SCAZT Practice Questions 2 — 50 Questions

Question 1

An administrator needs to ensure that only managed devices can access sensitive data in Box. Which Cisco solution feature enables this verification?

Accepted Answer

Secure Access device posture check.. Cisco Secure Access with device posture checks ensures that only devices meeting minimum security requirements can access defined SaaS applications.

Answer

SAML assertion mapping.

Answer

Cloudlock custom regex matching.

Answer

OAuth token rotation.

Question 2

Which THREE factors should be considered when designing an IaaS security architecture using Cisco Secure Workload (formerly Tetration)?

Accepted Answer

Identity-based policy enforcement. Secure Workload focuses on visibility, micro-segmentation, and policy enforcement across hybrid clouds.

Answer

Physical switch port mirroring

Answer

Global firewall rule consolidation

Question 3

You are designing a secure remote access solution for a hybrid cloud environment. Which Cisco technology should you implement to replace a traditional VPN while enforcing Zero Trust principles?

Accepted Answer

Cisco Secure Access (ZTNA). Cisco Secure Access (the ZTNA offering) provides per-application access based on identity and posture, replacing the broad network access of a VPN.

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Meraki Client VPN

Answer

Cisco Firepower VPN

Question 4

In an automated threat response scenario, you want to block a malicious domain globally across your environment using Cisco Umbrella. Which API endpoint is utilized by the SecureX orchestrator?

Accepted Answer

Umbrella Enforcement API. The Umbrella Investigate and Enforcement APIs allow for programmatic blocking of domains within the Umbrella dashboard.

Answer

Umbrella Management API

Answer

Umbrella Threat API

Answer

Umbrella Query API

Question 5

You have integrated Cisco Secure Firewall with SecureX. You want to automate the addition of a suspicious IP address to a dynamic object group. Which component in the FMC API architecture is primarily used for this?

Accepted Answer

Network Object API. FMC allows management of network objects via the REST API, enabling dynamic updates to object groups used in access control policies.

Answer

Policy API

Answer

System API

Answer

Event API

Question 6

You are troubleshooting a workflow where an API call to Cisco Secure Email fails with a 401 error. What is the most likely cause?

Accepted Answer

Expired credentials. A 401 error indicates an authorization issue, likely due to expired or incorrect credentials in the Credential object.

Answer

Network timeout

Answer

Payload syntax error

Answer

Invalid API endpoint URL

Question 7

You need to handle a case where an endpoint device is not reachable during an isolation attempt. How should the workflow respond?

Accepted Answer

Notify administrator of failure. The workflow should use error handling to transition to a 'failed' state and alert an admin, as the device may be offline or the agent disconnected.

Answer

Delete the device object

Answer

Retry indefinitely

Answer

Ignore and continue

Question 8

When designing an automated threat response for cloud-native applications, why is it critical to include a 'Human-in-the-loop' (HITL) step in the orchestration workflow?

Accepted Answer

To ensure that automated remediation actions are reviewed and approved before impacting production services.. HITL is critical in automated workflows to prevent false positives from causing business disruption, especially when the remediation involves blocking critical services or isolating production servers.

Answer

Because the Cisco SecureX platform requires a manual key-press to initiate any network-based isolation.

Answer

Because the SOAR platform cannot execute more than one API call without human confirmation.

Answer

To provide evidence for the automated audit log.

Answer

To comply with API rate-limiting requirements on cloud provider platforms.

Question 9

Which report in Cisco Umbrella provides the most direct view of security threats identified in your environment?

Accepted Answer

Security Activity. The Security Activity report details all blocked threats, including malware, phishing, and command-and-control attempts.

Answer

Top Identities

Answer

Application Usage

Answer

Web Activity

Question 10

A company wants to prevent users from bypassing security policies by using unauthorized VPNs or proxies. Which feature in Cisco Umbrella should be enabled to mitigate this risk?

Accepted Answer

Select the 'Proxy and VPN' category within the Destination Lists of the Web Policy.. The 'Proxy and VPN' category in the Umbrella destination lists allows administrators to block access to services that can bypass security filters.

Answer

Deploy the Cisco Secure Endpoint agent to detect unauthorized VPN software.

Answer

Enable the 'Web Proxy' feature in the Global Settings.

Answer

Configure an SSL Inspection rule for all traffic.

Question 11

Which THREE actions can be performed by the Cisco Cloudlock UBA engine?

Accepted Answer

Monitor mass file download events. UBA tracks user activity and can flag anomalies like impossible travel, mass file downloads, and unusual access times.

Answer

Perform port scanning

Answer

Block outbound DNS requests

Question 12

Which of the following is a key component of a successful 'Identity and Access Management' (IAM) strategy in the cloud?

Accepted Answer

Centralized identity provider integration with MFA.. A centralized IAM strategy, such as using an IdP (e.g., Azure AD or Okta) integrated with Cisco Duo, ensures consistent authentication.

Answer

Creating a separate user account for each cloud application.

Answer

Allowing password sharing for shared service accounts.

Answer

Disabling MFA for administrative accounts for speed.

Question 13

Which feature of the Cisco Umbrella SIG is specifically designed to prevent 'Command and Control' (C2) callbacks from infected endpoints?

Accepted Answer

DNS-layer security. The Umbrella DNS layer security identifies and blocks requests to malicious domains associated with C2 infrastructure.

Answer

Firewall-as-a-Service

Answer

SSL Decryption

Answer

Data Loss Prevention

Question 14

Which TWO features of Cisco Umbrella assist in preventing data loss?

Accepted Answer

Data Loss Prevention (DLP). Umbrella uses DLP patterns and file inspection to prevent sensitive data from being uploaded to unauthorized locations.

Answer

DNS query logs

Answer

Local firewall rules

Answer

Automated DNS updates

Question 15

Which protocol and format are used for the payload when triggering an incoming webhook for a SecureX orchestration workflow?

Accepted Answer

HTTP POST with JSON. SecureX webhooks expect JSON payloads via HTTP POST requests to initiate automated tasks.

Answer

MQTT with binary data

Answer

gRPC with Protobuf

Answer

HTTP GET with XML

Question 16

You are designing a playbook that isolates a host based on its IP. What is the standard practice for handling the dynamic IP address of an endpoint using DHCP?

Accepted Answer

Use GUID or Hostname. Instead of IP addresses, use persistent identifiers like Hostname, MAC address, or Secure Endpoint GUID to ensure the correct device is targeted.

Answer

Map IPs via DNS

Answer

Query the DHCP server first

Answer

Use the IP only if it is static

Question 17

You are setting up cloud network segmentation. In the context of Secure Access, how are groups of resources isolated from each other?

Accepted Answer

By using Access Rules and Policies. Security Policies and Access Rules are used to control traffic flows between segments in the cloud environment.

Answer

By assigning different DNS suffixes

Answer

By physical VLANs

Answer

By physical cable separation

Question 18

You are seeing 'SSL Inspection Error' in your logs. What is the most likely cause?

Accepted Answer

The Umbrella Root CA is not trusted on the client. SSL inspection errors typically occur when the client cannot validate the certificate presented by the proxy, often due to the missing Root CA.

Answer

The destination server is down

Answer

The policy is set to 'Allow'

Answer

The tunnel is disconnected

Question 19

In Secure Access, how are 'Traffic Forwarding' profiles used?

Accepted Answer

To define how traffic is routed to the cloud gateway. Traffic Forwarding profiles define which traffic (web, non-web, specific ports) should be sent to the Secure Access cloud.

Answer

To set up load balancing

Answer

To encrypt cloud storage

Answer

To define user roles

Question 20

When configuring a Duo authentication policy for a SaaS app, which THREE device health indicators can be required?

Accepted Answer

Security software (AV) active. Duo's policy engine can require that endpoints have disk encryption enabled, up-to-date operating systems, and activated security software.

Answer

Monitor CPU utilization

Answer

Hard drive space capacity