SCAZT Application And Data Security — Timed 25 Questions

Question 1

You have configured a DLP policy in Cisco Cloudlock that flags files shared with external users. You notice files shared with 'Anyone with the link' are not being flagged. What is the most likely configuration error?

25 minute time limit — choose an answer to begin.

Accepted Answer

The scope of the policy is set to 'internal' only.. Cloudlock policies require the specific permission level (e.g., 'Public' or 'Anyone with link') to be explicitly selected in the 'Exposure' criteria of the policy engine.

Answer

SSL inspection is not enabled.

Answer

The user is an administrator.

Answer

The API token for the SaaS has expired.

Question 2

You are implementing Cisco Umbrella CASB to restrict file uploads to unsanctioned SaaS applications. You have configured an App Control rule, but users can still upload files to a cloud storage service. What is the most likely cause?

Accepted Answer

The Intelligent Proxy is disabled in the Web Policy.. Cisco Umbrella CASB requires the intelligent proxy to be enabled to perform deep packet inspection (DPI) and enforce file upload restrictions at the application level.

Answer

The SSL inspection certificate is not installed on the server.

Answer

The SaaS application is whitelisted in the Global Settings.

Answer

The DNS policy is not configured for the user group.

Question 3

You are investigating a data leak in Google Drive using Cisco Cloudlock. You notice that a user shared a folder with the 'public'. How can you verify exactly who accessed this folder?

Accepted Answer

Check the Cloudlock Incident Audit logs.. Cloudlock's Audit logs record activities associated with shared files, allowing administrators to track who accessed the resources.

Answer

Perform a packet capture on the gateway.

Answer

Review the Google Drive 'Activity' tab only.

Answer

Review the Cisco Umbrella DNS logs.

Question 4

You need to ensure that only corporate-managed devices can access Microsoft 365. Which component should be configured to verify the device's security posture before granting access?

Accepted Answer

Cisco Duo. Cisco Duo is a Zero Trust access platform that performs device trust and posture checks before granting access to applications like Microsoft 365. Its Device Trust feature verifies that the endpoint is corporate-managed, patched, encrypted, and compliant with security policies before allowing authentication to complete. This directly satisfies the requirement to verify device security posture prior to granting access.

Answer

Cisco Secure Firewall

Answer

Cisco Cloudlock

Answer

Cisco Umbrella

Question 5

Which THREE factors influence the risk rating of an application in Cisco Umbrella's App Discovery tool?

Accepted Answer

Compliance certifications. In Cisco Umbrella's App Discovery (Cloud Access Security Broker / CASB) risk rating, the risk score for a discovered cloud application is derived from factors such as the application's compliance certifications (A), which indicate whether it meets recognized regulatory and industry frameworks like SOC 2, ISO 27001, or HIPAA; its encryption support (C), which reflects whether data is protected in transit and at rest using protocols such as TLS; and its data protection standards (D), which cover how the vendor handles data retention, ownership, and privacy commitments. These three attributes directly feed the app's risk score and category (e.g., sanctioned, tolerated, or unsanctioned) in the Umbrella dashboard. Server location (B) is not a risk-rating input in App Discovery, and the number of employees (E) is a vendor size metric that does not influence the application's risk rating.

Answer

Server location

Answer

Number of employees

Question 6

A security administrator needs to prevent users from downloading corporate files to personal devices using Cisco Cloudlock. Which policy type must be implemented to achieve this session-level control?

Accepted Answer

Real-Time Protection policy.. Cisco Cloudlock uses 'Real-Time Protection' via API or proxy-based integrations to enforce session-level controls like restricting downloads based on device posture.

Answer

User Behavior Analytics (UBA) policy.

Answer

Threat detection policy.

Answer

Data Loss Prevention (DLP) policy.

Question 7

You are configuring a DLP policy in Cisco Cloudlock. Which setting allows the policy to ignore files that have been cryptographically signed by your organization's internal CA?

Accepted Answer

File Metadata Exclusion.. The 'Fingerprinting' or 'Custom File Attribute' feature allows administrators to exclude files based on metadata or signatures, preventing false positives.

Answer

Content Inspection Override.

Answer

DLP Sensitivity Threshold.

Answer

Object Scoping.

Question 8

To ensure compliance, you must ensure that all emails containing credit card numbers sent via O365 are encrypted. How is this achieved within the Cloudlock framework?

Accepted Answer

Configure a DLP policy to trigger an 'Apply Sensitivity Label' action.. Cloudlock policies can trigger automated actions such as applying sensitivity labels or encryption policies in the underlying SaaS application upon detecting sensitive content.

Answer

Reset the user's password.

Answer

Enable TLS 1.3 for all outgoing mail.

Answer

Create a firewall rule to block the email.

Question 9

Which feature in Cisco Cloudlock allows you to identify if a SaaS user is logging in from an anonymizer or TOR exit node?

Accepted Answer

User Behavior Analytics (UBA) anomaly detection.. Cisco Cloudlock's Threat Intelligence engine correlates user login logs with known malicious IP reputation lists.

Answer

SaaS application object mapping.

Answer

File content scanning.

Answer

Encryption key management.

Question 10

A security team wants to block uploads of files containing personally identifiable information (PII) to any unsanctioned cloud storage service while still allowing uploads to approved services. They have deployed Cisco Cloudlock and Cisco Umbrella. Which configuration should they implement to achieve this?

Accepted Answer

Use Cisco Umbrella's App Discovery to tag unsanctioned apps, then create a Cloudlock DLP policy that references the Umbrella app tag to block PII uploads to those apps.. The correct approach integrates Cisco Umbrella's App Discovery to identify unsanctioned apps and Cisco Cloudlock's DLP to enforce content-based blocking. Umbrella tags apps as sanctioned or unsanctioned, and Cloudlock can use those tags in policies. This allows granular control: blocking PII uploads only to unsanctioned services while permitting them to approved ones, meeting the security team's requirement without over-blocking.

Answer

In Cisco Umbrella, create a policy that blocks all uploads to unsanctioned apps, and in Cloudlock, create a DLP policy that blocks PII uploads to sanctioned apps only.

Answer

Configure a Cisco Umbrella cloud firewall rule to block all uploads to unsanctioned apps, and use Cloudlock to scan approved apps for PII.

Answer

Create a Cloudlock DLP policy that inspects all uploads and blocks those matching PII patterns, then set the policy to apply only to unsanctioned apps using the Cloudlock app category filter.

Question 11

A financial institution uses Cisco Cloudlock to protect data in Microsoft 365. They need to ensure that when a user shares a file containing credit card numbers with an external domain, the file is automatically quarantined and the user is notified. Which Cloudlock policy action should be configured?

Accepted Answer

Set the policy action to 'Quarantine' and enable user notification in the policy settings.. The 'Quarantine' action in Cloudlock removes the file from the user's view and revokes sharing permissions, effectively containing the exposure. Enabling user notification ensures the user is informed. This combination automatically quarantines the file and notifies the user, satisfying the requirement. Other actions like Alert or Block do not quarantine an already shared file.

Answer

Set the policy action to 'Block' and configure a custom message for the user.

Answer

Set the policy action to 'Alert' and configure an email notification to the user.

Answer

Set the policy action to 'Tombstone' and enable user notification.

Question 12

A security administrator is configuring Cisco Cloudlock to monitor data in a custom application that does not have a native API connector. The application supports OAuth 2.0 and exposes a REST API for file operations. What is the most appropriate way to integrate this application with Cloudlock?

Accepted Answer

Use the Cloudlock Custom API Connector to define the API endpoints and authentication.. The Custom API Connector in Cisco Cloudlock is designed for integrating applications that lack native support. It allows administrators to specify API endpoints, authentication (such as OAuth 2.0), and data mapping so that Cloudlock can scan and enforce policies. This is the standard method for extending Cloudlock's data protection to custom cloud apps.

Answer

Deploy a Cloudlock proxy and configure it to intercept traffic to the custom application.

Answer

Use the Cloudlock Service Provider Interface (SPI) to develop a custom connector.

Answer

Configure Cisco Umbrella's App Discovery to recognize the custom application and then enable Cloudlock scanning.

Question 13

A security engineer is deploying Cisco Cloudlock to protect data in Google Workspace. They need to ensure that files shared with external users are continuously monitored and that any file containing sensitive data is automatically restricted if it becomes publicly accessible. Which two Cloudlock features should be configured to meet these requirements? (Choose two.)

Accepted Answer

Cloudlock's DLP policy with the 'Quarantine' action for files that become public.. Scheduled scans provide continuous monitoring by periodically crawling all files and detecting sensitive data and permission changes. A DLP policy with the Quarantine action automatically restricts files that meet conditions, such as being publicly accessible with sensitive data. Together, they ensure that files are monitored continuously and automatically restricted if they become public, meeting the requirements.

Answer

Cisco Umbrella's App Discovery to identify unsanctioned sharing of files.

Answer

Cloudlock's Incident Management dashboard to manually review and remediate exposures.

Answer

Real-time DLP policies that scan files upon upload and sharing.

Question 14

Which component of Cisco's secure cloud access architecture is responsible for performing URL filtering and malware scanning on traffic destined for SaaS applications?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the secure internet gateway component that performs DNS-layer security, URL filtering, and malware/file inspection on traffic destined for SaaS and internet applications. It is the cloud-delivered secure web gateway in Cisco's secure cloud access architecture.

Answer

Cisco Secure Endpoint

Answer

Cisco Cloudlock

Answer

Cisco Adaptive Security Appliance

Question 15

When configuring Cisco Duo for SaaS application access, which THREE conditions can be used in a 'Policy' to restrict access to a sensitive application?

Accepted Answer

Operating System version. Option B (Operating System version) is correct because Duo policies can include a device/OS-based condition that evaluates the operating system and version of the accessing endpoint, allowing administrators to block or require step-up authentication for outdated or unmanaged OS versions. Option C (MFA strength) is correct because Duo policies can enforce authentication strength by requiring specific factors or methods (e.g., Duo Push, WebAuthn, verified push, or phishing-resistant MFA), so access to a sensitive SaaS app can be restricted to stronger authentication. Option D (Geographic location) is correct because Duo policies support location-based conditions using geolocation/IP data, enabling administrators to allow, deny, or require additional verification based on the user's country or region. Options A (File size limit) and E (Application bandwidth usage) are not Duo policy conditions; Duo evaluates identity, device, authentication, and network/context signals, not file transfer size or SaaS bandwidth consumption.

Answer

File size limit

Answer

Application bandwidth usage

Question 16

In Cisco Umbrella, what is the primary purpose of defining a 'Cloud Application' in the 'App Discovery' dashboard?

Accepted Answer

To identify and govern Shadow IT usage across the enterprise.. In Cisco Umbrella's App Discovery dashboard, defining a Cloud Application lets you classify and monitor SaaS usage so you can identify unsanctioned (Shadow IT) apps and apply governance policies. It provides visibility into which cloud apps are being used, by whom, and with what risk, enabling allow/block decisions. It is fundamentally a discovery and governance function, not an authentication, bandwidth, or inspection-bypass feature.

Answer

To pre-authenticate users for that SaaS.

Answer

To increase bandwidth for authorized SaaS apps.

Answer

To bypass SSL inspection for the application.

Question 17

You are auditing a Cisco Cloudlock deployment for O365. Which TWO methods can be used to remediate a file that violates a Data Loss Prevention policy?

Accepted Answer

Delete the file. In a Cisco Cloudlock DLP deployment for O365, remediation actions operate directly on the offending file's permissions or existence, so option A (Delete the file) is correct because Cloudlock can remove the violating file from the O365 workload (e.g., OneDrive/SharePoint) to eliminate the exposure. Option D (Change sharing level to Private) is also correct because Cloudlock can revoke external/anonymous access by resetting the file's sharing so only the owner retains access, which directly mitigates the DLP violation. Option B (Block the user account in Active Directory) is not a Cloudlock file-level remediation action and would be handled by identity/AD tooling, not the DLP policy engine. Option C (Change the file owner) is not a standard Cloudlock remediation method and does not by itself stop the data exposure. Option E (Re-encrypt the file with a new key) is not a Cloudlock remediation capability for O365 files and does not address the sharing/permission violation.

Answer

Block the user account in Active Directory

Answer

Change the file owner

Answer

Re-encrypt the file with a new key

Question 18

Which Cisco technology provides visibility and control over SaaS applications using API-based integration to inspect data at rest?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is an API-based CASB that monitors data at rest in SaaS applications by connecting directly to the cloud provider's APIs.

Answer

Cisco Secure Firewall

Answer

Cisco Stealthwatch

Answer

Cisco Umbrella

Question 19

You are configuring a Cisco Cloudlock policy to detect sensitive data in a Salesforce environment. You need to identify instances where credit card numbers are shared publicly. Which specific policy category should you configure?

Accepted Answer

Data Exposure. The Cisco Cloudlock Data Loss Prevention engine uses specific policy categories to identify PII/PCI data, and 'Data Exposure' is the correct category for monitoring sharing settings.

Answer

User Behavior Analytics

Answer

Application Firewall

Answer

Threat Intelligence

Question 20

When integrating Cisco Umbrella with a SaaS application, which TWO methods can be used to ensure secure user authentication?

Accepted Answer

Duo MFA integration. Duo MFA integration (C) is correct because Cisco Umbrella supports Duo as a multi-factor authentication provider, adding a second verification factor to user logins and thereby strengthening secure authentication for SaaS access. SAML integration with an IdP (E) is correct because Umbrella can federate authentication to an identity provider such as Okta, Microsoft Entra ID, or OneLogin via SAML 2.0, enabling single sign-on and centralized, policy-based user authentication. SNMP monitoring (A) is only for collecting device and performance telemetry, not for authenticating users. A local LDAP database (B) is a directory store, not an authentication integration method Umbrella uses for SaaS SSO, and WPA2-Enterprise (D) is a wireless LAN 802.1X security standard unrelated to SaaS user authentication.

Answer

SNMP monitoring

Answer

Local LDAP database

Answer

WPA2-Enterprise