SCAZT Application And Data Security Practice Test 2 — 15 Questions

Question 1

In Cisco Umbrella, what is the primary purpose of defining a 'Cloud Application' in the 'App Discovery' dashboard?

Accepted Answer

To identify and govern Shadow IT usage across the enterprise.. In Cisco Umbrella's App Discovery dashboard, defining a Cloud Application lets you classify and monitor SaaS usage so you can identify unsanctioned (Shadow IT) apps and apply governance policies. It provides visibility into which cloud apps are being used, by whom, and with what risk, enabling allow/block decisions. It is fundamentally a discovery and governance function, not an authentication, bandwidth, or inspection-bypass feature.

Answer

To pre-authenticate users for that SaaS.

Answer

To increase bandwidth for authorized SaaS apps.

Answer

To bypass SSL inspection for the application.

Question 2

You are auditing a Cisco Cloudlock deployment for O365. Which TWO methods can be used to remediate a file that violates a Data Loss Prevention policy?

Accepted Answer

Delete the file. In a Cisco Cloudlock DLP deployment for O365, remediation actions operate directly on the offending file's permissions or existence, so option A (Delete the file) is correct because Cloudlock can remove the violating file from the O365 workload (e.g., OneDrive/SharePoint) to eliminate the exposure. Option D (Change sharing level to Private) is also correct because Cloudlock can revoke external/anonymous access by resetting the file's sharing so only the owner retains access, which directly mitigates the DLP violation. Option B (Block the user account in Active Directory) is not a Cloudlock file-level remediation action and would be handled by identity/AD tooling, not the DLP policy engine. Option C (Change the file owner) is not a standard Cloudlock remediation method and does not by itself stop the data exposure. Option E (Re-encrypt the file with a new key) is not a Cloudlock remediation capability for O365 files and does not address the sharing/permission violation.

Answer

Block the user account in Active Directory

Answer

Change the file owner

Answer

Re-encrypt the file with a new key

Question 3

Which Cisco technology provides visibility and control over SaaS applications using API-based integration to inspect data at rest?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is an API-based CASB that monitors data at rest in SaaS applications by connecting directly to the cloud provider's APIs.

Answer

Cisco Secure Firewall

Answer

Cisco Stealthwatch

Answer

Cisco Umbrella

Question 4

You are configuring a Cisco Cloudlock policy to detect sensitive data in a Salesforce environment. You need to identify instances where credit card numbers are shared publicly. Which specific policy category should you configure?

Accepted Answer

Data Exposure. The Cisco Cloudlock Data Loss Prevention engine uses specific policy categories to identify PII/PCI data, and 'Data Exposure' is the correct category for monitoring sharing settings.

Answer

User Behavior Analytics

Answer

Application Firewall

Answer

Threat Intelligence

Question 5

When integrating Cisco Umbrella with a SaaS application, which TWO methods can be used to ensure secure user authentication?

Accepted Answer

Duo MFA integration. Duo MFA integration (C) is correct because Cisco Umbrella supports Duo as a multi-factor authentication provider, adding a second verification factor to user logins and thereby strengthening secure authentication for SaaS access. SAML integration with an IdP (E) is correct because Umbrella can federate authentication to an identity provider such as Okta, Microsoft Entra ID, or OneLogin via SAML 2.0, enabling single sign-on and centralized, policy-based user authentication. SNMP monitoring (A) is only for collecting device and performance telemetry, not for authenticating users. A local LDAP database (B) is a directory store, not an authentication integration method Umbrella uses for SaaS SSO, and WPA2-Enterprise (D) is a wireless LAN 802.1X security standard unrelated to SaaS user authentication.

Answer

SNMP monitoring

Answer

Local LDAP database

Answer

WPA2-Enterprise

Question 6

A user is attempting to upload a file to a SaaS application, but the Cisco Umbrella Intelligent Proxy blocks it. What is the most effective way to troubleshoot the block?

Accepted Answer

Use the Umbrella Activity Search dashboard.. The Umbrella Activity Search dashboard (also called Activity Search or Reporting) provides detailed DNS, proxy, and firewall event logs, including the identity, destination, category, and policy that triggered a block. Searching for the user and the destination domain or URL will show exactly which policy rule blocked the upload, making it the most effective troubleshooting tool.

Answer

Reboot the client device.

Answer

Disable the browser cache.

Answer

Check the local host logs.

Question 7

Which THREE criteria can be used to classify a 'Shadow IT' application in Cisco Umbrella?

Accepted Answer

Volume of traffic. In Cisco Umbrella, Shadow IT discovery classifies discovered cloud applications using criteria such as the volume of traffic (A), which helps identify how heavily an unsanctioned app is being used across the organization, and the application category (B), such as File Sharing or Collaboration, which groups apps by function for policy decisions. The risk level (E) is also a classification criterion, since Umbrella assigns a risk score to each discovered app to help prioritize which Shadow IT services pose the greatest threat. These three attributes—traffic volume, category, and risk level—are the standard dimensions Umbrella uses to report and filter Shadow IT applications. A user's password hash (C) is never used, as Umbrella does not collect or classify applications by credential data, and a device serial number (D) is not a classification criterion for Shadow IT apps in Umbrella.

Answer

User's password hash

Answer

Device serial number

Question 8

Which THREE data types are commonly supported by the Cisco Cloudlock DLP engine for pattern matching?

Accepted Answer

Passport Numbers. Cisco Cloudlock's DLP engine is designed to detect and classify sensitive data in cloud applications, and it commonly supports structured personal and financial identifiers for pattern matching, including Passport Numbers (B), Credit Card Numbers (D), and Social Security Numbers (E). These data types have well-defined formats (for example, credit cards validated via the Luhn algorithm and SSNs matching the NNN-NN-NNNN pattern), which makes them ideal for regex- and checksum-based detection. Passport numbers are also included because Cloudlock maintains country-specific patterns for government-issued identity documents. The unmarked options do not belong: Unencrypted binary firmware images (A) and System BIOS versions (C) are not personal or sensitive data categories that Cloudlock's DLP engine targets for pattern matching, as they lack the structured, regulated formats the engine is built to identify.

Answer

Unencrypted binary firmware images

Answer

System BIOS versions

Question 9

Which feature in Cisco Cloudlock allows administrators to view a dashboard of users who are behaving outside of their normal baseline?

Accepted Answer

UBA. Cloudlock's UBA (User Behavior Analytics) module uses machine learning to establish a baseline and flag anomalies.

Answer

App Firewall

Answer

Policy manager

Answer

DLP engine

Question 10

When configuring an OAuth policy in Cisco Cloudlock, which TWO actions can be taken against third-party applications granted access to user data?

Accepted Answer

Quarantine the application. In Cisco Cloudlock's OAuth policy configuration, the platform is designed to govern third-party applications that users have authorized to access corporate data, and two of the enforcement actions available are quarantining the application (option A) and revoking authorization (option C). Quarantining the application (A) is correct because Cloudlock can place a risky or non-compliant OAuth app into a restricted/quarantined state, blocking its access to protected data until an administrator reviews it. Revoking authorization (C) is correct because Cloudlock can remove the OAuth token/grant that the user previously issued to the third-party app, immediately terminating the app's access to the user's data. The remaining options are not Cloudlock OAuth policy actions: forcing an OS update on the app server (B) and updating the app's source code (D) are actions on the third-party provider's infrastructure that Cloudlock has no control over, and enabling two-factor authentication for the app (E) is an authentication control configured on the app or identity provider, not an enforcement action within a Cloudlock OAuth policy.

Answer

Force an OS update on the app server

Answer

Update the app's source code

Answer

Enable two-factor authentication for the app

Question 11

Which Cisco Cloudlock policy type should be used to detect when a user logs in from an unusual geographic location?

Accepted Answer

User Behavior Analytics. Cisco Cloudlock's User Behavior Analytics (UBA) policy type is designed to detect anomalous user activity, including logins from unusual geographic locations. UBA builds a behavioral baseline for each user and flags deviations such as impossible travel, atypical login times, or access from new countries. This is distinct from data exposure or threat policies, which focus on content and malware rather than user behavior patterns.

Answer

Data Exposure

Answer

Cross-platform threat

Answer

Application firewall

Question 12

What is the primary function of the 'CASB' category in Cisco Umbrella's web policy?

Accepted Answer

To govern application usage and control data movement.. The CASB category in Umbrella allows admins to enforce policies specifically for cloud applications, such as blocking uploads to unsanctioned tenants.

Answer

To scan emails for malware.

Answer

To filter malicious DNS queries.

Answer

To provide VPN connectivity to the cloud.

Question 13

Which THREE items are included in a Cisco Cloudlock 'Incident' report?

Accepted Answer

Severity level. Cloudlock incidents provide detailed context including the user involved, the severity of the violation, and the specific file or resource affected.

Answer

BIOS version

Answer

User's home Wi-Fi SSID

Question 14

Which TWO settings should be verified if a Cisco Cloudlock API connector to Google Workspace is showing a 'Warning' status?

Accepted Answer

Service account permissions. Option C (Service account permissions) is correct because the Cisco Cloudlock API connector authenticates to Google Workspace using a service account, and if that account lacks the required OAuth scopes or admin-granted domain-wide delegation, the connector cannot retrieve the necessary data and will report a Warning status. Option D (API Token expiration) is correct because Cloudlock's connector relies on OAuth credentials/tokens for the service account; if the token or its associated certificate/credential has expired or been revoked, authentication fails and the connector shows a Warning until the token is refreshed or reauthorized. Option A (Network bandwidth usage) is not a connector-specific setting and would not cause a Warning status for API authentication. Option B (Physical server cooling status) is irrelevant to a cloud-based API connector. Option E (Local DNS server settings) is not a Cloudlock connector configuration and would not typically produce this Warning.

Answer

Network bandwidth usage

Answer

Physical server cooling status

Answer

Local DNS server settings

Question 15

Which term describes the unauthorized use of cloud applications by employees within an organization?

Accepted Answer

Shadow IT. Shadow IT refers to applications or software used within an organization without explicit IT department approval.

Answer

Zero Trust

Answer

Cloud-Native

Answer

BYOD