SCAZT Application And Data Security Practice Test 3 — 15 Questions

Question 1

When creating a policy in Cisco Cloudlock, what is the significance of setting a 'Threshold'?

Accepted Answer

To define the minimum number of occurrences to trigger an alert.. Thresholds allow you to define how many times a violation must occur (or how many instances of sensitive data are found) before an incident is triggered, reducing noise.

Answer

To limit the total number of files scanned.

Answer

To set the maximum file size for scanning.

Answer

To assign an expiration date to the policy.

Question 2

You are utilizing Cisco Umbrella to block access to unsanctioned SaaS apps. You want to allow access to O365 but restrict users to only your corporate tenant. Which feature should you enable?

Accepted Answer

Tenant Restrictions. Tenant Restrictions in Cisco Umbrella prevents users from authenticating to non-corporate O365 tenants by injecting HTTP headers that tell Microsoft which tenant IDs are allowed. This allows access to O365 while restricting users to only the organization's tenant, blocking personal or third-party tenants. It is the specific feature designed for this tenant-scoping use case.

Answer

URL filtering

Answer

DNS Layer Security

Answer

SSL Decryption

Question 3

Which THREE types of information are typically displayed in the Cisco Umbrella 'App Discovery' report?

Accepted Answer

Risk Score. The Cisco Umbrella App Discovery report is designed to give visibility into the SaaS and cloud applications in use across the environment, and it surfaces three key data points per application: the Application Name (C), which identifies the discovered app; the Traffic Volume (D), which shows how much bandwidth or request activity that app generates; and the Risk Score (A), which rates the app's security/privacy risk based on Cisco's Cloudlock/Umbrella intelligence. These three fields let administrators quickly triage shadow IT by knowing what the app is, how much it is used, and how risky it is. The other options do not belong: a User's home address (B) is personal data never shown in this report, and an Application's source code (E) is proprietary code that Umbrella has no access to and does not display.

Answer

User's home address

Answer

Application's source code

Question 4

What is the primary role of a Cloud Access Security Broker (CASB)?

Accepted Answer

To enforce security policies between cloud users and cloud applications.. A CASB sits between cloud users and cloud applications and enforces security policies such as DLP, access control, threat protection, and compliance monitoring. It is a policy enforcement point for cloud traffic, not an application development or infrastructure management tool.

Answer

To develop SaaS applications.

Answer

To manage physical server racks.

Answer

To provide internet connectivity.

Question 5

Which TWO methods can Cisco Cloudlock use to notify an administrator of a policy violation?

Accepted Answer

Email notification. Cisco Cloudlock can notify administrators of policy violations via Email notification (A), which sends an alert message to configured administrator email addresses, and via Webhook integration (C), which posts an HTTP callback to a configured external endpoint so that third-party systems (such as SIEM or ticketing platforms) can receive and act on the violation event. These two are the supported alerting/notification mechanisms Cloudlock exposes for policy violations. Physical alarm sound (B) is not a Cloudlock capability since it is a cloud service with no local hardware alerting. Automated phone call (D) and SMS text message (E) are also not supported notification channels in Cloudlock's policy violation alerting.

Answer

Physical alarm sound

Answer

Automated phone call

Answer

SMS text message

Question 6

In Cisco Cloudlock, why would you use a 'Custom Regex' pattern in a DLP policy?

Accepted Answer

To detect non-standard sensitive data formats.. Custom Regex patterns allow you to define organization-specific sensitive data formats, such as employee ID numbers or unique project code formats, that aren't in standard templates.

Answer

To increase the storage limit.

Answer

To scan files faster.

Answer

To bypass file encryption.

Question 7

When configuring Cisco Umbrella for SaaS, how does SSL inspection impact the visibility of application traffic?

Accepted Answer

It enables deep packet inspection of SaaS content.. SSL inspection decrypts traffic, allowing the proxy to inspect the actual payload, which is essential for granular visibility and DLP enforcement within SaaS apps.

Answer

It blocks all encrypted traffic.

Answer

It decreases application performance.

Answer

It removes the need for DNS filtering.

Question 8

Which TWO actions can a user take if a file is quarantined by Cisco Cloudlock?

Accepted Answer

Read the tombstone file. Option D is correct because when Cisco Cloudlock quarantines a file, it replaces the original with a tombstone file that the user can still read to see the quarantine notice and understand what happened to the content. Option E is correct because Cloudlock provides a remediation workflow in which the user can request a review of the quarantine decision, allowing an administrator or security team to re-evaluate and potentially restore the file. Options A, B, and C are not valid user actions on a quarantined file: moving, deleting the original, or changing permissions would require access to the original file, which Cloudlock has already removed and replaced with the tombstone, and those actions are not part of the standard quarantine remediation options presented to end users.

Answer

Move the file to another folder

Answer

Delete the original file directly

Answer

Change the file permissions

Question 9

What is the primary benefit of deploying a 'Managed' SaaS application configuration in Cisco Umbrella?

Accepted Answer

Granular policy enforcement and visibility.. Managed applications allow for granular visibility and enforcement policies to be applied specifically to those apps, as opposed to generic web traffic.

Answer

Faster internet speed.

Answer

Reduced cloud storage costs.

Answer

Automatic software updates.

Question 10

You notice an employee is accessing a cloud app that is not approved by IT. Which Umbrella feature allows you to see this activity?

Accepted Answer

App Discovery. App Discovery in Cisco Umbrella provides visibility into all cloud applications being accessed by users on the network, including those not sanctioned by IT. It uses DNS traffic analysis to identify and categorize thousands of SaaS applications, highlighting shadow IT. This feature allows administrators to see which unapproved apps are in use, assess risk, and take action. Thus, App Discovery directly answers the need to see the employee's activity.

Answer

Activity Search

Answer

DNS Policy

Answer

SSL Inspection

Question 11

If you configure an API-based connector for a new SaaS app in Cisco Cloudlock, when does the initial scan typically begin?

Accepted Answer

Immediately upon saving the configuration.. In Cisco Cloudlock, when you configure an API-based connector for a SaaS application and save the configuration, the initial scan of the tenant's data begins immediately. Cloudlock does not wait for a scheduled window or manual trigger; the scan is initiated as soon as the connector is successfully saved and authenticated.

Answer

At midnight, based on the system clock.

Answer

Only when the first user logs in.

Answer

After an administrator manually clicks 'Start'.

Question 12

In Cisco Cloudlock, what is the purpose of an 'Incident'?

Accepted Answer

To notify admins of a policy violation.. An incident is an alert generated when a specific policy rule is triggered by a user or data action within a protected SaaS app.

Answer

To record system uptime.

Answer

To manage app credentials.

Answer

To backup user data.

Question 13

Which THREE actions can be performed by the Cisco Cloudlock UBA engine?

Accepted Answer

Monitor mass file download events. Cisco Cloudlock's User Behavior Analytics (UBA) engine is designed to detect anomalous user activity across cloud environments, so option A (Monitor mass file download events) is correct because UBA baselines normal file access and flags excessive downloads that may indicate data exfiltration. Option C (Flag logins at unusual times) is correct because UBA correlates login timestamps against a user's historical pattern to identify suspicious off-hours access. Option E (Detect impossible travel) is correct because UBA compares geolocation and timing of successive logins to flag physically impossible authentication sequences. Option B (Perform port scanning) is not a UBA function—port scanning is a network reconnaissance technique performed by tools like Nmap, not a cloud behavioral analytics engine. Option D (Block outbound DNS requests) is also incorrect because UBA is a detection and alerting capability, not an inline enforcement or firewall function that blocks DNS traffic.

Answer

Perform port scanning

Answer

Block outbound DNS requests

Question 14

When configuring a Duo authentication policy for a SaaS app, which THREE device health indicators can be required?

Accepted Answer

Security software (AV) active. Duo's policy engine can require that endpoints have disk encryption enabled, up-to-date operating systems, and activated security software.

Answer

Monitor CPU utilization

Answer

Hard drive space capacity

Question 15

You are configuring a Cisco Cloudlock policy to detect sensitive PII in a Salesforce instance. Which configuration step ensures that the policy specifically triggers when sensitive data is uploaded to a public-facing object?

Accepted Answer

Enable the PII inspection engine and set the exposure filter to 'Public'.. Cisco Cloudlock's PII inspection engine is the component that actually scans content for sensitive data patterns (SSNs, credit cards, etc.). The exposure filter is what scopes the policy to only fire when that data sits in a publicly accessible object, so combining the PII engine with the 'Public' exposure filter is what produces a targeted alert. Without the exposure filter, the policy would trigger on any PII regardless of visibility, generating noise.

Answer

Configure an API-based firewall rule to block all inbound traffic from Salesforce.

Answer

Apply a global blocklist for all Salesforce users.

Answer

Set the policy scan interval to 'Real-time' and enable TLS decryption.