you to group workloads based on criteria (e.g., labels, IP addresses) and then apply policies, generate reports, and analyze traffic between these groups. To generate a compliance report showing communication flows between PCI and Non-PCI workloads, you would define two scopes and then use flow search or policy analysis within those scopes. The other options are related but not the primary feature for defining the boundary.

Answer

Annotation Policies.

Answer

Inventory Filters.

Answer

Flow Search.

Question 8

A security engineer is configuring Duo Authentication for Microsoft 365. The organization requires that users must be prompted for MFA only when accessing cloud resources from outside the corporate network. Which configuration setting in the Duo Admin Panel achieves this?

Accepted Answer

Configure a New Authentication Policy with 'Authorized Networks' set to the corporate office IP range. To prompt for MFA only when accessing Microsoft 365 from outside the corporate network, you configure a New Authentication Policy in the Duo Admin Panel with 'Authorized Networks' set to the corporate office IP range. This policy bypasses MFA for requests originating from those trusted IPs while enforcing MFA for all others.

Answer

Enable 'Duo Device Health' on the Microsoft 365 application object

Answer

Set the global MFA mode to 'Bypass' in the Duo Application settings

Answer

Apply a 'Remembered Device' setting of 30 days to the entire group

Question 9

What are TWO benefits of integrating Cisco Secure Email with SecureX orchestration?

Accepted Answer

Global threat purging. Option B (Global threat purging) is correct because SecureX orchestration can trigger Secure Email's message remediation capabilities across the organization, allowing an administrator to search for and delete malicious messages from all mailboxes at once rather than manually hunting them per-user. Option D (Automated threat extraction) is correct because orchestration workflows can automatically invoke Secure Email's threat extraction feature, which strips active content and attachments from messages and replaces them with safe renditions before delivery, removing the need for manual analyst intervention. The remaining options do not belong: real-time video monitoring (A) is not a Secure Email or SecureX orchestration function, manual email routing (C) contradicts the automation benefit that orchestration provides, and hardware load balancing (E) is an infrastructure/networking concern unrelated to email security integration.

Answer

Real-time video monitoring

Answer

Manual email routing

Answer

Hardware load balancing

Question 10

You are troubleshooting a missing event in Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud). Which configuration should you verify to ensure the cloud gateway is successfully pushing traffic metadata?

Accepted Answer

VPC Flow Logs enablement. Cisco Secure Cloud Analytics (Stealthwatch Cloud) ingests traffic metadata from cloud environments via VPC Flow Logs (in AWS) or equivalent flow logs in other clouds. If VPC Flow Logs are not enabled, the cloud gateway cannot collect and push metadata, resulting in missing events. Therefore, verifying VPC Flow Logs enablement is the correct configuration check.

Answer

Active Directory integration settings

Answer

The local firewall rules on the monitored instance

Answer

SecureX API token synchronization

Question 11

Which TWO methods can be used to bypass Duo authentication in an emergency?

Accepted Answer

Add the user to a group that has a 'Bypass' policy applied. Option C is correct because Duo policies can be applied to groups, and a group assigned a policy with the "Bypass" setting allows its members to authenticate without completing Duo's second factor. Option E is correct because Duo administrators can generate a temporary bypass code for a specific user, which the user enters in place of the Duo passcode to skip the normal authentication flow for a limited time. Option A is incorrect because renaming an AD account does not affect Duo's authentication enforcement and would not bypass the second factor. Option B is incorrect because resetting the password to '12345' only changes the primary credential and does not disable or bypass Duo MFA. Option D is incorrect because setting the global MFA mode to 'Bypass' for all users is not a supported Duo emergency bypass method and would disable MFA organization-wide rather than for a single user.

Answer

Rename the user's AD account

Answer

Reset the user's password to '12345'

Answer

Set the global MFA mode to 'Bypass' for all users

Question 12

You need to ensure that an incident response playbook in Cisco SecureX automatically updates a case in the Casebook feature. Which action is required in the workflow design?

Accepted Answer

Add Observation to Casebook. In Cisco SecureX orchestration workflows, to have a playbook update a case in Casebook, the workflow must add an observation to the Casebook. Observations are the mechanism by which workflow outputs are attached to a Casebook case, enabling analysts to see enrichment results, IOCs, and notes within the case timeline. This is the specific action required for Casebook integration.

Answer

Post to Incident API

Answer

Update Evidence Store

Answer

Sync with Incident Management

Question 13

Which Cisco Umbrella report provides the most granular visibility into the specific security categories triggered by user traffic?

Accepted Answer

Activity Search Report. The Activity Search Report in Cisco Umbrella provides the most granular, per-request visibility into user traffic, including the specific security categories triggered, the identity of the user or device, the destination, and the action taken. It lets administrators search and filter individual DNS and proxy events, making it the go-to report for drilling into exactly which category a request matched.

Answer

Total Requests Report

Answer

Security Overview Report

Answer

Destination List Report

Question 14

You are configuring Cisco SecureX threat response to investigate a file hash. You notice that the integration module for Cisco Umbrella is showing a status of 'Partial Success'. What is the most likely cause?

Accepted Answer

The integration is limited by insufficient API scopes or permissions on the Umbrella dashboard.. A 'Partial Success' status in a SecureX threat response integration module means the module responded but could not fully complete the enrichment — most commonly because the API credentials lack the scopes or role permissions required for the specific query. For Cisco Umbrella, the Investigate API requires the correct API key type and scopes (e.g., investigate read) and the dashboard user must have the appropriate role; missing scopes cause the module to return partial data rather than a hard failure. Verifying and correcting API scopes/permissions on the Umbrella dashboard resolves the partial success state.

Answer

The file hash is not present in the Umbrella cache.

Answer

The API token has expired and requires a refresh.

Answer

The SecureX relay server is down.

Question 15

You are creating a custom dashboard in SecureX and need to display data from Cisco Secure Endpoint (AMP for Endpoints). Which component must be properly configured first?

Accepted Answer

Secure Endpoint Integration Module. To display data from Cisco Secure Endpoint in a SecureX custom dashboard, the Secure Endpoint Integration Module must be properly configured first. This module enables SecureX to pull data from Secure Endpoint and make it available for dashboards and other SecureX features.

Answer

Cisco Threat Intelligence Grid

Answer

DNS Layer Security Policy

Answer

SecureX Orchestration Workflow

Question 16

When deploying the Cisco Secure Access AnyConnect module, what is the primary role of the Umbrella DNS module within it?

Accepted Answer

To intercept and secure DNS queries. The Umbrella DNS module inside AnyConnect intercepts DNS queries and sends them to Umbrella resolvers for security filtering.

Answer

To manage local network segmentation

Answer

To authenticate users to the cloud

Answer

To encrypt traffic payloads

Question 17

Which section in the Cisco Secure Firewall Management Center (FMC) is primarily used to view security events generated by intrusion policies?

Accepted Answer

Analysis > Intrusions > Events. In Cisco FMC, security events generated by intrusion policies are viewed under Analysis > Intrusions > Events. This section displays triggered intrusion events with details such as rule SID, priority, source/destination, and packet information. The other options are configuration or management areas, not event viewers.

Answer

Policies > Intrusion

Answer

Objects > Object Management

Answer

System > Updates

Question 18

When using SecureX to orchestrate response, which action is best suited for blocking a URL globally?

Accepted Answer

Umbrella Policy Update. Blocking a URL globally is best done by updating the Umbrella policy, since Umbrella enforces DNS-layer and web-layer blocking across all protected networks and roaming clients. An orchestration action that pushes a domain/URL into an Umbrella block list applies the block globally and immediately.

Answer

Endpoint Host File Modification

Answer

FMC Rule Update

Answer

Cloud Access Security Broker Rule

Question 19

An organization uses Duo Access Gateway (DAG) to protect on-premises applications. They want to transition to Duo SSO. What is the primary difference in architecture?

Accepted Answer

Duo SSO eliminates the need for on-premises server infrastructure for the identity provider. Duo Access Gateway (DAG) is an on-premises identity provider that must be installed on a local server to broker authentication for protected applications. Duo SSO is Duo's cloud-hosted identity provider, so migrating to it removes the need to maintain on-premises IdP server infrastructure — authentication is handled in Duo's cloud.

Answer

Duo SSO supports only SAML 1.0 protocols

Answer

Duo SSO requires a dedicated hardware appliance

Answer

Duo SSO requires the installation of the Duo Authentication Proxy on a local server

Question 20

What is the function of an Umbrella 'Integrations' key?

Accepted Answer

To automate API-based policy and log management. An Umbrella 'Integrations' key (also called an API key) is used to authenticate and authorize API calls that automate policy management, reporting, and log retrieval. It enables programmatic access to Umbrella's Investigate, Reporting, and Enforcement APIs for tasks like adding domains to block lists or pulling security logs.

Answer

To sign digital certificates

Answer

To encrypt DNS queries

Answer

To identify roaming clients