SCAZT Practice Test 21 — 15 Questions

Question 1

Which protocol and format are used for the payload when triggering an incoming webhook for a SecureX orchestration workflow?

Accepted Answer

HTTP POST with JSON. SecureX webhooks expect JSON payloads via HTTP POST requests to initiate automated tasks.

Answer

MQTT with binary data

Answer

gRPC with Protobuf

Answer

HTTP GET with XML

Question 2

Which capability of the Cisco Umbrella SIG ensures that sensitive data, such as PII or credit card numbers, does not leave the organization via web traffic?

Accepted Answer

Cloud-based Data Loss Prevention (DLP). Cisco Umbrella's Data Loss Prevention (DLP) capability inspects outgoing traffic for sensitive information based on pre-defined or custom data patterns.

Answer

Firewall-as-a-Service (FWaaS)

Answer

DNS-layer security

Answer

Intelligent Proxy

Question 3

A security engineer is worried about 'MFA fatigue' attacks. Which Duo configuration is the best defense?

Accepted Answer

Enabling Duo Push with Number Matching. MFA fatigue (push bombing) attacks work by spamming a victim with Duo Push prompts until they approve one out of annoyance or confusion. Duo Push with Number Matching forces the user to enter a number displayed in the login browser into the Duo Mobile app, proving the user is actively looking at the legitimate authentication attempt and cannot blindly approve a random push.

Answer

Disabling Duo Push and requiring phone calls only

Answer

Increasing the MFA timeout to 60 seconds

Answer

Setting 'Remembered Devices' to 1 year

Question 4

A user is attempting to access a SaaS application, but the session is blocked by Cisco Cloudlock due to a detected policy violation. Which component is responsible for analyzing the API calls and triggering the remediation?

Accepted Answer

Cloudlock CASB API engine. Cisco Cloudlock utilizes API-based integration to monitor SaaS environments and enforce security policies, such as DLP or anomaly detection.

Answer

Duo Authentication Proxy

Answer

AnyConnect SASE client

Answer

Umbrella SIG proxy

Question 5

Which TWO things must be done to successfully protect a legacy VPN with Duo?

Accepted Answer

Configure the VPN to use the Authentication Proxy as its RADIUS server. To protect a legacy VPN with Duo, the VPN concentrator must be pointed at Duo's Authentication Proxy as its RADIUS server (option B), because the proxy is the component that brokers RADIUS requests between the VPN and Duo's cloud service, allowing Duo MFA to be inserted into the existing RADIUS authentication flow. Correspondingly, the VPN device must be registered as a RADIUS client in the Duo Admin Panel (option D) so that the Authentication Proxy recognizes the device, validates its shared secret, and permits it to send authentication requests. Options A and E are incorrect because joining the VPN to Active Directory or enabling SAML is not required for a RADIUS-based legacy VPN integration, and option C is wrong because Duo does not require installing an agent directly on the VPN headend device; the Authentication Proxy handles that role.

Answer

Join the VPN to the Active Directory domain

Answer

Install the Duo agent on the VPN headend device

Answer

Enable SAML on the VPN device

Question 6

You are configuring Cisco Umbrella to protect roaming users. Which component must be installed on the endpoint to ensure consistent policy enforcement when the user is off-VPN?

Accepted Answer

Cisco Umbrella Roaming Client. The Cisco Umbrella Roaming Client is a lightweight endpoint agent installed on laptops and desktops that enforces Umbrella DNS-layer security even when the user is off the corporate network or VPN. It intercepts DNS queries locally on the endpoint and forwards them to Umbrella's global network, ensuring consistent policy enforcement regardless of location. This makes it the correct component for protecting roaming users.

Answer

Secure Firewall Management Center

Answer

Umbrella Virtual Appliance

Answer

AnyConnect Management VPN Tunnel

Question 7

Which feature in Cisco Umbrella is used to categorize web traffic for reporting and filtering?

Accepted Answer

Content Categories. Cisco Umbrella uses Content Categories to categorize web traffic for both reporting and filtering. Categories group domains by topic (e.g., social media, gambling, malware, phishing) and are used in policies to allow or block traffic, as well as in reports to show what categories users are accessing. This categorization is powered by Umbrella's threat intelligence and machine learning.

Answer

DNS Destination Lists

Answer

Network Tunnels

Answer

Identity Providers

Question 8

You want to monitor the health of your Cisco Secure Firewall Management Center (FMC) from within SecureX. Which integration component is required?

Accepted Answer

Secure Firewall Management Center module. The Secure Firewall Management Center module is the SecureX integration component that connects to FMC and surfaces health, events, and device status within SecureX. It is specifically designed to monitor FMC-managed firewalls. Without this module, SecureX cannot query FMC for health data.

Answer

AnyConnect Management module

Answer

Cisco Defense Orchestrator module

Answer

Cisco Smart Licensing module

Question 9

When configuring a custom dashboard in Cisco SecureX, what is the primary purpose of adding 'Tiles' from the 'Asset' category?

Accepted Answer

To visualize the current state and status of registered network and endpoint devices.. Tiles in the 'Asset' category of a Cisco SecureX dashboard are designed to surface the inventory and health of registered devices — endpoints, network gear, and other assets pulled from integrated sources like SecureX device insights. They render counts, statuses, and metadata about those assets so analysts can see at a glance what is deployed and whether anything is unhealthy. This is a visualization function, not a packet-capture or access-control function.

Answer

To stream live raw packet captures from the firewall.

Answer

To display the history of threat intelligence research performed by analysts.

Answer

To configure administrative access levels for other dashboard users.

Question 10

Where do you view the aggregate security posture score across all integrated Cisco cloud security products in the SecureX dashboard?

Accepted Answer

SecureX Dashboard. The SecureX dashboard is the unified platform that aggregates security posture scores from all integrated Cisco cloud security products, providing a single pane of glass for cross-product visibility. It pulls telemetry from products like Umbrella, Stealthwatch Cloud, and Defense Orchestrator and computes a consolidated risk/posture score. This is the core value proposition of SecureX as a platform layer above individual product dashboards.

Answer

Cisco Defense Orchestrator

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Umbrella Dashboard

Question 11

You are troubleshooting a connection issue where a remote user cannot access a private cloud application via the Cisco Secure Access ZTNA connector. Which step is most likely to resolve the issue?

Accepted Answer

Check the health status of the ZTNA connector in the Secure Access dashboard.. Verifying the connectivity of the ZTNA connector to the private resource is the first diagnostic step to ensure the tunnel is active.

Answer

Increase the timeout value on the client browser.

Answer

Flush the DNS cache on the corporate firewall.

Answer

Reboot the user's laptop.

Question 12

Which THREE of the following are primary functions of a Cloud Access Security Broker (CASB) regarding application and data security?

Accepted Answer

Automated threat protection for user sessions.. Option C is correct because a CASB provides automated threat protection by inspecting user sessions for malware, compromised accounts, and other threats in real time, often using inline proxies or API-based scanning. Option D is correct because CASB solutions discover and provide visibility into Shadow IT by identifying unsanctioned cloud applications and services in use across the organization. Option E is correct because a CASB enforces Data Loss Prevention (DLP) policies in the cloud, inspecting data in motion and at rest to prevent sensitive information from leaving the organization's control. Option A is incorrect because physical access control for data centers is a facility security function, not a CASB capability. Option B is incorrect because LAN traffic routing is handled by network devices such as routers and switches, not by a CASB.

Answer

Physical access control for data centers.

Answer

Local area network traffic routing.

Question 13

In Cisco Umbrella, what is the primary purpose of defining a 'Cloud Application' in the 'App Discovery' dashboard?

Accepted Answer

To identify and govern Shadow IT usage across the enterprise.. In Cisco Umbrella's App Discovery dashboard, defining a Cloud Application lets you classify and monitor SaaS usage so you can identify unsanctioned (Shadow IT) apps and apply governance policies. It provides visibility into which cloud apps are being used, by whom, and with what risk, enabling allow/block decisions. It is fundamentally a discovery and governance function, not an authentication, bandwidth, or inspection-bypass feature.

Answer

To pre-authenticate users for that SaaS.

Answer

To increase bandwidth for authorized SaaS apps.

Answer

To bypass SSL inspection for the application.

Question 14

When configuring a webhook from an external source to trigger a SecureX orchestration workflow, what is the mandatory authentication requirement?

Accepted Answer

API Client ID and Secret with appropriate scopes. When configuring a webhook to trigger a SecureX orchestration workflow, authentication is mandatory to ensure only authorized sources can initiate workflows. The required method is an API Client ID and Secret with appropriate scopes, which are generated in SecureX and used to obtain an access token. This token is then included in the webhook request for validation.

Answer

LDAP credentials

Answer

A shared static password

Answer

An SSH private key

Question 15

Which component is required to allow Umbrella to perform SSL decryption on web traffic?

Accepted Answer

Deployment of the Umbrella Root CA. To perform SSL decryption, the Umbrella Root CA certificate must be installed on all client endpoints to prevent browser certificate warnings.

Answer

DNS-over-HTTPS setup

Answer

VPN client configuration

Answer

Public IP whitelisting