SCAZT Practice Questions 1 — 50 Questions

Question 1

Which THREE types of information are typically displayed in the Cisco Umbrella 'App Discovery' report?

Accepted Answer

Risk Score. The Cisco Umbrella App Discovery report is designed to give visibility into the SaaS and cloud applications in use across the environment, and it surfaces three key data points per application: the Application Name (C), which identifies the discovered app; the Traffic Volume (D), which shows how much bandwidth or request activity that app generates; and the Risk Score (A), which rates the app's security/privacy risk based on Cisco's Cloudlock/Umbrella intelligence. These three fields let administrators quickly triage shadow IT by knowing what the app is, how much it is used, and how risky it is. The other options do not belong: a User's home address (B) is personal data never shown in this report, and an Application's source code (E) is proprietary code that Umbrella has no access to and does not display.

Answer

User's home address

Answer

Application's source code

Question 2

What is the main advantage of using a Secure Internet Gateway (SIG) over a traditional on-premises firewall?

Accepted Answer

Consistent protection for off-network users. A SIG provides security for users regardless of their location, unlike an on-premises firewall which only protects the office network.

Answer

Lower bandwidth costs

Answer

Faster internal LAN speed

Answer

Elimination of the need for DNS

Question 3

You notice an employee is accessing a cloud app that is not approved by IT. Which Umbrella feature allows you to see this activity?

Accepted Answer

App Discovery. App Discovery in Cisco Umbrella provides visibility into all cloud applications being accessed by users on the network, including those not sanctioned by IT. It uses DNS traffic analysis to identify and categorize thousands of SaaS applications, highlighting shadow IT. This feature allows administrators to see which unapproved apps are in use, assess risk, and take action. Thus, App Discovery directly answers the need to see the employee's activity.

Answer

Activity Search

Answer

DNS Policy

Answer

SSL Inspection

Question 4

A user is prompted for MFA but their phone is dead. Which administrative feature allows for a temporary bypass?

Accepted Answer

Issue a temporary bypass code in the Duo Admin Panel. The Duo Admin Panel allows administrators to generate a temporary bypass code for a specific user, which the user can enter in place of the normal MFA push or passcode. This is the designed administrative mechanism for scenarios like a lost or dead phone, and the code can be set with an expiration and usage limit.

Answer

Disable the user's account in Active Directory

Answer

Enable the 'Remembered Device' setting

Answer

Reset the user's password

Question 5

You are troubleshooting a scenario where users are unable to access a specific internal cloud resource after migrating to Cisco Secure Access. The traffic is being blocked by a default policy. How should you modify the traffic flow to ensure internal traffic stays off the SIG?

Accepted Answer

Configure a Tunnel Exclusion in the Secure Access tunnel settings for the internal IP ranges.. Tunnel Exclusions in Cisco Secure Access allow administrators to define internal IP ranges (and domains) that should bypass the SIG tunnel entirely, so traffic to those destinations is routed natively rather than being inspected and blocked by the default policy. This is the correct way to keep internal/private traffic off the Secure Access cloud when users are remote or on-network. Configuring the exclusion ensures the internal resource is reachable without being subjected to cloud web filtering.

Answer

Disable the 'Inspect Traffic' setting globally in the Secure Access dashboard.

Answer

Update the DNS policy to include internal domain suffixes as exceptions.

Answer

Assign the users to a separate Group Policy that has no web filtering enabled.

Question 6

You want to ensure that users are warned before visiting a newly registered domain. Which feature in Cisco Umbrella handles this?

Accepted Answer

Security Settings. In Cisco Umbrella, the Security Settings section includes a feature called 'Newly Seen Domains' that allows you to block or warn users about domains that have been recently registered or observed. When enabled, Umbrella displays a warning page before allowing access, helping to prevent phishing and malware attacks that often use newly registered domains. This is a core part of Umbrella's DNS-layer security and is configured under Security Settings, not under application or category-based policies.

Answer

Application Settings

Answer

Platform Logs

Answer

Web Policy Categories

Question 7

Which of the following is a requirement for using the Duo 'Remembered Devices' feature?

Accepted Answer

The user's browser must accept cookies from the Duo domain. Duo's 'Remembered Devices' feature works by placing a cookie in the user's browser after they complete authentication and choose to remember the device. On subsequent logins, Duo reads that cookie to recognize the device and skip the second factor (within the configured expiration). Therefore the browser must accept cookies from the Duo domain for the feature to function.

Answer

The user must be on the corporate network

Answer

The user must have a registered hardware token

Answer

The endpoint must be joined to a domain

Question 8

Which capability is provided by the Cisco Umbrella 'Reporting' tab?

Accepted Answer

Visibility into blocked domains and security categories. The Cisco Umbrella Reporting tab provides visibility into security activity, including which domains were blocked, the security categories that triggered the block, and the identities or locations involved. This is the primary place to investigate user activity and verify that policies are working as intended.

Answer

Configuration of VPN tunnels

Answer

Automated remediation of endpoint viruses

Answer

Real-time packet inspection of encrypted traffic

Question 9

When troubleshooting DNS queries in Umbrella, which command is most useful on a local machine to see if it is using the Umbrella resolvers?

Accepted Answer

nslookup debug.opendns.com. Running 'nslookup debug.opendns.com' confirms if the query is being answered by the Umbrella infrastructure.

Answer

ping 8.8.8.8

Answer

ipconfig /flushdns

Answer

tracert 208.67.222.222

Question 10

When monitoring compliance in Cisco Defense Orchestrator (CDO), which action should you perform to identify out-of-sync configurations across your Cisco ASA and Firepower Threat Defense devices?

Accepted Answer

Perform a 'Check for Changes' operation. In Cisco Defense Orchestrator (CDO), the 'Check for Changes' operation compares the running configuration on a managed device against the last-known or intended configuration stored in CDO. It surfaces out-of-sync devices — those whose configs drifted due to manual CLI edits or failed deployments — so you can review and remediate. This is the native CDO mechanism for configuration compliance and drift detection across ASA and FTD fleets.

Answer

Run a packet capture on the ASA interface

Answer

Generate a Compliance Report in SecureX

Answer

Reset the device credentials

Question 11

Which THREE items are considered primary components of the Cisco Umbrella 'Identity' structure when creating security policies?

Accepted Answer

Roaming Computer. In Cisco Umbrella, the Identity structure used when building policies is built around three primary identity types: Roaming Computers (A), which are endpoints running the Umbrella Roaming Client/SIG agent and are identified by their registered identity; Networks (B), which are defined by public IP addresses/subnets (or dynamic IPs via the Umbrella network device/AD integration) so all traffic egressing that IP is attributed to the network identity; and Active Directory User/Group (D), which ties DNS requests to AD users or groups via the AD Connector or Virtual Appliance for user-based policy enforcement. These three map directly to Umbrella's policy identity selectors (Roaming Computers, Networks, and AD Users/Groups) and are the standard building blocks for differentiated security policies. A printer's MAC address (C) is not an Umbrella identity construct—Umbrella identities are based on roaming client registration, public IP/network, or AD user/group, not endpoint MAC addresses. A public cloud instance ID (E) is likewise not a primary Umbrella identity type; cloud workloads are typically covered via network/IP identities or the Umbrella SIG/cloud firewall integrations rather than an instance-ID identity.

Answer

MAC Address of the Printer

Answer

Public Cloud Instance ID

Question 12

When performing automated threat hunting, you need to query multiple cloud platforms. Which SecureX feature enables this unified query?

Accepted Answer

Federated Search. SecureX Federated Search allows security analysts to run a single query across multiple integrated cloud platforms and products, aggregating results into a unified view. It connects to various Cisco and third-party sources (e.g., Umbrella, AMP, Threat Grid, Firepower) and returns correlated data, enabling efficient threat hunting without switching consoles. This directly addresses the need for a unified query across cloud platforms.

Answer

Snapshot Analysis

Answer

Centralized Dashboard

Answer

Aggregated Logging

Question 13

In Cisco Secure Cloud Analytics, what is the function of the 'Host Group' configuration?

Accepted Answer

To organize network segments into logical entities for analysis. In Cisco Secure Cloud Analytics, Host Groups are logical containers that let you organize monitored hosts (on-premises, cloud, or hybrid) into meaningful groupings such as by department, VPC, business unit, or security zone. This grouping drives the analytics engine's baselining and anomaly detection, because traffic behavior is evaluated relative to peers within the same group. Without Host Groups, the system would treat all hosts as one flat population, producing noisy and less accurate detections.

Answer

To define the cloud VPC boundaries

Answer

To automate patch deployment

Answer

To increase the polling frequency

Question 14

In Cisco Defense Orchestrator, why would an object show a 'Read Only' status?

Accepted Answer

The object was imported from a device and is not yet managed as a CDO object. In Cisco Defense Orchestrator (CDO), objects that are discovered on a managed device but have not yet been onboarded into CDO's own object database are shown with a 'Read Only' status. This indicates the object is device-local and CDO is only reading it from the device, not managing it as a shared, reusable CDO object. Once the object is imported/claimed into CDO, it becomes editable and can be shared across devices and policies.

Answer

The object is stored on a read-only disk partition

Answer

The object is currently being used in a policy

Answer

The user lacks administrator privileges

Question 15

Which component is required to enable Active Directory integration with Umbrella for user-level reporting?

Accepted Answer

Umbrella AD Connector. The Umbrella AD Connector is a lightweight Windows service that synchronizes user and group information from on-premises Active Directory to the Umbrella dashboard. It enables user-level reporting by mapping internal IP addresses to AD user identities, which is essential for granular visibility and policy enforcement. Without the AD Connector, Umbrella can only report on network-level data, not per-user activity.

Answer

SAML Provider

Answer

Virtual Appliance

Answer

AnyConnect Agent

Answer

Cisco Secure Firewall

Question 16

Which THREE factors are typically considered when evaluating 'Device Posture' in a Zero Trust environment?

Accepted Answer

Disk encryption status. Device Posture in a Zero Trust environment assesses the security hygiene and configuration state of an endpoint before granting access, so option B (Disk encryption status) is correct because full-disk encryption such as BitLocker or FileVault protects data at rest and is a standard compliance signal. Option C (Antivirus status) is correct because the presence, currency, and real-time protection state of endpoint anti-malware (e.g., Defender, CrowdStrike) indicates whether the device can detect and resist threats. Option E (Operating system patch level) is correct because missing OS security updates expose known vulnerabilities, so posture checks verify patch compliance via tools like Intune, Jamf, or conditional access policies. Option A (The user's home internet speed) is not a security posture attribute but a network performance metric, and option D (The user's favorite website) is irrelevant personal preference data with no bearing on device trust.

Answer

The user's home internet speed

Answer

The user's favorite website

Question 17

A global company needs to ensure that users in different regions have the lowest latency when accessing cloud applications. How should the SASE architecture be configured?

Accepted Answer

Ensure users are routed through the global anycast network to the nearest Umbrella data center.. Cisco Umbrella uses a globally distributed anycast network, which automatically routes users to the nearest data center, minimizing latency.

Answer

Manually configure the proxy settings for each user based on their country.

Answer

Install an on-premises proxy server in every region.

Answer

Direct all traffic to a single corporate data center before cloud access.

Question 18

Which Cisco technology should be used to provide visibility and threat detection for traffic traversing between cloud workloads in a VPC?

Accepted Answer

Cisco Secure Workload (Tetration). Cisco Tetration (Secure Workload) provides micro-segmentation and deep observability of traffic between workloads to detect anomalies and threats.

Answer

Cisco Umbrella

Answer

Cisco AnyConnect

Answer

Cisco Duo

Question 19

What is the primary goal of the 'Cisco SASE' framework?

Accepted Answer

To converge networking and security services into a single cloud-delivered offering.. Cisco SASE combines networking and security capabilities into a single cloud-native service to provide secure, optimized access to users wherever they are.

Answer

To increase the cost of cloud services.

Answer

To replace all physical firewalls in the data center.

Answer

To provide a new type of internet provider service.

Question 20

Which THREE mechanisms are commonly used by a CASB to enforce access control to SaaS applications?

Accepted Answer

API-based integration.. A CASB commonly enforces access control to SaaS applications through three primary deployment modes. API-based integration (C) connects directly to the SaaS provider's REST APIs to scan content, apply DLP policies, and enforce access rules without inline traffic inspection. Reverse Proxy (D) sits between users and the SaaS app, intercepting sessions so the CASB can apply authentication, authorization, and policy controls inline. Forward Proxy (E) routes user traffic from the endpoint through the CASB, enabling inline enforcement of access policies for SaaS sessions. Local host firewall rules (A) operate at the OS/network layer and cannot inspect SaaS application context or user identity, so they are not a CASB enforcement mechanism. Direct switch-to-server connection (B) is a network topology concept, not an access-control mechanism used by a CASB.

Answer

Local host firewall rules.

Answer

Direct switch-to-server connection.