SCAZT Practice Test 5 — 10 Questions

Question 1

Which report in Cisco Umbrella provides the most direct view of security threats identified in your environment?

Accepted Answer

Security Activity. The Security Activity report details all blocked threats, including malware, phishing, and command-and-control attempts.

Answer

Top Identities

Answer

Application Usage

Answer

Web Activity

Question 2

What is the primary function of the Duo 'Telephony Credits'?

Accepted Answer

To cover the costs of SMS and voice call authentication. Duo Telephony Credits are a prepaid balance used to pay for out-of-band authentication methods that incur per-use carrier charges — specifically SMS passcodes and voice call callbacks. When a user authenticates via SMS or phone call, Duo deducts credits from the account's balance to cover the telecom cost. This is why Duo recommends migrating users to the Duo Mobile app (push notifications or TOTP), which consumes no telephony credits because it uses data/IP instead of the PSTN.

Answer

To unlock premium reporting features

Answer

To provide hardware tokens to employees

Answer

To pay for the monthly Duo license fee

Question 3

When designing a SOAR playbook for cloud security incidents, which TWO factors are critical for ensuring successful execution?

Accepted Answer

Input validation logic. Input validation logic (A) is critical because SOAR playbooks consume data from alerts, tickets, and external feeds; validating and normalizing that input prevents malformed or malicious values from breaking conditional branches, causing failed API calls, or triggering unintended automated actions. Correct API permissions for integrated tools (D) is equally critical because each playbook action (e.g., isolating an EC2 instance, disabling an IAM key, posting to Slack) executes under a service account or integration credential, and least-privilege scopes must be granted for those specific APIs or the steps will fail with 401/403 errors. Full administrative privileges (B) is not required and violates least privilege, increasing blast radius if the playbook or credential is compromised. Manual intervention steps (C) are optional and can even reduce automation value, so they are not a critical success factor. Frequent database reindexing (E) is unrelated to playbook execution and addresses search performance, not SOAR workflow reliability.

Answer

Full administrative privileges

Answer

Manual intervention steps

Answer

Frequent database reindexing

Question 4

An administrator notices that sensitive data is being shared via Microsoft Teams. Where in the Cloudlock dashboard should they navigate to identify which specific users are sharing the files?

Accepted Answer

Platform > Incidents dashboard.. The Cloudlock Incidents dashboard is where DLP and other policy violations are surfaced, showing details such as the offending file, the policy matched, and the users involved. To identify which specific users are sharing sensitive files via Teams, the administrator reviews the incident details in Platform > Incidents. This is the central triage view for policy violations.

Answer

Platform > Users > Provisioning.

Answer

Platform > Settings > API Configuration.

Answer

Platform > Threat Intelligence.

Question 5

Which component of Cisco's secure cloud access architecture is responsible for performing URL filtering and malware scanning on traffic destined for SaaS applications?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the secure internet gateway component that performs DNS-layer security, URL filtering, and malware/file inspection on traffic destined for SaaS and internet applications. It is the cloud-delivered secure web gateway in Cisco's secure cloud access architecture.

Answer

Cisco Secure Endpoint

Answer

Cisco Cloudlock

Answer

Cisco Adaptive Security Appliance

Question 6

A administrator wants to implement 'Strict' device health checks. What happens if a device reports an unknown OS version?

Accepted Answer

The access attempt is blocked by the policy. In Duo's device health/trusted endpoint policies, the 'Strict' enforcement mode means any device that fails to meet the defined health criteria — including an unrecognized or unknown OS version — is denied access entirely. Because Duo cannot evaluate the posture of an OS it does not recognize, the safe default under Strict is to block the connection rather than downgrade or redirect. This is the defining behavior that separates Strict from permissive or report-only modes.

Answer

The user is redirected to a temporary guest portal

Answer

The user is prompted to upgrade the OS manually

Answer

The user is granted read-only access

Question 7

A company is using Cisco Tetration (Secure Workload) for data center visibility. They need to generate a compliance report that shows communication flows between 'PCI-scoped' and 'Non-PCI-scoped' workloads. Which feature should be used to define this boundary?

Accepted Answer

Scopes.. In Cisco Tetration (Secure Workload), Scopes are used to define logical boundaries for workloads, such as PCI-scoped vs. Non-PCI-scoped. Scopes allow you to group workloads based on criteria (e.g., labels, IP addresses) and then apply policies, generate reports, and analyze traffic between these groups. To generate a compliance report showing communication flows between PCI and Non-PCI workloads, you would define two scopes and then use flow search or policy analysis within those scopes. The other options are related but not the primary feature for defining the boundary.

Answer

Annotation Policies.

Answer

Inventory Filters.

Answer

Flow Search.

Question 8

A security engineer is configuring Duo Authentication for Microsoft 365. The organization requires that users must be prompted for MFA only when accessing cloud resources from outside the corporate network. Which configuration setting in the Duo Admin Panel achieves this?

Accepted Answer

Configure a New Authentication Policy with 'Authorized Networks' set to the corporate office IP range. To prompt for MFA only when accessing Microsoft 365 from outside the corporate network, you configure a New Authentication Policy in the Duo Admin Panel with 'Authorized Networks' set to the corporate office IP range. This policy bypasses MFA for requests originating from those trusted IPs while enforcing MFA for all others.

Answer

Enable 'Duo Device Health' on the Microsoft 365 application object

Answer

Set the global MFA mode to 'Bypass' in the Duo Application settings

Answer

Apply a 'Remembered Device' setting of 30 days to the entire group

Question 9

What are TWO benefits of integrating Cisco Secure Email with SecureX orchestration?

Accepted Answer

Global threat purging. Option B (Global threat purging) is correct because SecureX orchestration can trigger Secure Email's message remediation capabilities across the organization, allowing an administrator to search for and delete malicious messages from all mailboxes at once rather than manually hunting them per-user. Option D (Automated threat extraction) is correct because orchestration workflows can automatically invoke Secure Email's threat extraction feature, which strips active content and attachments from messages and replaces them with safe renditions before delivery, removing the need for manual analyst intervention. The remaining options do not belong: real-time video monitoring (A) is not a Secure Email or SecureX orchestration function, manual email routing (C) contradicts the automation benefit that orchestration provides, and hardware load balancing (E) is an infrastructure/networking concern unrelated to email security integration.

Answer

Real-time video monitoring

Answer

Manual email routing

Answer

Hardware load balancing

Question 10

You are troubleshooting a missing event in Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud). Which configuration should you verify to ensure the cloud gateway is successfully pushing traffic metadata?

Accepted Answer

VPC Flow Logs enablement. Cisco Secure Cloud Analytics (Stealthwatch Cloud) ingests traffic metadata from cloud environments via VPC Flow Logs (in AWS) or equivalent flow logs in other clouds. If VPC Flow Logs are not enabled, the cloud gateway cannot collect and push metadata, resulting in missing events. Therefore, verifying VPC Flow Logs enablement is the correct configuration check.

Answer

Active Directory integration settings

Answer

The local firewall rules on the monitored instance

Answer

SecureX API token synchronization