SCAZT Practice Test 5 — 25 Questions

Question 1

You are analyzing an incident in SecureX. You see an 'Observable' marked in red. What does this indicate?

Accepted Answer

High-severity malicious indicator. Red observables typically indicate a high-severity threat or a known malicious indicator based on intelligence feeds.

Answer

Suspicious but unverified

Answer

Clean/Benign

Answer

Unknown status

Question 2

Which TWO features are part of the Cisco Secure Access suite for remote users?

Accepted Answer

Zero Trust Network Access (ZTNA). Secure Access includes both ZTNA (Zero Trust Network Access) and SWG (Secure Web Gateway) functionality.

Answer

Physical Router Management

Answer

Wireless Controller provisioning

Answer

Local DHCP Server

Question 3

A firm is adopting SASE and needs to secure mobile devices. Which component of the Cisco SASE suite is best suited to protect mobile endpoints?

Accepted Answer

Cisco Secure Client (formerly AnyConnect) with Umbrella roaming module.. The Cisco Umbrella roaming client (integrated with the AnyConnect/Cisco Secure Client) provides consistent protection for mobile devices off-network.

Answer

Cisco Meraki Systems Manager.

Answer

Cisco Cloudlock.

Answer

Cisco Stealthwatch.

Question 4

Why is 'SSL/TLS Inspection' necessary in a SASE architecture?

Accepted Answer

To allow the security stack to inspect encrypted payloads for threats and sensitive data.. Without decryption, security tools cannot see the content of encrypted traffic, allowing threats or data leaks to pass undetected.

Answer

To allow the ISP to monitor user traffic.

Answer

To accelerate the connection for the end user.

Answer

To replace the need for end-to-end encryption.

Question 5

Which TWO methods can be used to identify internal clients in Cisco Umbrella reports?

Accepted Answer

Umbrella Virtual Appliance (VA). Internal clients are identified by either the local IP address (via VA) or the Roaming Client ID.

Answer

DHCP relay settings

Answer

Public IP address of the ISP

Answer

DNS-over-HTTPS

Question 6

You are designing a secure access path for a BYOD device. What is the most effective approach to ensure the device does not compromise the network?

Accepted Answer

Enforce ZTNA with device posture checks and MFA.. ZTNA ensures that the device is checked for posture and the user is authenticated before allowing access, regardless of device ownership.

Answer

Provide the device with a permanent VPN connection.

Answer

Require the device to join the corporate Active Directory domain.

Answer

Configure an open SSID for BYOD devices.

Question 7

What is the primary goal of the 'Cisco SASE' framework?

Accepted Answer

To converge networking and security services into a single cloud-delivered offering.. Cisco SASE combines networking and security capabilities into a single cloud-native service to provide secure, optimized access to users wherever they are.

Answer

To increase the cost of cloud services.

Answer

To replace all physical firewalls in the data center.

Answer

To provide a new type of internet provider service.

Question 8

Which THREE types of information are analyzed by Cisco Secure Workload (Tetration) to enforce micro-segmentation?

Accepted Answer

User identity context. Tetration analyzes process information, user context, and network flow data to define policies.

Answer

The color of the server rack

Answer

User's home address

Question 9

When deploying the Cisco Secure Access AnyConnect module, what is the primary role of the Umbrella DNS module within it?

Accepted Answer

To intercept and secure DNS queries. The Umbrella DNS module inside AnyConnect intercepts DNS queries and sends them to Umbrella resolvers for security filtering.

Answer

To manage local network segmentation

Answer

To authenticate users to the cloud

Answer

To encrypt traffic payloads

Question 10

When using Umbrella's 'Selective Proxy', how is the determination made to route traffic through the proxy vs. direct to destination?

Accepted Answer

Based on the domain categorization. The Selective Proxy uses a list of domains (like those known to host malware) to decide whether to route traffic through the proxy for deep inspection.

Answer

Based on the packet source IP

Answer

Based on the browser type

Answer

Based on the time of day

Question 11

You have a branch office with a static IP. You want to secure it without a local virtual appliance. What is the best method?

Accepted Answer

Use an IP-based Network Identity. Configuring network identity in Umbrella by defining the public IP (Network Identity) allows the gateway to associate traffic with your organization without a tunnel or VA.

Answer

Use a PAC file

Answer

Use DNS-over-HTTPS

Answer

Use the Umbrella Roaming Client

Question 12

You are setting up a secure hybrid cloud environment. How do you implement 'Micro-segmentation' between virtual machines in the same subnet?

Accepted Answer

Use host-based security policies or a distributed SDN firewall.. Micro-segmentation is achieved using host-based firewalls or SDN controllers (like those provided by Cisco Secure Workload/Tetration) to enforce policy at the individual workload level.

Answer

Rely on the cloud provider's default network ACLs.

Answer

Place each VM in a different subnet.

Answer

Configure a VLAN for every virtual machine.

Question 13

Which TWO methods can be used to tunnel traffic from a branch office to the Cisco Umbrella SIG?

Accepted Answer

GRE tunnel. IPsec tunnels and GRE tunnels are the standard methods for connecting site-level traffic to the Umbrella cloud.

Answer

DNS-over-HTTPS

Answer

Bluetooth connectivity

Answer

HTTP Proxy (explicit)

Question 14

When migrating from an explicit proxy to the Umbrella SIG, what is the primary challenge for legacy applications?

Accepted Answer

Hardcoded proxy configurations may break. Legacy applications often have hardcoded proxy settings or require specific authentication methods that may not be supported by the cloud SIG.

Answer

The OS must be upgraded

Answer

The local DNS server will fail

Answer

The bandwidth requirement increases

Question 15

Which THREE components are critical for a successful cloud network segmentation strategy?

Accepted Answer

Access Rules controlling cross-segment traffic. Effective segmentation requires clear definitions of user groups, resource groups, and the access policies that govern their interaction.

Answer

A flat network architecture

Answer

Shared administrative credentials

Question 16

Which TWO of the following are primary components of the Cisco SASE security stack?

Accepted Answer

Cisco Umbrella SIG. Cisco Umbrella SIG and Duo are the core pillars of the Cisco SASE security offering.

Answer

Cisco Webex

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Meraki Go

Question 17

A administrator wants to implement 'Strict' device health checks. What happens if a device reports an unknown OS version?

Accepted Answer

The access attempt is blocked by the policy. Under a 'Strict' policy, if the device health app cannot confirm a supported, patched OS, the access request is denied.

Answer

The user is redirected to a temporary guest portal

Answer

The user is prompted to upgrade the OS manually

Answer

The user is granted read-only access

Question 18

When syncing users from Active Directory to Duo, what is the role of the 'Duo Authentication Proxy'?

Accepted Answer

To facilitate directory synchronization between AD and Duo. The proxy acts as the bridge that performs LDAP/AD queries and pushes user objects to the Duo cloud.

Answer

To enforce hardware-based encryption on AD servers

Answer

To store user passwords locally

Answer

To serve as the primary identity provider for the cloud

Question 19

Which TWO methods can be used to bypass Duo authentication in an emergency?

Accepted Answer

Add the user to a group that has a 'Bypass' policy applied. Temporary bypass codes and a 'Bypass' policy setting for a specific user group are the standard emergency options.

Answer

Rename the user's AD account

Answer

Reset the user's password to '12345'

Answer

Set the global MFA mode to 'Bypass' for all users

Question 20

Which Cisco product provides the primary telemetry source for endpoint-based threat response?

Accepted Answer

Secure Endpoint. Cisco Secure Endpoint (formerly AMP for Endpoints) is the primary source for endpoint telemetry and action execution.

Answer

Umbrella

Answer

Firepower Management Center

Answer

Stealthwatch