SCAZT Application And Data Security — 15 Questions

Question 1

You are implementing Cisco Umbrella CASB to restrict file uploads to unsanctioned SaaS applications. You have configured an App Control rule, but users can still upload files to a cloud storage service. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Intelligent Proxy is disabled in the Web Policy.. Cisco Umbrella CASB requires the intelligent proxy to be enabled to perform deep packet inspection (DPI) and enforce file upload restrictions at the application level.

Answer

The SSL inspection certificate is not installed on the server.

Answer

The SaaS application is whitelisted in the Global Settings.

Answer

The DNS policy is not configured for the user group.

Question 2

You are investigating a data leak in Google Drive using Cisco Cloudlock. You notice that a user shared a folder with the 'public'. How can you verify exactly who accessed this folder?

Accepted Answer

Check the Cloudlock Incident Audit logs.. Cloudlock's Audit logs record activities associated with shared files, allowing administrators to track who accessed the resources.

Answer

Perform a packet capture on the gateway.

Answer

Review the Google Drive 'Activity' tab only.

Answer

Review the Cisco Umbrella DNS logs.

Question 3

A security administrator needs to prevent users from downloading corporate files to personal devices using Cisco Cloudlock. Which policy type must be implemented to achieve this session-level control?

Accepted Answer

Real-Time Protection policy.. Cisco Cloudlock uses 'Real-Time Protection' via API or proxy-based integrations to enforce session-level controls like restricting downloads based on device posture.

Answer

User Behavior Analytics (UBA) policy.

Answer

Threat detection policy.

Answer

Data Loss Prevention (DLP) policy.

Question 4

You are configuring a DLP policy in Cisco Cloudlock. Which setting allows the policy to ignore files that have been cryptographically signed by your organization's internal CA?

Accepted Answer

File Metadata Exclusion.. The 'Fingerprinting' or 'Custom File Attribute' feature allows administrators to exclude files based on metadata or signatures, preventing false positives.

Answer

Content Inspection Override.

Answer

DLP Sensitivity Threshold.

Answer

Object Scoping.

Question 5

Which component of Cisco's secure cloud access architecture is responsible for performing URL filtering and malware scanning on traffic destined for SaaS applications?

Accepted Answer

Cisco Umbrella. Cisco Umbrella acts as a secure web gateway (SWG) to inspect traffic flow and perform URL filtering and malware analysis.

Answer

Cisco Secure Endpoint

Answer

Cisco Cloudlock

Answer

Cisco Adaptive Security Appliance

Question 6

When configuring Cisco Duo for SaaS application access, which THREE conditions can be used in a 'Policy' to restrict access to a sensitive application?

Accepted Answer

Operating System version. Duo allows for granular access control based on user location, device security posture, and authentication methods.

Answer

File size limit

Answer

Application bandwidth usage

Question 7

You have configured a DLP policy in Cisco Cloudlock that flags files shared with external users. You notice files shared with 'Anyone with the link' are not being flagged. What is the most likely configuration error?

Accepted Answer

The scope of the policy is set to 'internal' only.. Cloudlock policies require the specific permission level (e.g., 'Public' or 'Anyone with link') to be explicitly selected in the 'Exposure' criteria of the policy engine.

Answer

SSL inspection is not enabled.

Answer

The user is an administrator.

Answer

The API token for the SaaS has expired.

Question 8

In Cisco Umbrella, what is the primary purpose of defining a 'Cloud Application' in the 'App Discovery' dashboard?

Accepted Answer

To identify and govern Shadow IT usage across the enterprise.. App Discovery allows administrators to see which shadow IT applications are in use and decide whether to block or monitor them via policy.

Answer

To pre-authenticate users for that SaaS.

Answer

To increase bandwidth for authorized SaaS apps.

Answer

To bypass SSL inspection for the application.

Question 9

You are auditing a Cisco Cloudlock deployment for O365. Which TWO methods can be used to remediate a file that violates a Data Loss Prevention policy?

Accepted Answer

Delete the file. Cloudlock provides automated remediation actions including changing the permission level of the file or deleting the file entirely.

Answer

Block the user account in Active Directory

Answer

Change the file owner

Answer

Re-encrypt the file with a new key

Question 10

Which Cisco technology provides visibility and control over SaaS applications using API-based integration to inspect data at rest?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is an API-based CASB that monitors data at rest in SaaS applications by connecting directly to the cloud provider's APIs.

Answer

Cisco Secure Firewall

Answer

Cisco Stealthwatch

Answer

Cisco Umbrella

Question 11

You are configuring a Cisco Cloudlock policy to detect sensitive data in a Salesforce environment. You need to identify instances where credit card numbers are shared publicly. Which specific policy category should you configure?

Accepted Answer

Data Exposure. The Cisco Cloudlock Data Loss Prevention engine uses specific policy categories to identify PII/PCI data, and 'Data Exposure' is the correct category for monitoring sharing settings.

Answer

User Behavior Analytics

Answer

Application Firewall

Answer

Threat Intelligence

Question 12

When integrating Cisco Umbrella with a SaaS application, which TWO methods can be used to ensure secure user authentication?

Accepted Answer

Duo MFA integration. Umbrella can work with IdPs (like Duo or Azure AD) to enforce SAML-based authentication and ensure consistent security posture.

Answer

SNMP monitoring

Answer

Local LDAP database

Answer

WPA2-Enterprise

Question 13

A user is attempting to upload a file to a SaaS application, but the Cisco Umbrella Intelligent Proxy blocks it. What is the most effective way to troubleshoot the block?

Accepted Answer

Use the Umbrella Activity Search dashboard.. The Umbrella Activity Search is the primary tool to see why a specific request (domain/URL) was blocked by policy.

Answer

Reboot the client device.

Answer

Disable the browser cache.

Answer

Check the local host logs.

Question 14

Which THREE criteria can be used to classify a 'Shadow IT' application in Cisco Umbrella?

Accepted Answer

Volume of traffic. Shadow IT identification is based on traffic volumes, application category, and risk scores assigned by Umbrella.

Answer

User's password hash

Answer

Device serial number

Question 15

Which THREE data types are commonly supported by the Cisco Cloudlock DLP engine for pattern matching?

Accepted Answer

Passport Numbers. Cloudlock uses a wide variety of predefined regex and pattern matching templates for common sensitive data, including credit cards, social security numbers, and passport numbers.

Answer

Unencrypted binary firmware images

Answer

System BIOS versions