SCAZT Practice Test 4 — 25 Questions

Question 1

You are seeing 'SSL Inspection Error' in your logs. What is the most likely cause?

Accepted Answer

The Umbrella Root CA is not trusted on the client. SSL inspection errors typically occur when the client cannot validate the certificate presented by the proxy, often due to the missing Root CA.

Answer

The destination server is down

Answer

The policy is set to 'Allow'

Answer

The tunnel is disconnected

Question 2

An organization is migrating to a Secure Internet Gateway (SIG) architecture. They currently have an on-premises firewall blocking all traffic except for specific ports. What is the recommended method to forward traffic to the SIG while maintaining existing security policy consistency?

Accepted Answer

Configure an IPsec tunnel from the firewall to the Cisco SIG headend.. Using an IPsec tunnel ensures that the traffic is encrypted and consistently tagged for the SIG to apply the appropriate security policies.

Answer

Configure port forwarding for all traffic on the firewall to an external DNS proxy.

Answer

Disable the existing firewall to prevent conflicts with the SIG cloud services.

Answer

Replace the existing firewall with an Umbrella Roaming Client.

Question 3

Why is 'SSL/TLS Inspection' necessary in a SASE architecture?

Accepted Answer

To allow the security stack to inspect encrypted payloads for threats and sensitive data.. Without decryption, security tools cannot see the content of encrypted traffic, allowing threats or data leaks to pass undetected.

Answer

To allow the ISP to monitor user traffic.

Answer

To accelerate the connection for the end user.

Answer

To replace the need for end-to-end encryption.

Question 4

You are designing a secure access path for a BYOD device. What is the most effective approach to ensure the device does not compromise the network?

Accepted Answer

Enforce ZTNA with device posture checks and MFA.. ZTNA ensures that the device is checked for posture and the user is authenticated before allowing access, regardless of device ownership.

Answer

Provide the device with a permanent VPN connection.

Answer

Require the device to join the corporate Active Directory domain.

Answer

Configure an open SSID for BYOD devices.

Question 5

When integrating Cisco Cloudlock with O365, which authentication mechanism is required to allow the CASB to perform administrative actions, such as removing a malicious file share?

Accepted Answer

OAuth 2.0 delegated permissions.. Cisco Cloudlock (now part of Cisco Umbrella/Cloudlock CASB) integrates with Microsoft 365 via OAuth 2.0 delegated permissions so the CASB can act on behalf of an authorized admin to enumerate files, inspect shares, and perform remediation such as removing a malicious file share. OAuth 2.0 delegated permissions grant scoped, revocable API access without storing user credentials, which is required for administrative actions against the Microsoft Graph and Office 365 APIs.

Answer

LDAP over TLS.

Answer

SAML 2.0 with manual certificate import.

Answer

Basic Authentication over SSL.

Question 6

What is the purpose of 'Internal Networks' in the Umbrella dashboard?

Accepted Answer

To identify traffic from specific office locations. In the Umbrella dashboard, 'Internal Networks' are used to identify traffic originating from specific office locations or internal network ranges. By defining internal networks, administrators can apply different policies to traffic based on its source, such as allowing or blocking certain categories for users on the corporate network versus remote users. This helps in distinguishing internal traffic from external or guest traffic.

Answer

To cache internal traffic

Answer

To define user groups

Answer

To segment internal VLANs

Question 7

Which of the following describes the 'Duo Central' portal?

Accepted Answer

A user-facing portal that provides a single point of access to apps. Duo Central is a user-facing portal that gives end users a single, unified launch point for all their assigned applications after they authenticate. It presents the apps a user is entitled to and can enforce Duo policies (like device health or MFA) at access time. It is essentially a personalized app dashboard for the end user, not an admin console.

Answer

A local server component for handling RADIUS

Answer

A security tool for scanning endpoints

Answer

A tool for administrators to manage Duo policies

Question 8

When implementing a ZTNA solution, which factor is most crucial when defining an 'Application Access Policy'?

Accepted Answer

The identity of the user and the specific application they require.. In ZTNA, policies must be defined based on the user identity and the specific application, rather than network segments.

Answer

The physical location of the cloud data center.

Answer

The source IP address of the user's laptop.

Answer

The user's department in Active Directory.

Question 9

When designing a SOAR playbook, which mechanism ensures that the playbook does not trigger multiple times for the same alert?

Accepted Answer

Stateful deduplication check. Deduplication logic, often using a 'Case' status check or a stateful flag, prevents redundant executions.

Answer

Random delay node

Answer

Firewall rate limiting

Answer

Task sequencing

Question 10

Which TWO settings should you check if a SecureX integration module shows 'Offline' status?

Accepted Answer

Verify the validity of the API credentials. Option A is correct because a SecureX integration module authenticates to the remote API using its configured API credentials, and if the API key, token, or client secret is expired, revoked, or incorrect, the module cannot establish its session and will report 'Offline'. Option C is correct because the module must reach the API endpoint over the network (typically HTTPS/TCP 443); blocked firewall rules, DNS failures, proxy misconfiguration, or routing problems will prevent the heartbeat/health check from succeeding and cause the Offline status. Options B and D are incorrect because monitor resolution and local browser installation have no bearing on the server-side integration module's connectivity or authentication state. Option E is incorrect because a power cable issue would affect the whole appliance or host, not selectively produce an integration module Offline status while the rest of SecureX remains operational.

Answer

Change the resolution of the computer monitor

Answer

Reinstall the local web browser

Answer

Check the local power cable of the SecureX server

Question 11

You are deploying Umbrella Virtual Appliances (VAs) in a local Active Directory environment. What is the primary purpose of the VA in this deployment?

Accepted Answer

To provide identity-based reporting for internal clients. The Umbrella Virtual Appliance (VA) is deployed on-premises to forward DNS requests from internal clients to Umbrella's global network while preserving the internal client IP addresses. This allows Umbrella to map DNS queries to specific internal users and devices via Active Directory integration, enabling identity-based policy enforcement and reporting. Without the VA, all internal clients would appear as a single NATed public IP, losing per-user visibility.

Answer

To bypass the ISP DNS settings

Answer

To cache web content locally

Answer

To decrypt HTTPS traffic

Question 12

In Cisco Cloudlock, what is the purpose of an 'Incident'?

Accepted Answer

To notify admins of a policy violation.. An incident is an alert generated when a specific policy rule is triggered by a user or data action within a protected SaaS app.

Answer

To record system uptime.

Answer

To manage app credentials.

Answer

To backup user data.

Question 13

You are implementing Cisco Secure Access and need to configure a Global Policy that restricts access to unsanctioned SaaS applications based on their risk score. Where should this policy be applied in the Secure Access dashboard?

Accepted Answer

Under Policy > Access Policies > Web Policy > CASB. In Cisco Secure Access, policies that restrict access to SaaS applications based on risk score are CASB (Cloud Access Security Broker) policies, and they are configured under Policy > Access Policies > Web Policy > CASB. This is where you define rules that evaluate SaaS app risk scores and enforce block or allow actions for unsanctioned applications.

Answer

Under Policy > Network Policies > DNS Policy

Answer

Under Settings > Device Management > SaaS Controls

Answer

Under Connect > Network > Cloud Firewalls

Question 14

Which component in the Cisco SecureX suite allows you to build custom, automated security tasks?

Accepted Answer

Orchestration. The Orchestration component of Cisco SecureX (SecureX orchestration) is the workflow automation engine that lets security teams build custom, automated response and enrichment tasks using a drag-and-drop workflow builder. It connects to Cisco and third-party APIs via prebuilt activities and atomic actions. This is distinct from Threat Response, which is the investigation and enrichment console.

Answer

Device Inventory

Answer

Threat Response

Answer

Security Analytics

Question 15

Which capability does the Cisco SecureX 'Response' feature provide to an incident responder when analyzing a file hash detected in the cloud?

Accepted Answer

The ability to search for the file across integrated product logs and take remediation actions.. SecureX Response (part of the SecureX platform, leveraging Cisco Threat Response) lets an incident responder pivot from an observable like a file hash to search across all integrated Cisco and third-party product telemetry (AMP, Umbrella, Firepower, Email Security, etc.) to see where else the hash appears. From there, the responder can trigger remediation actions such as blocking the hash, isolating an endpoint, or adding to a blocklist directly from the unified interface.

Answer

Automatic deletion of the file from all cloud storage buckets.

Answer

An automated way to reset user passwords in Azure AD.

Answer

A method to update cloud firewall rules via CLI.

Answer

The ability to generate a PDF report of cloud compliance.

Question 16

What is the purpose of the 'Enrollment Email' sent by Duo?

Accepted Answer

To allow the user to register their authentication device. The Enrollment Email sent by Duo is used to invite users to enroll their authentication devices, such as smartphones or hardware tokens. It contains a link that guides the user through the device registration process. This is a core part of Duo's user enrollment workflow.

Answer

To notify the user of a security breach

Answer

To provide instructions on how to use VPN

Answer

To reset the user's domain password

Question 17

When using SecureX Threat Response, you perform a search for a specific IP address. Which sources are queried to build the investigation graph?

Accepted Answer

All enabled integration modules in SecureX. SecureX Threat Response queries all enabled integration modules — such as Cisco Secure Endpoint, Secure Firewall, Umbrella, and third-party threat intel sources — to build a comprehensive investigation graph for an observable like an IP address. This aggregated view is the core value of Threat Response.

Answer

Only the locally cached logs from the browser

Answer

The public DNS whois database only

Answer

The local host file on the analyst's workstation

Question 18

When managing incidents in SecureX, which TWO actions can be performed directly from a Casebook?

Accepted Answer

Trigger a workflow. Casebook allows analysts to add observables for investigation and trigger pre-configured workflows to automate response.

Answer

Manage user passwords

Answer

Modify firewall firmware

Answer

Delete all historical logs

Question 19

Which Duo feature allows an administrator to visualize the percentage of users who have successfully registered their mobile devices?

Accepted Answer

Duo Dashboard. The Duo Dashboard provides administrators with visualizations and summary metrics, including the percentage of users who have successfully registered their mobile devices (enrollment status). It aggregates enrollment, authentication, and device health data into widgets and reports. The Authentication Log, Policy Editor, and Trust Monitor serve different purposes and do not provide this enrollment percentage visualization.

Answer

Duo Authentication Log

Answer

Duo Policy Editor

Answer

Duo Trust Monitor

Question 20

You are analyzing a 'Domain Blocked' event in Umbrella. The explanation says 'Proxy'. What does this imply?

Accepted Answer

The traffic was caught by the selective proxy. In Umbrella, a 'Domain Blocked' event with the explanation 'Proxy' indicates that the traffic was blocked by the selective proxy, which is used for URL filtering and SSL inspection. This means the block occurred at the proxy layer, not at the DNS layer. The selective proxy inspects HTTP/HTTPS requests and applies policies based on URL, category, or other attributes.

Answer

The user is not authenticated

Answer

The request was blocked by the firewall

Answer

The domain was blocked by the DNS resolver