SCAZT Practice Test 22 — 15 Questions

Question 1

When building a custom API integration in SecureX, which TWO authentication protocols are commonly supported for secure access?

Accepted Answer

API Key. Option A (API Key) is correct because SecureX custom API integrations commonly authenticate requests by passing a static API key or token in the request header, which the platform validates to grant access to the API. Option D (OAuth2) is correct because SecureX supports OAuth2 authorization flows, allowing integrations to obtain bearer access tokens for secure, scoped, and revocable access to protected resources. Options B (Kerberos), C (NTLM), and E (LDAP) are not the commonly supported authentication protocols for SecureX custom API integrations; Kerberos and NTLM are Windows domain authentication mechanisms, and LDAP is a directory access protocol rather than an API authentication scheme used by SecureX for this purpose.

Answer

Kerberos

Answer

NTLM

Answer

LDAP

Question 2

Which Cisco product facilitates 'Cloud-to-Cloud' security by monitoring activities in SaaS platforms like Microsoft 365?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock (part of the Secure Access suite) is a CASB that integrates via API to monitor and protect SaaS applications.

Answer

Cisco Firepower

Answer

Cisco Duo

Answer

Cisco Umbrella

Question 3

When designing a cloud security architecture, why is 'logging and observability' so critical?

Accepted Answer

To ensure compliance and enable efficient threat hunting.. Centralized logging provides the necessary data for threat hunting, compliance auditing, and troubleshooting in a distributed cloud environment.

Answer

To automatically block all incoming traffic.

Answer

To reduce the cost of cloud storage.

Answer

To increase the speed of the internet connection.

Question 4

Which TWO methods can be used to identify internal clients in Cisco Umbrella reports?

Accepted Answer

Umbrella Virtual Appliance (VA). Option A, the Umbrella Virtual Appliance (VA), is correct because it is deployed on-premises and forwards DNS requests to Umbrella while embedding the internal client's IP address in the request metadata, allowing Umbrella to attribute activity to specific internal endpoints in reports. Option C, the Umbrella Roaming Client, is correct because it runs on individual endpoints and tags DNS queries with a device identifier and internal identity, so Umbrella can report on that specific client even when it is off-network. Option B, DHCP relay settings, is not a supported Umbrella client-identification method; DHCP relay is used for IP address assignment, not for tagging DNS traffic to Umbrella. Option D, the public IP address of the ISP, only identifies the network's egress point, not individual internal clients, so it cannot distinguish internal users in reports. Option E, DNS-over-HTTPS, is an encrypted DNS transport protocol and does not by itself provide Umbrella with internal client identity for reporting.

Answer

DHCP relay settings

Answer

Public IP address of the ISP

Answer

DNS-over-HTTPS

Question 5

A user is attempting to access a cloud application protected by Duo SSO. The Duo prompt shows 'Access Denied: Your device is not running a supported browser'. Where is this restriction defined?

Accepted Answer

In the Duo Application configuration under 'Browser Restrictions'. The 'Access Denied: Your device is not running a supported browser' message from Duo SSO is generated by the Duo application's browser restriction settings. In the Duo Admin Panel, each protected application can be configured with browser restrictions that define which browsers and versions are permitted, and Duo enforces this at the SSO prompt before granting access.

Answer

In the Active Directory GPO for the user

Answer

In the Duo Authentication Proxy configuration file

Answer

In the local browser settings of the client machine

Question 6

A security analyst is reviewing Cisco Umbrella logs to investigate a potential malware infection. The analyst wants to identify which internal host attempted to resolve a known malicious domain. Which log type in Cisco Umbrella should the analyst examine?

Accepted Answer

DNS logs. The correct answer is DNS logs. Cisco Umbrella DNS logs capture all DNS queries and responses, including the source IP and requested domain. This allows analysts to trace which internal host attempted to resolve a malicious domain, which is essential for investigating malware infections.

Answer

Proxy logs

Answer

IP logs

Answer

Firewall logs

Question 7

A security architect is designing a Cisco Secure Access deployment for a hybrid workforce. The requirement is to inspect TLS traffic for SaaS applications while preserving privacy for banking and healthcare categories, and to avoid breaking certificate-pinned applications. Which combination of Secure Access features should be used?

Accepted Answer

Configure selective TLS decryption with category-based bypass for banking and healthcare, and add pinned applications to a decryption exemption list. Selective TLS decryption in Cisco Secure Access enables inspection of specific traffic while bypassing categories that require privacy, such as banking and healthcare. Adding pinned applications to a decryption exemption list prevents certificate validation failures. This combination satisfies the need to inspect SaaS traffic, respect privacy constraints, and maintain compatibility with certificate-pinned applications without resorting to global decryption or disabling inspection.

Answer

Deploy a forward proxy on-premises with TLS bridging and mirror traffic to Secure Access for analysis

Answer

Enable full TLS decryption globally and add banking and healthcare domains to a bypass list; rely on default certificate handling for pinned apps

Answer

Disable TLS decryption entirely and use DNS-layer security plus cloud firewall rules to inspect SaaS traffic

Question 8

A security analyst is investigating an incident in Cisco SecureX threat response and needs to determine which endpoint in the environment first observed a malicious file hash. The analyst has already run a pivot from the file hash to see related observables. Which action should the analyst take next to identify the earliest sighting?

Accepted Answer

Open the Sightings tab for the file hash observable and sort by timestamp ascending.. The Sightings tab within Cisco SecureX threat response aggregates observations from all integrated security modules and displays them with timestamps. Sorting by timestamp ascending immediately shows which module observed the observable first, allowing the analyst to identify the earliest endpoint. This is the standard investigative step for determining the origin of a threat.

Answer

Export the investigation summary as a PDF and manually compare timestamps from each module.

Answer

Use the Threat Response API to query the /sightings endpoint with the file hash and parse the JSON output.

Answer

Navigate to the Investigate tab and run a new enrichment query for the file hash.

Question 9

A security team is using Cisco Cloudlock to protect data in a sanctioned Microsoft 365 tenant. They need to automatically apply a sensitivity label to files that match a custom regular expression for project code names, without blocking user activity. Which Cloudlock policy action should they configure?

Accepted Answer

Set the policy action to 'Apply Label' and select the appropriate sensitivity label.. The requirement is to automatically apply a sensitivity label to files matching a custom regex while not blocking users. Cloudlock's Apply Label action integrates with Microsoft Information Protection to assign the chosen label, enabling encryption and policy enforcement downstream. Alerting, quarantining, or revoking sharing either do not label the file or are disruptive, so they do not meet the precise need.

Answer

Set the policy action to 'Alert' with a notification to the security team.

Answer

Set the policy action to 'Revoke Sharing' and remove all external shares.

Answer

Set the policy action to 'Quarantine' and move the file to a secure folder.

Question 10

A security architect is designing data loss prevention for a hybrid workforce using Cisco Cloudlock and Cisco Umbrella. They need to inspect encrypted traffic to a sanctioned cloud app to detect sensitive data uploads, while maintaining privacy for personal banking sites. Which combination of capabilities should they implement?

Accepted Answer

Configure selective SSL decryption for the sanctioned app category and apply Cloudlock DLP policies to that traffic.. Selective SSL decryption for the sanctioned app category enables inspection of encrypted uploads while exempting financial services to respect privacy. Cloudlock DLP policies then analyze the decrypted traffic for sensitive data patterns. Decrypting everything, using only API scanning, or blocking all uploads either violates privacy, misses encrypted traffic, or is too blunt to detect specific sensitive content.

Answer

Use Cloudlock API-based scanning exclusively and disable SSL decryption entirely.

Answer

Enable SSL decryption for all categories and use Cloudlock DLP policies on the decrypted traffic.

Answer

Implement Cisco Umbrella intelligent proxy to block all uploads to cloud apps and rely on that for data protection.

Question 11

A security analyst is using Cisco SecureX threat response to investigate a suspicious domain. The analyst observes that the domain has a 'Sighting' from Cisco Umbrella but no 'Sighting' from Cisco Secure Endpoint. What is the most accurate interpretation of this result?

Accepted Answer

The domain was queried via Umbrella but no endpoint has communicated with it according to Secure Endpoint telemetry.. In Cisco SecureX threat response, a sighting indicates that a specific module observed the observable. A Umbrella sighting means the domain was seen in DNS or web traffic through Umbrella. No Secure Endpoint sighting means that no endpoint managed by Secure Endpoint reported communication with that domain. This is a factual interpretation of the available telemetry, and analysts should avoid over-interpreting the absence of data.

Answer

The domain is malicious and has been blocked by Umbrella, so Secure Endpoint did not see it.

Answer

The domain is only used by IoT devices that are not protected by Secure Endpoint.

Answer

Secure Endpoint integration is offline, so its sightings are not displayed.

Question 12

A SOC manager wants to give analysts a single place in Cisco SecureX to review the status and results of automated response workflows that were triggered by incidents, including which ones succeeded and which failed. Which SecureX capability should the manager point analysts to?

Accepted Answer

The orchestration workflow run history, which lists executions, their status, and step-level results.. Orchestration run history is the authoritative record of workflow executions, capturing status and step-level detail. That is where analysts confirm whether an automated response completed, failed, or partially executed. Investigation graphs, casebooks, and device inventory serve enrichment, collaboration, and asset management respectively, so none of them provides the workflow execution audit the manager requested.

Answer

The Threat Response investigation graph, which visualizes relationships between observables and sightings.

Answer

The device inventory page, which lists onboarded endpoints and their agent health.

Answer

The SecureX dashboard's casebook, which aggregates analyst notes and evidence for each incident.

Question 13

A security administrator is reviewing the Cisco SecureX dashboard and notices that the 'Threat Detections' widget is not displaying any data, even though there have been recent detections in Cisco Secure Endpoint. The administrator has verified that the Secure Endpoint integration is active. What is the most likely cause of the missing data?

Accepted Answer

The dashboard time range is set to a period before the detections occurred.. Cisco SecureX dashboard widgets are filtered by the dashboard's global time range. If the time range is set to a period before the recent detections, the widget will not display them. The integration being active ensures data can flow, but the time range must include the detection events. Adjusting the time range is the first troubleshooting step.

Answer

The administrator's user role lacks permission to view threat detection data.

Answer

The Secure Endpoint integration module requires re-authentication.

Answer

The 'Threat Detections' widget is only available in the SecureX threat response dashboard, not the main dashboard.

Question 14

A security team is deploying Cisco Identity Services Engine (ISE) for a large enterprise. They want to implement a robust posture policy that checks endpoint compliance before granting network access. Which two components are required to perform posture assessment in ISE? (Choose two.)

Accepted Answer

Cisco AnyConnect Secure Mobility Client with ISE Posture module. Posture assessment in Cisco ISE requires two main components: a posture agent on the endpoint, such as the Cisco AnyConnect Secure Mobility Client with the ISE Posture module, and ISE with posture policies configured. The agent collects endpoint compliance data and sends it to ISE, which evaluates it against the policies. Based on the results, ISE can grant, deny, or restrict access. Other features like SGTs, Umbrella, or ANC are not required for the assessment itself, though they may be used in conjunction with posture for enforcement or remediation.

Answer

Cisco Umbrella Roaming Client

Answer

Cisco Adaptive Network Control (ANC)

Answer

Cisco TrustSec Security Group Tags (SGTs)

Question 15

A network security administrator is using Cisco SecureX threat response to investigate a suspicious domain. After running a query, the administrator notices that the 'Verdict' for the domain is 'Unknown' despite having integrated Cisco Umbrella and Cisco Secure Endpoint. Which action should the administrator take to improve the likelihood of obtaining a verdict for future domain queries?

Accepted Answer

Verify that the domain is not an internal or private domain and that it is resolvable by the integrated security services.. In Cisco SecureX threat response, an 'Unknown' verdict indicates that none of the integrated intelligence sources have enough information to classify the domain. This often occurs when the domain is internal, non-resolvable, or not present in the sources' databases. Verifying that the domain is public and resolvable ensures that Cisco Umbrella, Cisco Secure Endpoint, and other integrated modules can query their respective intelligence feeds and return a meaningful verdict.

Answer

Adjust the threat response threshold settings in Cisco SecureX to lower the confidence level required for a verdict.

Answer

Add the domain to a custom allow list in Cisco Umbrella to force a 'Good' verdict.

Answer

Ensure that the Cisco Umbrella integration module is configured with the correct API key and that the domain is not blocked by a custom block list.