SCAZT Practice Test 2 — 25 Questions

Question 1

Which interface in Cisco SecureX allows users to manually trigger an orchestration workflow?

Accepted Answer

Workflows Tab. The Workflows Tab in Cisco SecureX is the interface where orchestration workflows are listed, created, edited, and manually executed. From this tab, users can select a workflow and trigger it on demand, as well as view its run history and status.

Answer

Settings Tab

Answer

Reporting Tab

Answer

Help Tab

Question 2

Which of the following is a key component of the SecureX 'Dashboard' customization?

Accepted Answer

Adding and configuring Widgets. SecureX dashboards are customized by adding, removing, and arranging widgets — prebuilt or custom tiles that display data from integrated modules and APIs. This is done through the dashboard UI without touching code or backend systems. Widgets can be resized, repositioned, and configured with filters, making them the primary customization unit.

Answer

Modifying the SecureX source code

Answer

Editing the backend SQL database

Answer

Installing custom browser plugins

Answer

Changing the global CSS file

Question 3

Which TWO methods are used to verify compliance against security policies in Cisco Defense Orchestrator?

Accepted Answer

Generating compliance reports on policy configurations. Option A is correct because Cisco Defense Orchestrator (CDO) provides compliance reporting that evaluates managed device configurations against security policies and highlights violations, giving administrators an auditable view of policy adherence. Option B is correct because CDO's 'Check for Changes' feature compares the running configuration against the last-known-good or baseline configuration to detect configuration drift, which is a core mechanism for verifying ongoing compliance. Options C, D, and E are incorrect because rebooting appliances, running traceroutes from endpoints, and manually reconfiguring firewalls are operational or troubleshooting actions that do not verify compliance against security policies in CDO.

Answer

Rebooting all security appliances

Answer

Executing a manual traceroute from every endpoint

Answer

Manually re-configuring the entire firewall

Question 4

You are creating a custom report in SecureX for compliance auditing. You need to include data from both Cisco Secure Endpoint and Cisco Secure Firewall. What is the requirement to make this possible?

Accepted Answer

Both integration modules must be configured and authenticated in SecureX. To include data from both Cisco Secure Endpoint and Cisco Secure Firewall in a SecureX custom report, both integration modules must be configured and authenticated within SecureX. This ensures SecureX can query each product's API and aggregate the data into a unified report.

Answer

The devices must be on the same VLAN

Answer

You must use the CLI to enable the report feature

Answer

They must be in the same physical rack

Question 5

When implementing a Zero Trust architecture, what is the 'Principle of Least Privilege' (PoLP) specifically intended to achieve?

Accepted Answer

Granting only the necessary permissions required for a user to perform their task.. PoLP ensures that users and devices are granted the minimum level of access required to perform their jobs, minimizing the blast radius of a potential breach.

Answer

Allowing open access to all company resources from the office.

Answer

Giving administrative access to all power users.

Answer

Automating the password rotation process.

Question 6

When troubleshooting a Cisco Umbrella roaming client visibility issue, what does the 'Diagnostic Tool' verify?

Accepted Answer

Connectivity to the Umbrella service and policy sync status. The Umbrella Roaming Client Diagnostic Tool checks connectivity to the Umbrella resolvers and verifies that the client is successfully syncing policy and identity information from the Umbrella dashboard. It reports on DNS resolution path, tunnel status, and whether the client is registered and communicating with the Umbrella service. This directly addresses visibility issues where the client is installed but not enforcing or reporting.

Answer

The encryption strength of the local database

Answer

The local CPU usage of the machine

Answer

Active Directory domain controller sync

Question 7

Which component of SecureX tracks the history of all executed playbooks, allowing you to debug failed automated responses?

Accepted Answer

Workflow Execution History. SecureX orchestration maintains a Workflow Execution History that records every run of a playbook, including inputs, outputs, activity-level details, and errors. This is the component used to debug failed automated responses by inspecting which step failed and why.

Answer

Event Logs

Answer

Casebook Timeline

Answer

Deployment Log

Question 8

If you configure an API-based connector for a new SaaS app in Cisco Cloudlock, when does the initial scan typically begin?

Accepted Answer

Immediately upon saving the configuration.. In Cisco Cloudlock, when you configure an API-based connector for a SaaS application and save the configuration, the initial scan of the tenant's data begins immediately. Cloudlock does not wait for a scheduled window or manual trigger; the scan is initiated as soon as the connector is successfully saved and authenticated.

Answer

At midnight, based on the system clock.

Answer

Only when the first user logs in.

Answer

After an administrator manually clicks 'Start'.

Question 9

What is the role of a 'Policy' in Cisco Umbrella?

Accepted Answer

To define security and filtering rules for identities. In Cisco Umbrella, a Policy is the construct that defines the security and filtering rules applied to a given identity (users, groups, networks, or roaming computers). Policies determine which categories, domains, and security threat types are allowed or blocked, and they are the core mechanism for enforcing acceptable-use and protection requirements.

Answer

To configure hardware settings

Answer

To monitor bandwidth usage

Answer

To manage API credentials

Question 10

Which THREE components are part of the Cisco SecureX suite?

Accepted Answer

Threat Response. Cisco SecureX is a cloud-native security platform whose core components include Threat Response (option A), which provides integrated investigation, threat hunting, and response workflows across Cisco and third-party security products, making it a correct answer. Dashboard (option C) is also a SecureX component, offering a single-pane-of-glass view that aggregates security intelligence, metrics, and alerts from integrated products. Orchestration (option E) is likewise part of SecureX, delivering automation and workflow orchestration through prebuilt playbooks and APIs to streamline security operations. The remaining options do not belong: Cisco IOS-XE CLI (option B) is the command-line interface for Cisco's IOS-XE network operating system, not a SecureX component, and Cisco Webex Meetings (option D) is a collaboration/meeting application unrelated to the SecureX security suite.

Answer

Cisco IOS-XE CLI

Answer

Cisco Webex Meetings

Question 11

In the context of SASE, what is the primary role of the 'Global Anycast Network'?

Accepted Answer

To provide high availability and optimal latency by routing traffic to the nearest security node.. Anycast allows the enterprise to use a single IP address to reach the nearest Umbrella data center, improving performance and reliability.

Answer

To hide the internal IP addresses of the users.

Answer

To manage user credentials across multiple cloud providers.

Answer

To encrypt traffic between the user and the cloud.

Question 12

When configuring Duo Trust Monitor, what is the primary purpose of 'Baseline' behavior?

Accepted Answer

To identify normal authentication patterns for users. Duo Trust Monitor's 'Baseline' behavior establishes what normal authentication looks like for each user by learning patterns such as typical locations, devices, times, and application access. This baseline is then used to detect anomalies that may indicate compromised credentials or risky behavior. It is not an enforcement mechanism, identity sync, or static allow list.

Answer

To enforce MFA for every authentication attempt

Answer

To synchronize identity sources from LDAP

Answer

To define the static list of allowed IP addresses

Question 13

What is the primary function of the 'Threat Response' module within SecureX?

Accepted Answer

Unified investigation across multiple security products. The primary function of the Threat Response module within SecureX is unified investigation across multiple security products. It aggregates and correlates data from Cisco and third-party sources, allowing analysts to pivot across telemetry, threat intelligence, and events in a single interface. It is not a DNS cache, patch manager, or inventory tool.

Answer

DNS query caching

Answer

Automated patch management for Windows servers

Answer

Hardware inventory reporting

Question 14

Which Cisco Cloudlock policy type should be used to detect when a user logs in from an unusual geographic location?

Accepted Answer

User Behavior Analytics. Cisco Cloudlock's User Behavior Analytics (UBA) policy type is designed to detect anomalous user activity, including logins from unusual geographic locations. UBA builds a behavioral baseline for each user and flags deviations such as impossible travel, atypical login times, or access from new countries. This is distinct from data exposure or threat policies, which focus on content and malware rather than user behavior patterns.

Answer

Data Exposure

Answer

Cross-platform threat

Answer

Application firewall

Question 15

You are utilizing Cisco Umbrella to block access to unsanctioned SaaS apps. You want to allow access to O365 but restrict users to only your corporate tenant. Which feature should you enable?

Accepted Answer

Tenant Restrictions. Tenant Restrictions in Cisco Umbrella prevents users from authenticating to non-corporate O365 tenants by injecting HTTP headers that tell Microsoft which tenant IDs are allowed. This allows access to O365 while restricting users to only the organization's tenant, blocking personal or third-party tenants. It is the specific feature designed for this tenant-scoping use case.

Answer

URL filtering

Answer

DNS Layer Security

Answer

SSL Decryption

Question 16

Which report in Cisco Umbrella provides the most direct view of security threats identified in your environment?

Accepted Answer

Security Activity. The Security Activity report details all blocked threats, including malware, phishing, and command-and-control attempts.

Answer

Top Identities

Answer

Application Usage

Answer

Web Activity

Question 17

What is the primary function of the Duo 'Telephony Credits'?

Accepted Answer

To cover the costs of SMS and voice call authentication. Duo Telephony Credits are a prepaid balance used to pay for out-of-band authentication methods that incur per-use carrier charges — specifically SMS passcodes and voice call callbacks. When a user authenticates via SMS or phone call, Duo deducts credits from the account's balance to cover the telecom cost. This is why Duo recommends migrating users to the Duo Mobile app (push notifications or TOTP), which consumes no telephony credits because it uses data/IP instead of the PSTN.

Answer

To unlock premium reporting features

Answer

To provide hardware tokens to employees

Answer

To pay for the monthly Duo license fee

Question 18

When designing a SOAR playbook for cloud security incidents, which TWO factors are critical for ensuring successful execution?

Accepted Answer

Input validation logic. Input validation logic (A) is critical because SOAR playbooks consume data from alerts, tickets, and external feeds; validating and normalizing that input prevents malformed or malicious values from breaking conditional branches, causing failed API calls, or triggering unintended automated actions. Correct API permissions for integrated tools (D) is equally critical because each playbook action (e.g., isolating an EC2 instance, disabling an IAM key, posting to Slack) executes under a service account or integration credential, and least-privilege scopes must be granted for those specific APIs or the steps will fail with 401/403 errors. Full administrative privileges (B) is not required and violates least privilege, increasing blast radius if the playbook or credential is compromised. Manual intervention steps (C) are optional and can even reduce automation value, so they are not a critical success factor. Frequent database reindexing (E) is unrelated to playbook execution and addresses search performance, not SOAR workflow reliability.

Answer

Full administrative privileges

Answer

Manual intervention steps

Answer

Frequent database reindexing

Question 19

An administrator notices that sensitive data is being shared via Microsoft Teams. Where in the Cloudlock dashboard should they navigate to identify which specific users are sharing the files?

Accepted Answer

Platform > Incidents dashboard.. The Cloudlock Incidents dashboard is where DLP and other policy violations are surfaced, showing details such as the offending file, the policy matched, and the users involved. To identify which specific users are sharing sensitive files via Teams, the administrator reviews the incident details in Platform > Incidents. This is the central triage view for policy violations.

Answer

Platform > Users > Provisioning.

Answer

Platform > Settings > API Configuration.

Answer

Platform > Threat Intelligence.

Question 20

Which component of Cisco's secure cloud access architecture is responsible for performing URL filtering and malware scanning on traffic destined for SaaS applications?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the secure internet gateway component that performs DNS-layer security, URL filtering, and malware/file inspection on traffic destined for SaaS and internet applications. It is the cloud-delivered secure web gateway in Cisco's secure cloud access architecture.

Answer

Cisco Secure Endpoint

Answer

Cisco Cloudlock

Answer

Cisco Adaptive Security Appliance