SCAZT Practice Test 7 — 10 Questions

Question 1

In the context of the Duo Authentication Proxy, what is the 'fail_mode' parameter used for?

Accepted Answer

To define how to handle requests when the cloud service is unreachable. The fail_mode parameter in the Duo Authentication Proxy determines how authentication requests are handled when the Duo cloud service cannot be reached — for example, whether to fail open (allow) or fail closed (deny) for the configured integration.

Answer

To decide whether to permit local password caching

Answer

To set the timeout for LDAP queries

Answer

To enable logging for failed authentication attempts

Question 2

Which Duo log would be most useful for troubleshooting a failure during the initial push notification delivery?

Accepted Answer

Authentication Log. The Duo Authentication Log records the full authentication attempt lifecycle, including the initial push notification being sent to the user's device, the user's response (approve/deny/timeout), and the final authentication result. When troubleshooting a failure during initial push delivery, this log shows whether the push was dispatched, whether the device was reachable, and any error codes returned by Duo's push service. This makes it the primary log for diagnosing push-delivery failures.

Answer

Directory Sync Log

Answer

Telephony Log

Answer

Administrative Actions Log

Question 3

Which TWO ways does Cisco Secure Cloud Analytics provide visibility into encrypted traffic?

Accepted Answer

TLS fingerprinting. Cisco Secure Cloud Analytics gains visibility into encrypted traffic without decrypting it, and option A (TLS fingerprinting) is correct because it inspects the unencrypted TLS handshake fields — such as the JA3/JA3S hash derived from ClientHello/ServerHello parameters, cipher suites, and extensions — to identify the client or server application even though the payload remains encrypted. Option E (Behavioral analysis of flow patterns) is also correct because the product uses metadata from flow records (for example NetFlow/IPFIX) to model traffic behavior, detecting anomalies like unusual destinations, volumes, or beaconing patterns without needing to see inside the encrypted session. Option B is wrong because Secure Cloud Analytics is a cloud-delivered network telemetry and analytics platform, not an endpoint agent that reads local browser history files. Option C is wrong because installing a root CA on mobile devices is a TLS interception technique used by other tools, not a visibility method of Secure Cloud Analytics. Option D is wrong because Secure Cloud Analytics does not perform full payload decryption at the cloud edge; its value proposition is metadata- and fingerprint-based analytics that preserve privacy and avoid decryption.

Answer

Analyzing the local browser history files

Answer

Installing a root CA on all mobile devices

Answer

Full payload decryption at the cloud edge

Question 4

Which THREE factors should be considered when designing an IaaS security architecture using Cisco Secure Workload (formerly Tetration)?

Accepted Answer

Identity-based policy enforcement. Cisco Secure Workload (formerly Tetration) is built around identity-based policy enforcement, so option C is correct because it uses workload attributes such as labels, tags, and process identity to define granular allow/deny rules rather than relying only on IP addresses. Option D is correct because application dependency mapping is a core capability that discovers workload-to-workload communication flows and builds the behavioral baseline needed to create accurate policies. Option E is correct because host-based sensor deployment is required to collect the telemetry (flows, processes, packages) from each workload that feeds the platform's analytics and policy engine. Option A is not correct because physical switch port mirroring is a network-centric monitoring approach and is not the primary mechanism used by Secure Workload in IaaS environments. Option B is not correct because global firewall rule consolidation is a broad network-security practice, not a specific design factor for Cisco Secure Workload's identity- and workload-centric architecture.

Answer

Physical switch port mirroring

Answer

Global firewall rule consolidation

Question 5

A user is attempting to upload a file to a SaaS application, but the Cisco Umbrella Intelligent Proxy blocks it. What is the most effective way to troubleshoot the block?

Accepted Answer

Use the Umbrella Activity Search dashboard.. The Umbrella Activity Search dashboard (also called Activity Search or Reporting) provides detailed DNS, proxy, and firewall event logs, including the identity, destination, category, and policy that triggered a block. Searching for the user and the destination domain or URL will show exactly which policy rule blocked the upload, making it the most effective troubleshooting tool.

Answer

Reboot the client device.

Answer

Disable the browser cache.

Answer

Check the local host logs.

Question 6

When automating threat response using SecureX, you want to verify if a file hash is malicious using Talos Intelligence. Which tool provides this lookup capability?

Accepted Answer

Threat Intelligence. The Threat Intelligence module in SecureX is the component that performs enrichment lookups against sources like Cisco Talos for observables such as file hashes, IPs, domains, and URLs. When you submit a hash, Threat Intelligence queries Talos and returns verdicts (malicious, suspicious, unknown, benign) along with related context. This is the designated tool for reputation lookups within the SecureX platform.

Answer

Secure Cloud Analytics

Answer

Endpoint Compliance

Answer

Identity Services Engine

Question 7

Which term describes the unauthorized use of cloud applications by employees within an organization?

Accepted Answer

Shadow IT. Shadow IT refers to applications or software used within an organization without explicit IT department approval.

Answer

Zero Trust

Answer

Cloud-Native

Answer

BYOD

Question 8

You are setting up a secure hybrid cloud environment. How do you implement 'Micro-segmentation' between virtual machines in the same subnet?

Accepted Answer

Use host-based security policies or a distributed SDN firewall.. Micro-segmentation is achieved using host-based firewalls or SDN controllers (like those provided by Cisco Secure Workload/Tetration) to enforce policy at the individual workload level.

Answer

Rely on the cloud provider's default network ACLs.

Answer

Place each VM in a different subnet.

Answer

Configure a VLAN for every virtual machine.

Question 9

Which TWO pieces of information are required for a 'Network Identity' in Umbrella?

Accepted Answer

A friendly name for the location. A network identity is defined by the public IP address and a descriptive name to identify the location in reports.

Answer

The internal DHCP server IP

Answer

The local VLAN ID

Answer

The ISP account number

Question 10

What is the purpose of the 'Casebook' in Cisco SecureX?

Accepted Answer

Group observables for investigation. Casebook serves as an incident management workbench, allowing analysts to group observables and evidence for investigation.

Answer

Monitor network traffic

Answer

Configure firewall policies

Answer

Automate endpoint isolation