SCAZT Application And Data Security — 15 Questions

Question 1

You have configured a DLP policy in Cisco Cloudlock that flags files shared with external users. You notice files shared with 'Anyone with the link' are not being flagged. What is the most likely configuration error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The scope of the policy is set to 'internal' only.. Cloudlock policies require the specific permission level (e.g., 'Public' or 'Anyone with link') to be explicitly selected in the 'Exposure' criteria of the policy engine.

Answer

SSL inspection is not enabled.

Answer

The user is an administrator.

Answer

The API token for the SaaS has expired.

Question 2

You are implementing Cisco Umbrella CASB to restrict file uploads to unsanctioned SaaS applications. You have configured an App Control rule, but users can still upload files to a cloud storage service. What is the most likely cause?

Accepted Answer

The Intelligent Proxy is disabled in the Web Policy.. Cisco Umbrella CASB requires the intelligent proxy to be enabled to perform deep packet inspection (DPI) and enforce file upload restrictions at the application level.

Answer

The SSL inspection certificate is not installed on the server.

Answer

The SaaS application is whitelisted in the Global Settings.

Answer

The DNS policy is not configured for the user group.

Question 3

You are investigating a data leak in Google Drive using Cisco Cloudlock. You notice that a user shared a folder with the 'public'. How can you verify exactly who accessed this folder?

Accepted Answer

Check the Cloudlock Incident Audit logs.. Cloudlock's Audit logs record activities associated with shared files, allowing administrators to track who accessed the resources.

Answer

Perform a packet capture on the gateway.

Answer

Review the Google Drive 'Activity' tab only.

Answer

Review the Cisco Umbrella DNS logs.

Question 4

You need to ensure that only corporate-managed devices can access Microsoft 365. Which component should be configured to verify the device's security posture before granting access?

Accepted Answer

Cisco Duo. Cisco Duo is a Zero Trust access platform that performs device trust and posture checks before granting access to applications like Microsoft 365. Its Device Trust feature verifies that the endpoint is corporate-managed, patched, encrypted, and compliant with security policies before allowing authentication to complete. This directly satisfies the requirement to verify device security posture prior to granting access.

Answer

Cisco Secure Firewall

Answer

Cisco Cloudlock

Answer

Cisco Umbrella

Question 5

Which THREE factors influence the risk rating of an application in Cisco Umbrella's App Discovery tool?

Accepted Answer

Compliance certifications. In Cisco Umbrella's App Discovery (Cloud Access Security Broker / CASB) risk rating, the risk score for a discovered cloud application is derived from factors such as the application's compliance certifications (A), which indicate whether it meets recognized regulatory and industry frameworks like SOC 2, ISO 27001, or HIPAA; its encryption support (C), which reflects whether data is protected in transit and at rest using protocols such as TLS; and its data protection standards (D), which cover how the vendor handles data retention, ownership, and privacy commitments. These three attributes directly feed the app's risk score and category (e.g., sanctioned, tolerated, or unsanctioned) in the Umbrella dashboard. Server location (B) is not a risk-rating input in App Discovery, and the number of employees (E) is a vendor size metric that does not influence the application's risk rating.

Answer

Server location

Answer

Number of employees

Question 6

A security administrator needs to prevent users from downloading corporate files to personal devices using Cisco Cloudlock. Which policy type must be implemented to achieve this session-level control?

Accepted Answer

Real-Time Protection policy.. Cisco Cloudlock uses 'Real-Time Protection' via API or proxy-based integrations to enforce session-level controls like restricting downloads based on device posture.

Answer

User Behavior Analytics (UBA) policy.

Answer

Threat detection policy.

Answer

Data Loss Prevention (DLP) policy.

Question 7

You are configuring a DLP policy in Cisco Cloudlock. Which setting allows the policy to ignore files that have been cryptographically signed by your organization's internal CA?

Accepted Answer

File Metadata Exclusion.. The 'Fingerprinting' or 'Custom File Attribute' feature allows administrators to exclude files based on metadata or signatures, preventing false positives.

Answer

Content Inspection Override.

Answer

DLP Sensitivity Threshold.

Answer

Object Scoping.

Question 8

To ensure compliance, you must ensure that all emails containing credit card numbers sent via O365 are encrypted. How is this achieved within the Cloudlock framework?

Accepted Answer

Configure a DLP policy to trigger an 'Apply Sensitivity Label' action.. Cloudlock policies can trigger automated actions such as applying sensitivity labels or encryption policies in the underlying SaaS application upon detecting sensitive content.

Answer

Reset the user's password.

Answer

Enable TLS 1.3 for all outgoing mail.

Answer

Create a firewall rule to block the email.

Question 9

Which feature in Cisco Cloudlock allows you to identify if a SaaS user is logging in from an anonymizer or TOR exit node?

Accepted Answer

User Behavior Analytics (UBA) anomaly detection.. Cisco Cloudlock's Threat Intelligence engine correlates user login logs with known malicious IP reputation lists.

Answer

SaaS application object mapping.

Answer

File content scanning.

Answer

Encryption key management.

Question 10

A security team wants to block uploads of files containing personally identifiable information (PII) to any unsanctioned cloud storage service while still allowing uploads to approved services. They have deployed Cisco Cloudlock and Cisco Umbrella. Which configuration should they implement to achieve this?

Accepted Answer

Use Cisco Umbrella's App Discovery to tag unsanctioned apps, then create a Cloudlock DLP policy that references the Umbrella app tag to block PII uploads to those apps.. The correct approach integrates Cisco Umbrella's App Discovery to identify unsanctioned apps and Cisco Cloudlock's DLP to enforce content-based blocking. Umbrella tags apps as sanctioned or unsanctioned, and Cloudlock can use those tags in policies. This allows granular control: blocking PII uploads only to unsanctioned services while permitting them to approved ones, meeting the security team's requirement without over-blocking.

Answer

In Cisco Umbrella, create a policy that blocks all uploads to unsanctioned apps, and in Cloudlock, create a DLP policy that blocks PII uploads to sanctioned apps only.

Answer

Configure a Cisco Umbrella cloud firewall rule to block all uploads to unsanctioned apps, and use Cloudlock to scan approved apps for PII.

Answer

Create a Cloudlock DLP policy that inspects all uploads and blocks those matching PII patterns, then set the policy to apply only to unsanctioned apps using the Cloudlock app category filter.

Question 11

A financial institution uses Cisco Cloudlock to protect data in Microsoft 365. They need to ensure that when a user shares a file containing credit card numbers with an external domain, the file is automatically quarantined and the user is notified. Which Cloudlock policy action should be configured?

Accepted Answer

Set the policy action to 'Quarantine' and enable user notification in the policy settings.. The 'Quarantine' action in Cloudlock removes the file from the user's view and revokes sharing permissions, effectively containing the exposure. Enabling user notification ensures the user is informed. This combination automatically quarantines the file and notifies the user, satisfying the requirement. Other actions like Alert or Block do not quarantine an already shared file.

Answer

Set the policy action to 'Block' and configure a custom message for the user.

Answer

Set the policy action to 'Alert' and configure an email notification to the user.

Answer

Set the policy action to 'Tombstone' and enable user notification.

Question 12

A security administrator is configuring Cisco Cloudlock to monitor data in a custom application that does not have a native API connector. The application supports OAuth 2.0 and exposes a REST API for file operations. What is the most appropriate way to integrate this application with Cloudlock?

Accepted Answer

Use the Cloudlock Custom API Connector to define the API endpoints and authentication.. The Custom API Connector in Cisco Cloudlock is designed for integrating applications that lack native support. It allows administrators to specify API endpoints, authentication (such as OAuth 2.0), and data mapping so that Cloudlock can scan and enforce policies. This is the standard method for extending Cloudlock's data protection to custom cloud apps.

Answer

Deploy a Cloudlock proxy and configure it to intercept traffic to the custom application.

Answer

Use the Cloudlock Service Provider Interface (SPI) to develop a custom connector.

Answer

Configure Cisco Umbrella's App Discovery to recognize the custom application and then enable Cloudlock scanning.

Question 13

A security engineer is deploying Cisco Cloudlock to protect data in Google Workspace. They need to ensure that files shared with external users are continuously monitored and that any file containing sensitive data is automatically restricted if it becomes publicly accessible. Which two Cloudlock features should be configured to meet these requirements? (Choose two.)

Accepted Answer

Cloudlock's DLP policy with the 'Quarantine' action for files that become public.. Scheduled scans provide continuous monitoring by periodically crawling all files and detecting sensitive data and permission changes. A DLP policy with the Quarantine action automatically restricts files that meet conditions, such as being publicly accessible with sensitive data. Together, they ensure that files are monitored continuously and automatically restricted if they become public, meeting the requirements.

Answer

Cisco Umbrella's App Discovery to identify unsanctioned sharing of files.

Answer

Cloudlock's Incident Management dashboard to manually review and remediate exposures.

Answer

Real-time DLP policies that scan files upon upload and sharing.

Question 14

Which component of Cisco's secure cloud access architecture is responsible for performing URL filtering and malware scanning on traffic destined for SaaS applications?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the secure internet gateway component that performs DNS-layer security, URL filtering, and malware/file inspection on traffic destined for SaaS and internet applications. It is the cloud-delivered secure web gateway in Cisco's secure cloud access architecture.

Answer

Cisco Secure Endpoint

Answer

Cisco Cloudlock

Answer

Cisco Adaptive Security Appliance

Question 15

When configuring Cisco Duo for SaaS application access, which THREE conditions can be used in a 'Policy' to restrict access to a sensitive application?

Accepted Answer

Operating System version. Option B (Operating System version) is correct because Duo policies can include a device/OS-based condition that evaluates the operating system and version of the accessing endpoint, allowing administrators to block or require step-up authentication for outdated or unmanaged OS versions. Option C (MFA strength) is correct because Duo policies can enforce authentication strength by requiring specific factors or methods (e.g., Duo Push, WebAuthn, verified push, or phishing-resistant MFA), so access to a sensitive SaaS app can be restricted to stronger authentication. Option D (Geographic location) is correct because Duo policies support location-based conditions using geolocation/IP data, enabling administrators to allow, deny, or require additional verification based on the user's country or region. Options A (File size limit) and E (Application bandwidth usage) are not Duo policy conditions; Duo evaluates identity, device, authentication, and network/context signals, not file transfer size or SaaS bandwidth consumption.

Answer

File size limit

Answer

Application bandwidth usage