SCAZT Application And Data Security Practice Test 3 — 15 Questions

Question 1

Which THREE factors influence the risk rating of an application in Cisco Umbrella's App Discovery tool?

Accepted Answer

Compliance certifications. Risk ratings are calculated based on an application's data privacy policies, compliance certifications, and security features.

Answer

Server location

Answer

Number of employees

Question 2

Which TWO actions can a user take if a file is quarantined by Cisco Cloudlock?

Accepted Answer

Read the tombstone file. Quarantine moves the original file to a secure location and replaces it with a placeholder (tombstone) file; the user can typically only access the tombstone.

Answer

Move the file to another folder

Answer

Delete the original file directly

Answer

Change the file permissions

Question 3

What is the primary benefit of deploying a 'Managed' SaaS application configuration in Cisco Umbrella?

Accepted Answer

Granular policy enforcement and visibility.. Managed applications allow for granular visibility and enforcement policies to be applied specifically to those apps, as opposed to generic web traffic.

Answer

Faster internet speed.

Answer

Reduced cloud storage costs.

Answer

Automatic software updates.

Question 4

You notice an employee is accessing a cloud app that is not approved by IT. Which Umbrella feature allows you to see this activity?

Accepted Answer

App Discovery. Shadow IT reporting within the App Discovery feature shows a list of applications accessed by users that have not been sanctioned by the IT department.

Answer

Activity Search

Answer

DNS Policy

Answer

SSL Inspection

Question 5

If you configure an API-based connector for a new SaaS app in Cisco Cloudlock, when does the initial scan typically begin?

Accepted Answer

Immediately upon saving the configuration.. After the OAuth handshake and the 'Save' of the connector configuration, Cloudlock triggers an initial scan of the application's environment (e.g., all files in Google Drive).

Answer

At midnight, based on the system clock.

Answer

Only when the first user logs in.

Answer

After an administrator manually clicks 'Start'.

Question 6

In Cisco Cloudlock, what is the purpose of an 'Incident'?

Accepted Answer

To notify admins of a policy violation.. An incident is an alert generated when a specific policy rule is triggered by a user or data action within a protected SaaS app.

Answer

To record system uptime.

Answer

To manage app credentials.

Answer

To backup user data.

Question 7

Which THREE actions can be performed by the Cisco Cloudlock UBA engine?

Accepted Answer

Monitor mass file download events. UBA tracks user activity and can flag anomalies like impossible travel, mass file downloads, and unusual access times.

Answer

Perform port scanning

Answer

Block outbound DNS requests

Question 8

When configuring a Duo authentication policy for a SaaS app, which THREE device health indicators can be required?

Accepted Answer

Security software (AV) active. Duo's policy engine can require that endpoints have disk encryption enabled, up-to-date operating systems, and activated security software.

Answer

Monitor CPU utilization

Answer

Hard drive space capacity

Question 9

You are configuring a Cisco Cloudlock policy to detect sensitive PII in a Salesforce instance. Which configuration step ensures that the policy specifically triggers when sensitive data is uploaded to a public-facing object?

Accepted Answer

Enable the PII inspection engine and set the exposure filter to 'Public'.. Cisco Cloudlock allows scoping of policies to specific application objects and exposure levels. Selecting the 'Public' exposure flag ensures that only data accessible to unauthorized external users triggers the alert.

Answer

Configure an API-based firewall rule to block all inbound traffic from Salesforce.

Answer

Apply a global blocklist for all Salesforce users.

Answer

Set the policy scan interval to 'Real-time' and enable TLS decryption.

Question 10

When integrating Cisco Cloudlock with O365, which authentication mechanism is required to allow the CASB to perform administrative actions, such as removing a malicious file share?

Accepted Answer

OAuth 2.0 delegated permissions.. Cisco Cloudlock requires OAuth 2.0 scopes granted via an administrative consent process to perform actions on behalf of the application in the O365 tenant.

Answer

LDAP over TLS.

Answer

SAML 2.0 with manual certificate import.

Answer

Basic Authentication over SSL.

Question 11

An administrator notices that sensitive data is being shared via Microsoft Teams. Where in the Cloudlock dashboard should they navigate to identify which specific users are sharing the files?

Accepted Answer

Platform > Incidents dashboard.. The 'Security Audit' or 'Incidents' dashboard provides a breakdown of users involved in data exposure incidents in SaaS applications like Teams.

Answer

Platform > Users > Provisioning.

Answer

Platform > Settings > API Configuration.

Answer

Platform > Threat Intelligence.

Question 12

In a Cisco Secure Access environment, you are applying an application-layer policy to restrict access to a specific SaaS application based on the user's geolocation. Which tool is used to define this access control rule?

Accepted Answer

Secure Access Policy rules.. Cisco Secure Access uses Access Policies that integrate with Identity and Context-Aware settings to enforce location-based access to SaaS applications.

Answer

Cloudlock API Gateway.

Answer

Web Security Appliance (WSA) Filter.

Answer

Identity Services Engine (ISE) Policy Sets.

Question 13

You have detected a compromised account in Google Workspace via Cloudlock. Which automated response action can immediately prevent further data exfiltration from this user account?

Accepted Answer

Suspend User account.. The 'Disable User' or 'Suspend User' action is the standard response to isolate a compromised identity and prevent further access.

Answer

Change user's DNS settings.

Answer

Delete the user's primary mailbox.

Answer

Clear browser cache for the user.

Question 14

An administrator needs to ensure that only managed devices can access sensitive data in Box. Which Cisco solution feature enables this verification?

Accepted Answer

Secure Access device posture check.. Cisco Secure Access with device posture checks ensures that only devices meeting minimum security requirements can access defined SaaS applications.

Answer

SAML assertion mapping.

Answer

Cloudlock custom regex matching.

Answer

OAuth token rotation.

Question 15

To ensure compliance, you must ensure that all emails containing credit card numbers sent via O365 are encrypted. How is this achieved within the Cloudlock framework?

Accepted Answer

Configure a DLP policy to trigger an 'Apply Sensitivity Label' action.. Cloudlock policies can trigger automated actions such as applying sensitivity labels or encryption policies in the underlying SaaS application upon detecting sensitive content.

Answer

Reset the user's password.

Answer

Enable TLS 1.3 for all outgoing mail.

Answer

Create a firewall rule to block the email.