SCAZT Practice Exam 4 — 20 Questions

Question 1

In the context of the Duo Authentication Proxy, what is the 'fail_mode' parameter used for?

Accepted Answer

To define how to handle requests when the cloud service is unreachable. The fail_mode parameter in the Duo Authentication Proxy determines how authentication requests are handled when the Duo cloud service cannot be reached — for example, whether to fail open (allow) or fail closed (deny) for the configured integration.

Answer

To decide whether to permit local password caching

Answer

To set the timeout for LDAP queries

Answer

To enable logging for failed authentication attempts

Question 2

Which Duo log would be most useful for troubleshooting a failure during the initial push notification delivery?

Accepted Answer

Authentication Log. The Duo Authentication Log records the full authentication attempt lifecycle, including the initial push notification being sent to the user's device, the user's response (approve/deny/timeout), and the final authentication result. When troubleshooting a failure during initial push delivery, this log shows whether the push was dispatched, whether the device was reachable, and any error codes returned by Duo's push service. This makes it the primary log for diagnosing push-delivery failures.

Answer

Directory Sync Log

Answer

Telephony Log

Answer

Administrative Actions Log

Question 3

Which TWO ways does Cisco Secure Cloud Analytics provide visibility into encrypted traffic?

Accepted Answer

TLS fingerprinting. Cisco Secure Cloud Analytics gains visibility into encrypted traffic without decrypting it, and option A (TLS fingerprinting) is correct because it inspects the unencrypted TLS handshake fields — such as the JA3/JA3S hash derived from ClientHello/ServerHello parameters, cipher suites, and extensions — to identify the client or server application even though the payload remains encrypted. Option E (Behavioral analysis of flow patterns) is also correct because the product uses metadata from flow records (for example NetFlow/IPFIX) to model traffic behavior, detecting anomalies like unusual destinations, volumes, or beaconing patterns without needing to see inside the encrypted session. Option B is wrong because Secure Cloud Analytics is a cloud-delivered network telemetry and analytics platform, not an endpoint agent that reads local browser history files. Option C is wrong because installing a root CA on mobile devices is a TLS interception technique used by other tools, not a visibility method of Secure Cloud Analytics. Option D is wrong because Secure Cloud Analytics does not perform full payload decryption at the cloud edge; its value proposition is metadata- and fingerprint-based analytics that preserve privacy and avoid decryption.

Answer

Analyzing the local browser history files

Answer

Installing a root CA on all mobile devices

Answer

Full payload decryption at the cloud edge

Question 4

Which THREE factors should be considered when designing an IaaS security architecture using Cisco Secure Workload (formerly Tetration)?

Accepted Answer

Identity-based policy enforcement. Cisco Secure Workload (formerly Tetration) is built around identity-based policy enforcement, so option C is correct because it uses workload attributes such as labels, tags, and process identity to define granular allow/deny rules rather than relying only on IP addresses. Option D is correct because application dependency mapping is a core capability that discovers workload-to-workload communication flows and builds the behavioral baseline needed to create accurate policies. Option E is correct because host-based sensor deployment is required to collect the telemetry (flows, processes, packages) from each workload that feeds the platform's analytics and policy engine. Option A is not correct because physical switch port mirroring is a network-centric monitoring approach and is not the primary mechanism used by Secure Workload in IaaS environments. Option B is not correct because global firewall rule consolidation is a broad network-security practice, not a specific design factor for Cisco Secure Workload's identity- and workload-centric architecture.

Answer

Physical switch port mirroring

Answer

Global firewall rule consolidation

Question 5

A user is attempting to upload a file to a SaaS application, but the Cisco Umbrella Intelligent Proxy blocks it. What is the most effective way to troubleshoot the block?

Accepted Answer

Use the Umbrella Activity Search dashboard.. The Umbrella Activity Search dashboard (also called Activity Search or Reporting) provides detailed DNS, proxy, and firewall event logs, including the identity, destination, category, and policy that triggered a block. Searching for the user and the destination domain or URL will show exactly which policy rule blocked the upload, making it the most effective troubleshooting tool.

Answer

Reboot the client device.

Answer

Disable the browser cache.

Answer

Check the local host logs.

Question 6

When automating threat response using SecureX, you want to verify if a file hash is malicious using Talos Intelligence. Which tool provides this lookup capability?

Accepted Answer

Threat Intelligence. The Threat Intelligence module in SecureX is the component that performs enrichment lookups against sources like Cisco Talos for observables such as file hashes, IPs, domains, and URLs. When you submit a hash, Threat Intelligence queries Talos and returns verdicts (malicious, suspicious, unknown, benign) along with related context. This is the designated tool for reputation lookups within the SecureX platform.

Answer

Secure Cloud Analytics

Answer

Endpoint Compliance

Answer

Identity Services Engine

Question 7

Which term describes the unauthorized use of cloud applications by employees within an organization?

Accepted Answer

Shadow IT. Shadow IT refers to applications or software used within an organization without explicit IT department approval.

Answer

Zero Trust

Answer

Cloud-Native

Answer

BYOD

Question 8

You are setting up a secure hybrid cloud environment. How do you implement 'Micro-segmentation' between virtual machines in the same subnet?

Accepted Answer

Use host-based security policies or a distributed SDN firewall.. Micro-segmentation is achieved using host-based firewalls or SDN controllers (like those provided by Cisco Secure Workload/Tetration) to enforce policy at the individual workload level.

Answer

Rely on the cloud provider's default network ACLs.

Answer

Place each VM in a different subnet.

Answer

Configure a VLAN for every virtual machine.

Question 9

Which TWO pieces of information are required for a 'Network Identity' in Umbrella?

Accepted Answer

A friendly name for the location. A network identity is defined by the public IP address and a descriptive name to identify the location in reports.

Answer

The internal DHCP server IP

Answer

The local VLAN ID

Answer

The ISP account number

Question 10

What is the purpose of the 'Casebook' in Cisco SecureX?

Accepted Answer

Group observables for investigation. Casebook serves as an incident management workbench, allowing analysts to group observables and evidence for investigation.

Answer

Monitor network traffic

Answer

Configure firewall policies

Answer

Automate endpoint isolation

Question 11

Which TWO are common 'secure access design patterns' in a hybrid cloud?

Accepted Answer

ZTNA for remote user access. Standard patterns include ZTNA for users and secure transit gateways for inter-cloud traffic.

Answer

Connecting all apps to the local LAN only

Answer

Open access for all traffic

Answer

Public internet bypass for all traffic

Question 12

You want to restrict access to specific cloud apps (e.g., Dropbox). Which Umbrella feature is used?

Accepted Answer

Application Control. Application Control allows administrators to discover and block access to specific cloud applications.

Answer

Content Categories

Answer

Firewall Rules

Answer

URL Filtering

Question 13

You need to handle a case where an endpoint device is not reachable during an isolation attempt. How should the workflow respond?

Accepted Answer

Notify administrator of failure. The workflow should use error handling to transition to a 'failed' state and alert an admin, as the device may be offline or the agent disconnected.

Answer

Delete the device object

Answer

Retry indefinitely

Answer

Ignore and continue

Question 14

When designing an automated threat response for cloud-native applications, why is it critical to include a 'Human-in-the-loop' (HITL) step in the orchestration workflow?

Accepted Answer

To ensure that automated remediation actions are reviewed and approved before impacting production services.. HITL is critical in automated workflows to prevent false positives from causing business disruption, especially when the remediation involves blocking critical services or isolating production servers.

Answer

Because the Cisco SecureX platform requires a manual key-press to initiate any network-based isolation.

Answer

Because the SOAR platform cannot execute more than one API call without human confirmation.

Answer

To provide evidence for the automated audit log.

Answer

To comply with API rate-limiting requirements on cloud provider platforms.

Question 15

Which of the following is a key component of a successful 'Identity and Access Management' (IAM) strategy in the cloud?

Accepted Answer

Centralized identity provider integration with MFA.. A centralized IAM strategy, such as using an IdP (e.g., Microsoft Entra ID or Okta) integrated with Cisco Duo, ensures consistent authentication.

Answer

Creating a separate user account for each cloud application.

Answer

Allowing password sharing for shared service accounts.

Answer

Disabling MFA for administrative accounts for speed.

Question 16

You are seeing 'SSL Inspection Error' in your logs. What is the most likely cause?

Accepted Answer

The Umbrella Root CA is not trusted on the client. SSL inspection errors typically occur when the client cannot validate the certificate presented by the proxy, often due to the missing Root CA.

Answer

The destination server is down

Answer

The policy is set to 'Allow'

Answer

The tunnel is disconnected

Question 17

An organization is migrating to a Secure Internet Gateway (SIG) architecture. They currently have an on-premises firewall blocking all traffic except for specific ports. What is the recommended method to forward traffic to the SIG while maintaining existing security policy consistency?

Accepted Answer

Configure an IPsec tunnel from the firewall to the Cisco SIG headend.. Using an IPsec tunnel ensures that the traffic is encrypted and consistently tagged for the SIG to apply the appropriate security policies.

Answer

Configure port forwarding for all traffic on the firewall to an external DNS proxy.

Answer

Disable the existing firewall to prevent conflicts with the SIG cloud services.

Answer

Replace the existing firewall with an Umbrella Roaming Client.

Question 18

Why is 'SSL/TLS Inspection' necessary in a SASE architecture?

Accepted Answer

To allow the security stack to inspect encrypted payloads for threats and sensitive data.. Without decryption, security tools cannot see the content of encrypted traffic, allowing threats or data leaks to pass undetected.

Answer

To allow the ISP to monitor user traffic.

Answer

To accelerate the connection for the end user.

Answer

To replace the need for end-to-end encryption.

Question 19

You are designing a secure access path for a BYOD device. What is the most effective approach to ensure the device does not compromise the network?

Accepted Answer

Enforce ZTNA with device posture checks and MFA.. ZTNA ensures that the device is checked for posture and the user is authenticated before allowing access, regardless of device ownership.

Answer

Provide the device with a permanent VPN connection.

Answer

Require the device to join the corporate Active Directory domain.

Answer

Configure an open SSID for BYOD devices.

Question 20

When integrating Cisco Cloudlock with O365, which authentication mechanism is required to allow the CASB to perform administrative actions, such as removing a malicious file share?

Accepted Answer

OAuth 2.0 delegated permissions.. Cisco Cloudlock (now part of Cisco Umbrella/Cloudlock CASB) integrates with Microsoft 365 via OAuth 2.0 delegated permissions so the CASB can act on behalf of an authorized admin to enumerate files, inspect shares, and perform remediation such as removing a malicious file share. OAuth 2.0 delegated permissions grant scoped, revocable API access without storing user credentials, which is required for administrative actions against the Microsoft Graph and Office 365 APIs.

Answer

LDAP over TLS.

Answer

SAML 2.0 with manual certificate import.

Answer

Basic Authentication over SSL.