SCAZT Practice Questions 2 — 50 Questions

Question 1

Which TWO methods can be used to bypass Duo authentication in an emergency?

Accepted Answer

Add the user to a group that has a 'Bypass' policy applied. Option C is correct because Duo policies can be applied to groups, and a group assigned a policy with the "Bypass" setting allows its members to authenticate without completing Duo's second factor. Option E is correct because Duo administrators can generate a temporary bypass code for a specific user, which the user enters in place of the Duo passcode to skip the normal authentication flow for a limited time. Option A is incorrect because renaming an AD account does not affect Duo's authentication enforcement and would not bypass the second factor. Option B is incorrect because resetting the password to '12345' only changes the primary credential and does not disable or bypass Duo MFA. Option D is incorrect because setting the global MFA mode to 'Bypass' for all users is not a supported Duo emergency bypass method and would disable MFA organization-wide rather than for a single user.

Answer

Rename the user's AD account

Answer

Reset the user's password to '12345'

Answer

Set the global MFA mode to 'Bypass' for all users

Question 2

You need to ensure that an incident response playbook in Cisco SecureX automatically updates a case in the Casebook feature. Which action is required in the workflow design?

Accepted Answer

Add Observation to Casebook. In Cisco SecureX orchestration workflows, to have a playbook update a case in Casebook, the workflow must add an observation to the Casebook. Observations are the mechanism by which workflow outputs are attached to a Casebook case, enabling analysts to see enrichment results, IOCs, and notes within the case timeline. This is the specific action required for Casebook integration.

Answer

Post to Incident API

Answer

Update Evidence Store

Answer

Sync with Incident Management

Question 3

Which Cisco Umbrella report provides the most granular visibility into the specific security categories triggered by user traffic?

Accepted Answer

Activity Search Report. The Activity Search Report in Cisco Umbrella provides the most granular, per-request visibility into user traffic, including the specific security categories triggered, the identity of the user or device, the destination, and the action taken. It lets administrators search and filter individual DNS and proxy events, making it the go-to report for drilling into exactly which category a request matched.

Answer

Total Requests Report

Answer

Security Overview Report

Answer

Destination List Report

Question 4

You are configuring Cisco SecureX threat response to investigate a file hash. You notice that the integration module for Cisco Umbrella is showing a status of 'Partial Success'. What is the most likely cause?

Accepted Answer

The integration is limited by insufficient API scopes or permissions on the Umbrella dashboard.. A 'Partial Success' status in a SecureX threat response integration module means the module responded but could not fully complete the enrichment — most commonly because the API credentials lack the scopes or role permissions required for the specific query. For Cisco Umbrella, the Investigate API requires the correct API key type and scopes (e.g., investigate read) and the dashboard user must have the appropriate role; missing scopes cause the module to return partial data rather than a hard failure. Verifying and correcting API scopes/permissions on the Umbrella dashboard resolves the partial success state.

Answer

The file hash is not present in the Umbrella cache.

Answer

The API token has expired and requires a refresh.

Answer

The SecureX relay server is down.

Question 5

You are creating a custom dashboard in SecureX and need to display data from Cisco Secure Endpoint (AMP for Endpoints). Which component must be properly configured first?

Accepted Answer

Secure Endpoint Integration Module. To display data from Cisco Secure Endpoint in a SecureX custom dashboard, the Secure Endpoint Integration Module must be properly configured first. This module enables SecureX to pull data from Secure Endpoint and make it available for dashboards and other SecureX features.

Answer

Cisco Threat Intelligence Grid

Answer

DNS Layer Security Policy

Answer

SecureX Orchestration Workflow

Question 6

When deploying the Cisco Secure Access AnyConnect module, what is the primary role of the Umbrella DNS module within it?

Accepted Answer

To intercept and secure DNS queries. The Umbrella DNS module inside AnyConnect intercepts DNS queries and sends them to Umbrella resolvers for security filtering.

Answer

To manage local network segmentation

Answer

To authenticate users to the cloud

Answer

To encrypt traffic payloads

Question 7

Which section in the Cisco Secure Firewall Management Center (FMC) is primarily used to view security events generated by intrusion policies?

Accepted Answer

Analysis > Intrusions > Events. In Cisco FMC, security events generated by intrusion policies are viewed under Analysis > Intrusions > Events. This section displays triggered intrusion events with details such as rule SID, priority, source/destination, and packet information. The other options are configuration or management areas, not event viewers.

Answer

Policies > Intrusion

Answer

Objects > Object Management

Answer

System > Updates

Question 8

When using SecureX to orchestrate response, which action is best suited for blocking a URL globally?

Accepted Answer

Umbrella Policy Update. Blocking a URL globally is best done by updating the Umbrella policy, since Umbrella enforces DNS-layer and web-layer blocking across all protected networks and roaming clients. An orchestration action that pushes a domain/URL into an Umbrella block list applies the block globally and immediately.

Answer

Endpoint Host File Modification

Answer

FMC Rule Update

Answer

Cloud Access Security Broker Rule

Question 9

An organization uses Duo Access Gateway (DAG) to protect on-premises applications. They want to transition to Duo SSO. What is the primary difference in architecture?

Accepted Answer

Duo SSO eliminates the need for on-premises server infrastructure for the identity provider. Duo Access Gateway (DAG) is an on-premises identity provider that must be installed on a local server to broker authentication for protected applications. Duo SSO is Duo's cloud-hosted identity provider, so migrating to it removes the need to maintain on-premises IdP server infrastructure — authentication is handled in Duo's cloud.

Answer

Duo SSO supports only SAML 1.0 protocols

Answer

Duo SSO requires a dedicated hardware appliance

Answer

Duo SSO requires the installation of the Duo Authentication Proxy on a local server

Question 10

What is the function of an Umbrella 'Integrations' key?

Accepted Answer

To automate API-based policy and log management. An Umbrella 'Integrations' key (also called an API key) is used to authenticate and authorize API calls that automate policy management, reporting, and log retrieval. It enables programmatic access to Umbrella's Investigate, Reporting, and Enforcement APIs for tasks like adding domains to block lists or pulling security logs.

Answer

To sign digital certificates

Answer

To encrypt DNS queries

Answer

To identify roaming clients

Question 11

In the context of the Duo Authentication Proxy, what is the 'fail_mode' parameter used for?

Accepted Answer

To define how to handle requests when the cloud service is unreachable. The fail_mode parameter in the Duo Authentication Proxy determines how authentication requests are handled when the Duo cloud service cannot be reached — for example, whether to fail open (allow) or fail closed (deny) for the configured integration.

Answer

To decide whether to permit local password caching

Answer

To set the timeout for LDAP queries

Answer

To enable logging for failed authentication attempts

Question 12

Which Duo log would be most useful for troubleshooting a failure during the initial push notification delivery?

Accepted Answer

Authentication Log. The Duo Authentication Log records the full authentication attempt lifecycle, including the initial push notification being sent to the user's device, the user's response (approve/deny/timeout), and the final authentication result. When troubleshooting a failure during initial push delivery, this log shows whether the push was dispatched, whether the device was reachable, and any error codes returned by Duo's push service. This makes it the primary log for diagnosing push-delivery failures.

Answer

Directory Sync Log

Answer

Telephony Log

Answer

Administrative Actions Log

Question 13

Which TWO ways does Cisco Secure Cloud Analytics provide visibility into encrypted traffic?

Accepted Answer

TLS fingerprinting. Cisco Secure Cloud Analytics gains visibility into encrypted traffic without decrypting it, and option A (TLS fingerprinting) is correct because it inspects the unencrypted TLS handshake fields — such as the JA3/JA3S hash derived from ClientHello/ServerHello parameters, cipher suites, and extensions — to identify the client or server application even though the payload remains encrypted. Option E (Behavioral analysis of flow patterns) is also correct because the product uses metadata from flow records (for example NetFlow/IPFIX) to model traffic behavior, detecting anomalies like unusual destinations, volumes, or beaconing patterns without needing to see inside the encrypted session. Option B is wrong because Secure Cloud Analytics is a cloud-delivered network telemetry and analytics platform, not an endpoint agent that reads local browser history files. Option C is wrong because installing a root CA on mobile devices is a TLS interception technique used by other tools, not a visibility method of Secure Cloud Analytics. Option D is wrong because Secure Cloud Analytics does not perform full payload decryption at the cloud edge; its value proposition is metadata- and fingerprint-based analytics that preserve privacy and avoid decryption.

Answer

Analyzing the local browser history files

Answer

Installing a root CA on all mobile devices

Answer

Full payload decryption at the cloud edge

Question 14

Which THREE factors should be considered when designing an IaaS security architecture using Cisco Secure Workload (formerly Tetration)?

Accepted Answer

Identity-based policy enforcement. Cisco Secure Workload (formerly Tetration) is built around identity-based policy enforcement, so option C is correct because it uses workload attributes such as labels, tags, and process identity to define granular allow/deny rules rather than relying only on IP addresses. Option D is correct because application dependency mapping is a core capability that discovers workload-to-workload communication flows and builds the behavioral baseline needed to create accurate policies. Option E is correct because host-based sensor deployment is required to collect the telemetry (flows, processes, packages) from each workload that feeds the platform's analytics and policy engine. Option A is not correct because physical switch port mirroring is a network-centric monitoring approach and is not the primary mechanism used by Secure Workload in IaaS environments. Option B is not correct because global firewall rule consolidation is a broad network-security practice, not a specific design factor for Cisco Secure Workload's identity- and workload-centric architecture.

Answer

Physical switch port mirroring

Answer

Global firewall rule consolidation

Question 15

A user is attempting to upload a file to a SaaS application, but the Cisco Umbrella Intelligent Proxy blocks it. What is the most effective way to troubleshoot the block?

Accepted Answer

Use the Umbrella Activity Search dashboard.. The Umbrella Activity Search dashboard (also called Activity Search or Reporting) provides detailed DNS, proxy, and firewall event logs, including the identity, destination, category, and policy that triggered a block. Searching for the user and the destination domain or URL will show exactly which policy rule blocked the upload, making it the most effective troubleshooting tool.

Answer

Reboot the client device.

Answer

Disable the browser cache.

Answer

Check the local host logs.

Question 16

When automating threat response using SecureX, you want to verify if a file hash is malicious using Talos Intelligence. Which tool provides this lookup capability?

Accepted Answer

Threat Intelligence. The Threat Intelligence module in SecureX is the component that performs enrichment lookups against sources like Cisco Talos for observables such as file hashes, IPs, domains, and URLs. When you submit a hash, Threat Intelligence queries Talos and returns verdicts (malicious, suspicious, unknown, benign) along with related context. This is the designated tool for reputation lookups within the SecureX platform.

Answer

Secure Cloud Analytics

Answer

Endpoint Compliance

Answer

Identity Services Engine

Question 17

Which term describes the unauthorized use of cloud applications by employees within an organization?

Accepted Answer

Shadow IT. Shadow IT refers to applications or software used within an organization without explicit IT department approval.

Answer

Zero Trust

Answer

Cloud-Native

Answer

BYOD

Question 18

You are setting up a secure hybrid cloud environment. How do you implement 'Micro-segmentation' between virtual machines in the same subnet?

Accepted Answer

Use host-based security policies or a distributed SDN firewall.. Micro-segmentation is achieved using host-based firewalls or SDN controllers (like those provided by Cisco Secure Workload/Tetration) to enforce policy at the individual workload level.

Answer

Rely on the cloud provider's default network ACLs.

Answer

Place each VM in a different subnet.

Answer

Configure a VLAN for every virtual machine.

Question 19

Which TWO pieces of information are required for a 'Network Identity' in Umbrella?

Accepted Answer

A friendly name for the location. A network identity is defined by the public IP address and a descriptive name to identify the location in reports.

Answer

The internal DHCP server IP

Answer

The local VLAN ID

Answer

The ISP account number

Question 20

What is the purpose of the 'Casebook' in Cisco SecureX?

Accepted Answer

Group observables for investigation. Casebook serves as an incident management workbench, allowing analysts to group observables and evidence for investigation.

Answer

Monitor network traffic

Answer

Configure firewall policies

Answer

Automate endpoint isolation