SCAZT Practice Test 6 — 10 Questions

Question 1

Which TWO methods can be used to bypass Duo authentication in an emergency?

Accepted Answer

Add the user to a group that has a 'Bypass' policy applied. Option C is correct because Duo policies can be applied to groups, and a group assigned a policy with the "Bypass" setting allows its members to authenticate without completing Duo's second factor. Option E is correct because Duo administrators can generate a temporary bypass code for a specific user, which the user enters in place of the Duo passcode to skip the normal authentication flow for a limited time. Option A is incorrect because renaming an AD account does not affect Duo's authentication enforcement and would not bypass the second factor. Option B is incorrect because resetting the password to '12345' only changes the primary credential and does not disable or bypass Duo MFA. Option D is incorrect because setting the global MFA mode to 'Bypass' for all users is not a supported Duo emergency bypass method and would disable MFA organization-wide rather than for a single user.

Answer

Rename the user's AD account

Answer

Reset the user's password to '12345'

Answer

Set the global MFA mode to 'Bypass' for all users

Question 2

You need to ensure that an incident response playbook in Cisco SecureX automatically updates a case in the Casebook feature. Which action is required in the workflow design?

Accepted Answer

Add Observation to Casebook. In Cisco SecureX orchestration workflows, to have a playbook update a case in Casebook, the workflow must add an observation to the Casebook. Observations are the mechanism by which workflow outputs are attached to a Casebook case, enabling analysts to see enrichment results, IOCs, and notes within the case timeline. This is the specific action required for Casebook integration.

Answer

Post to Incident API

Answer

Update Evidence Store

Answer

Sync with Incident Management

Question 3

Which Cisco Umbrella report provides the most granular visibility into the specific security categories triggered by user traffic?

Accepted Answer

Activity Search Report. The Activity Search Report in Cisco Umbrella provides the most granular, per-request visibility into user traffic, including the specific security categories triggered, the identity of the user or device, the destination, and the action taken. It lets administrators search and filter individual DNS and proxy events, making it the go-to report for drilling into exactly which category a request matched.

Answer

Total Requests Report

Answer

Security Overview Report

Answer

Destination List Report

Question 4

You are configuring Cisco SecureX threat response to investigate a file hash. You notice that the integration module for Cisco Umbrella is showing a status of 'Partial Success'. What is the most likely cause?

Accepted Answer

The integration is limited by insufficient API scopes or permissions on the Umbrella dashboard.. A 'Partial Success' status in a SecureX threat response integration module means the module responded but could not fully complete the enrichment — most commonly because the API credentials lack the scopes or role permissions required for the specific query. For Cisco Umbrella, the Investigate API requires the correct API key type and scopes (e.g., investigate read) and the dashboard user must have the appropriate role; missing scopes cause the module to return partial data rather than a hard failure. Verifying and correcting API scopes/permissions on the Umbrella dashboard resolves the partial success state.

Answer

The file hash is not present in the Umbrella cache.

Answer

The API token has expired and requires a refresh.

Answer

The SecureX relay server is down.

Question 5

You are creating a custom dashboard in SecureX and need to display data from Cisco Secure Endpoint (AMP for Endpoints). Which component must be properly configured first?

Accepted Answer

Secure Endpoint Integration Module. To display data from Cisco Secure Endpoint in a SecureX custom dashboard, the Secure Endpoint Integration Module must be properly configured first. This module enables SecureX to pull data from Secure Endpoint and make it available for dashboards and other SecureX features.

Answer

Cisco Threat Intelligence Grid

Answer

DNS Layer Security Policy

Answer

SecureX Orchestration Workflow

Question 6

When deploying the Cisco Secure Access AnyConnect module, what is the primary role of the Umbrella DNS module within it?

Accepted Answer

To intercept and secure DNS queries. The Umbrella DNS module inside AnyConnect intercepts DNS queries and sends them to Umbrella resolvers for security filtering.

Answer

To manage local network segmentation

Answer

To authenticate users to the cloud

Answer

To encrypt traffic payloads

Question 7

Which section in the Cisco Secure Firewall Management Center (FMC) is primarily used to view security events generated by intrusion policies?

Accepted Answer

Analysis > Intrusions > Events. In Cisco FMC, security events generated by intrusion policies are viewed under Analysis > Intrusions > Events. This section displays triggered intrusion events with details such as rule SID, priority, source/destination, and packet information. The other options are configuration or management areas, not event viewers.

Answer

Policies > Intrusion

Answer

Objects > Object Management

Answer

System > Updates

Question 8

When using SecureX to orchestrate response, which action is best suited for blocking a URL globally?

Accepted Answer

Umbrella Policy Update. Blocking a URL globally is best done by updating the Umbrella policy, since Umbrella enforces DNS-layer and web-layer blocking across all protected networks and roaming clients. An orchestration action that pushes a domain/URL into an Umbrella block list applies the block globally and immediately.

Answer

Endpoint Host File Modification

Answer

FMC Rule Update

Answer

Cloud Access Security Broker Rule

Question 9

An organization uses Duo Access Gateway (DAG) to protect on-premises applications. They want to transition to Duo SSO. What is the primary difference in architecture?

Accepted Answer

Duo SSO eliminates the need for on-premises server infrastructure for the identity provider. Duo Access Gateway (DAG) is an on-premises identity provider that must be installed on a local server to broker authentication for protected applications. Duo SSO is Duo's cloud-hosted identity provider, so migrating to it removes the need to maintain on-premises IdP server infrastructure — authentication is handled in Duo's cloud.

Answer

Duo SSO supports only SAML 1.0 protocols

Answer

Duo SSO requires a dedicated hardware appliance

Answer

Duo SSO requires the installation of the Duo Authentication Proxy on a local server

Question 10

What is the function of an Umbrella 'Integrations' key?

Accepted Answer

To automate API-based policy and log management. An Umbrella 'Integrations' key (also called an API key) is used to authenticate and authorize API calls that automate policy management, reporting, and log retrieval. It enables programmatic access to Umbrella's Investigate, Reporting, and Enforcement APIs for tasks like adding domains to block lists or pulling security logs.

Answer

To sign digital certificates

Answer

To encrypt DNS queries

Answer

To identify roaming clients