SCAZT Practice Test 5 — 25 Questions

Question 1

Which THREE pieces of information are displayed in the Umbrella 'Activity Search' report?

Accepted Answer

Identity that initiated the request. Option A is correct because the Umbrella Activity Search report shows the identity (the user or internal IP/identity) that initiated the DNS request, allowing admins to attribute traffic to a specific person or device. Option B is correct because the report displays the action taken on each request, such as Allowed or Blocked, based on the applied security policy. Option E is correct because each entry includes a timestamp showing when the request occurred, which is essential for chronological investigation and correlation with other logs. Option C is not included because the report concerns DNS/web request metadata, not endpoint hardware details like a hard drive serial number. Option D is not included because passwords are never displayed in reporting; Umbrella logs authentication identities, not credentials.

Answer

Internal hard drive serial number

Answer

User's password

Question 2

Which THREE types of activities are commonly used in SecureX orchestration playbooks for threat containment?

Accepted Answer

Update firewall access policy. In SecureX orchestration playbooks, threat containment typically involves taking direct, automated actions against the affected assets or access paths. Option A (Update firewall access policy) is correct because modifying firewall rules to block malicious IPs, domains, or ports is a standard containment action that limits an attacker's ability to communicate with command-and-control infrastructure or move laterally. Option C (Isolate endpoint) is correct because isolating a compromised endpoint via EDR or network quarantine cuts off the host from the network while preserving it for forensic investigation, which is a core containment technique. Option E (Disable user account) is correct because disabling a compromised or suspicious user account prevents further unauthorized access and stops the attacker from using those credentials to pivot or persist. Option B (Clear browser cache) is not a containment activity — it is a remediation or hygiene step that does not stop an active threat. Option D (Restart the operating system) is not containment either; rebooting may disrupt volatile evidence and does not reliably prevent an adversary from continuing their activity.

Answer

Clear browser cache

Answer

Restart the operating system

Question 3

You are designing a secure remote access solution for a hybrid cloud environment. Which Cisco technology should you implement to replace a traditional VPN while enforcing Zero Trust principles?

Accepted Answer

Cisco Secure Access (ZTNA). Cisco Secure Access (the ZTNA offering) provides per-application access based on identity and posture, replacing the broad network access of a VPN.

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Meraki Client VPN

Answer

Cisco Firepower VPN

Question 4

Which THREE factors can be evaluated by Duo Device Health during an access request?

Accepted Answer

OS version and patch level. Duo Device Health evaluates endpoint posture attributes at access time, and OS version and patch level (B) is one of its supported checks, allowing policies to require a minimum OS build or patch state before granting access. Disk Encryption status (D) is also a native Device Health signal, so administrators can block or step-up authentication for devices whose drives are not encrypted (e.g., BitLocker, FileVault). Antivirus status (E) is likewise collected, letting policies verify that a recognized AV product is installed, running, and up to date. The remaining options are not Device Health factors: active Internet connection speed (A) is a network performance metric, not a posture attribute Duo reports, and the user's current GPS location (C) is not gathered by Duo Device Health for access evaluation.

Answer

Active Internet connection speed

Answer

User's current GPS location

Question 5

In a SOAR playbook, which THREE types of data can be used to enrich an incident within a case?

Accepted Answer

File hash analysis. In a SOAR playbook, enrichment adds context to an incident by querying threat-intelligence and analysis services. Option A (File hash analysis) is correct because submitting an MD5/SHA-256 hash to services like VirusTotal or a sandbox returns detections, malware family, and prevalence data that directly enrich the case. Option D (Domain age and ownership) is correct because WHOIS/RDAP lookups return registrar, creation date, and registrant details, and newly registered or privacy-shielded domains are strong indicators of malicious infrastructure. Option E (IP Reputation) is correct because reputation feeds (e.g., AbuseIPDB, VirusTotal, Talos) return geolocation, ASN, and threat scores for an IP observed in the incident. Option B (Browser version history) is not a standard enrichment data type in SOAR playbooks; it is endpoint inventory/patch data, not threat context. Option C (User physical location) is not typically used for enrichment in this context; identity/asset context such as department or manager may be pulled from a CMDB or directory, but physical location is not a standard enrichment source.

Answer

Browser version history

Answer

User physical location

Question 6

Which THREE settings are part of the 'Authentication Policy' in the Duo Admin Panel?

Accepted Answer

MFA prompt behavior (e.g., auto-push). In the Duo Admin Panel, the Authentication Policy is a global policy that governs how users authenticate, and it explicitly includes the MFA prompt behavior setting (B), such as auto-push and whether users can choose among push, phone call, or passcode, which controls the second-factor experience. It also includes Authorized networks (C), which define IP ranges or CIDR blocks from which users can authenticate without MFA or with reduced requirements, directly shaping authentication enforcement. It further includes Remembered devices duration (E), which sets how long a device can be trusted to skip Duo MFA (for example, 1 to 30 days), a core element of the authentication policy. Hardware token assignment (A) is managed under device/token management and user enrollment rather than the Authentication Policy, and AD forest trust configuration (D) belongs to Active Directory or directory integration settings, not the Authentication Policy.

Answer

Hardware token assignment

Answer

AD forest trust configuration

Question 7

An organization is using Cisco Duo for MFA and wants to monitor for suspicious administrative activity. Which report type in the Duo dashboard provides the most granular visibility into changes made to global settings by an administrator?

Accepted Answer

Administrator Actions Log.. The Administrator Actions Log in the Cisco Duo dashboard records administrative changes such as modifications to global settings, user/group changes, integration updates, and policy edits, along with the admin identity and timestamp. This is the report specifically designed to provide granular visibility into administrative activity, making it the correct answer for monitoring suspicious admin behavior.

Answer

Device Insights Report.

Answer

Telephony Usage Report.

Answer

Integration Health Check.

Answer

Authentication Logs.

Question 8

You are configuring a SASE design to secure traffic from a branch office to the cloud. What is the recommended method for routing internet-bound traffic from the branch to the Cisco Umbrella SIG?

Accepted Answer

Establish an IPsec tunnel from the branch edge device to the nearest Umbrella data center.. IPsec tunnels from the branch edge device (such as a Cisco ISR or Meraki MX) to the Cisco Umbrella SIG provide a secure, encrypted transit for all traffic.

Answer

Configure DNS forwarding only.

Answer

Use an AnyConnect agent on every endpoint in the branch.

Answer

Deploy a local proxy server that intercepts all traffic.

Question 9

A user is experiencing 'SSL Certificate Mismatch' errors. You suspect it is caused by the Umbrella proxy. How do you resolve this permanently?

Accepted Answer

Install the Umbrella Root CA certificate on the endpoint. The 'SSL Certificate Mismatch' error occurs because the Umbrella proxy intercepts SSL traffic and presents its own certificate, which the endpoint does not trust. Installing the Umbrella Root CA certificate on the endpoint allows the endpoint to trust the proxy's certificate, resolving the mismatch permanently.

Answer

Disable SSL decryption in the policy

Answer

Update the browser

Answer

Add the domain to the 'Always Allow' list

Question 10

Which THREE features are provided by the Cisco Umbrella 'Deployments' menu?

Accepted Answer

Virtual appliance setup. The Cisco Umbrella Deployments menu is where administrators configure the various ways endpoints and networks connect to Umbrella's resolvers. Option A (Virtual appliance setup) is correct because the Deployments section provides the virtual appliance (VA) for on-premises DNS forwarding to Umbrella, including its download, registration, and configuration. Option D (Network tunnel configuration) is correct because Deployments lets you create and manage network tunnels (IPsec/Umbrella tunnels) that forward DNS traffic from a network to Umbrella. Option E (Roaming client configuration) is correct because the same menu hosts roaming client (Umbrella Roaming Client) deployment, including identity, profile, and download settings for endpoints. Option B (Custom logo upload for the login page) is not part of Deployments; branding is handled under Admin/Account settings, not deployment configuration. Option C (Hardware firmware update schedule) is not an Umbrella Deployments feature, as Umbrella is a cloud-delivered service and does not manage hardware firmware schedules.

Answer

Custom logo upload for the login page

Answer

Hardware firmware update schedule

Question 11

You are troubleshooting an Umbrella SIG tunnel connection. The IPsec tunnel is up, but users report timeouts. What is the most likely cause if the tunnel MTU is not adjusted correctly?

Accepted Answer

MTU mismatch causing packet fragmentation. When an IPsec tunnel's MTU is not adjusted, large packets get encapsulated with additional IPsec headers, exceeding the path MTU and requiring fragmentation. If DF (Don't Fragment) is set and ICMP is blocked, packets are silently dropped, causing the timeouts users report even though the tunnel shows as up.

Answer

DNS resolution failure in the tunnel

Answer

Incorrect IKEv2 Phase 2 proposal

Answer

Missing Proxy PAC file

Question 12

What does the 'Umbrella dashboard' allow you to do regarding DNS security?

Accepted Answer

Configure global security policies and view reports. The Umbrella dashboard is the central management interface for configuring global security policies, viewing reports, and managing all aspects of DNS security. It allows administrators to set block lists, allow lists, and custom policies that apply across the organization. Additionally, it provides detailed reporting and analytics on DNS requests and security events.

Answer

Provision new ISP links

Answer

Manage local server hardware

Answer

Flash router firmware

Question 13

What is the primary benefit of the Duo Universal Prompt compared to the traditional iframe-based prompt?

Accepted Answer

It is a hosted redirect that provides a more secure and consistent experience. The Duo Universal Prompt is a hosted, redirect-based authentication experience that replaces the traditional iframe-based prompt. Because it is hosted by Duo rather than embedded in the customer's page, it provides a more secure and consistent experience across browsers and devices, and it is not subject to the restrictions and security risks of iframes (e.g., clickjacking, third-party cookie blocking). This design also simplifies integration and future feature rollouts.

Answer

It supports offline authentication only

Answer

It removes the need for mobile devices

Answer

It requires less bandwidth

Question 14

You are investigating a security incident and need to correlate logs from Cisco Secure Endpoint and Cisco Umbrella. What is the key piece of information needed to link these two sets of logs in SecureX?

Accepted Answer

A shared identifier like an internal IP address or user identity. To correlate logs from Cisco Secure Endpoint and Cisco Umbrella in SecureX, a shared identifier such as an internal IP address or user identity is essential. SecureX uses these identifiers to link events across different security products, enabling a unified view of the incident. Without a common identifier, correlation is not possible.

Answer

The browser version used by the user

Answer

The source MAC address only

Answer

The time the laptop was manufactured

Question 15

You need to ensure that all web traffic from a branch office is inspected by the Umbrella SIG. Which configuration step is mandatory on your perimeter router?

Accepted Answer

Create a PBR (Policy Based Routing) to direct traffic to the tunnel. To ensure all web traffic from a branch office is inspected by Umbrella SIG, the perimeter router must be configured with Policy Based Routing (PBR) to redirect traffic into the IPsec tunnel that connects to Umbrella's SIG infrastructure. PBR overrides the default routing table and forces traffic matching specific criteria (e.g., all HTTP/HTTPS) through the tunnel interface. Without PBR, traffic would follow normal default routes and bypass the tunnel.

Answer

Install the Roaming Client on the router

Answer

Define an ACL to permit all traffic to Umbrella

Answer

Enable DNS-over-HTTPS on the router

Question 16

A company wants to prevent users from using personal devices for work. Which Duo policy is most effective for this?

Accepted Answer

Trusted Endpoints policy with certificate requirement. Duo's Trusted Endpoints policy with certificate requirement verifies that the device accessing protected applications possesses a valid device certificate issued by your organization's MDM or Duo's own certificate authority. Personal devices that are not enrolled and do not have the certificate are denied access, effectively blocking BYOD. This is the most direct and enforceable control for restricting access to corporate-managed devices.

Answer

Browser version policy

Answer

Geographic location policy

Answer

MFA prompt frequency policy

Question 17

Which THREE factors influence the performance of a SASE deployment?

Accepted Answer

Encryption processing overhead. Encryption processing overhead (A) is correct because SASE relies heavily on IPsec and TLS tunnels between branches/users and the security service edge, and the CPU/ASIC cost of encrypting and decrypting that traffic directly limits throughput and adds latency. Internet circuit quality (C) is correct because SASE delivers security and networking from the cloud, so packet loss, jitter, and available bandwidth on the underlying WAN/ISP links determine the user experience regardless of the provider's capacity. Distance to the nearest cloud edge node (E) is correct because SASE points of presence (PoPs) terminate tunnels and enforce policy; greater geographic or network distance increases round-trip latency and reduces performance. The number of users logged into the console (B) affects only administrative sessions, not data-plane traffic, and the version of the office software (D) is an endpoint application concern unrelated to SASE transport or security processing.

Answer

The number of users logged into the console

Answer

The version of the office software

Question 18

An organization requires that users on iOS devices must have a passcode enabled to access cloud resources. Which Duo feature enforces this?

Accepted Answer

Duo Mobile Application Policy. Duo Mobile Application Policy allows administrators to define security requirements for the Duo Mobile app itself, including requiring a device passcode (screen lock) on iOS and Android before the app can be used to approve authentication requests. This directly enforces the passcode requirement for accessing cloud resources protected by Duo.

Answer

Active Directory GPO for iOS

Answer

MDM solution integration

Answer

Duo Authentication Proxy RADIUS rule

Question 19

Which THREE of the following are components of the Duo 'Trusted Endpoints' solution?

Accepted Answer

An MDM/UEM solution for device management. Option A (an MDM/UEM solution for device management) is correct because Duo Trusted Endpoints relies on an MDM/UEM platform (such as Intune, Jamf, or Workspace ONE) to enroll, manage, and report the compliance/management state of devices that Duo then evaluates. Option B (a Duo policy configured to require trusted endpoints) is correct because the enforcement mechanism is a Duo policy setting that requires the accessing device to be a trusted endpoint before granting access to the protected application. Option D (a device certificate on the endpoint) is correct because Duo Trusted Endpoints uses a client certificate issued to the managed device as the cryptographic proof of trust that the Duo service validates during authentication. Option C (local firewall on the endpoint) is not part of the solution, since host firewalls control network traffic and play no role in Duo's device trust verification. Option E (Active Directory domain controller) is not a component of Trusted Endpoints, as AD provides identity authentication and directory services rather than the device-trust management and certificate validation that the solution requires.

Answer

Local firewall on the endpoint

Answer

Active Directory domain controller

Question 20

You are reviewing the SecureX 'Threat Response' module. Which THREE actions can you perform directly from the investigation canvas once you have identified a malicious file hash? (Choose three.)

Accepted Answer

Search for the hash across integrated security products.. Option B is correct because the Threat Response investigation canvas lets you pivot a file hash across all integrated security products (e.g., Secure Endpoint, Umbrella, AMP) to see where else that indicator appears. Option D is correct because from the canvas you can pivot directly to the Secure Endpoint file trajectory view, which shows the hash's execution and propagation history on the endpoint. Option E is correct because the canvas provides a Secure Endpoint response action to isolate the affected endpoint, containing the threat while investigation continues. Option A is not a capability of the Threat Response module, as it cannot alter an ISP's global DNS configuration. Option C is not offered as a canvas action; remote shell execution for file deletion is not a supported Threat Response pivot or response action.

Answer

Modify the global DNS configuration for the ISP.

Answer

Execute a remote shell on the endpoint to delete the file.