SCAZT Cloud Security Architecture — 15 Questions

Question 1

An organization is deploying Cisco Umbrella SIG to enforce Zero Trust access. You must configure the selective decryption policy. Which setting ensures that specific sensitive traffic, such as financial and healthcare sites, is bypassed for inspection to comply with privacy regulations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Web Policy rule with a 'Decrypt' action and specify the sensitive categories in the 'Bypass' list.. In Cisco Umbrella SIG selective decryption, the Web Policy rule controls which traffic is decrypted for inspection. To comply with privacy regulations for financial and healthcare sites, you configure a Web Policy rule with a 'Decrypt' action and add those sensitive categories to the 'Bypass' list, so their TLS traffic is not decrypted while other traffic is inspected.

Answer

Apply a 'Transparent Proxy' setting on the local Cisco ASA firewall.

Answer

Enable 'HTTPS Inspection' in the Cloud Security global settings and select 'Bypass All' for all categories.

Answer

Set the 'Block' action for sensitive categories in the Destination Lists.

Question 2

A network architect is deploying Cisco Umbrella SIG to enforce Zero Trust access. Which mechanism provides the initial posture assessment before allowing a user to access a SaaS application via the Secure Web Gateway?

Accepted Answer

AnyConnect/Secure Client Posture Module. The Cisco Umbrella Roaming Client or AnyConnect module performs device posture checks before establishing the tunnel.

Answer

Umbrella Virtual Appliance

Answer

Cloud-delivered Firewall

Answer

Umbrella DNS Policies

Answer

Umbrella SIG API

Question 3

Which TWO components are essential for implementing a Zero Trust Network Access (ZTNA) model using Cisco Duo and Secure Access?

Accepted Answer

Duo Authentication Proxy. Duo Authentication Proxy (A) is essential because it acts as the on-premises broker that forwards authentication requests from Duo's cloud service to the local identity sources (such as Active Directory or RADIUS/LDAP), enabling identity verification for ZTNA. Cisco Secure Access Connector (C) is essential because it establishes the outbound-only tunnel from the private network to Cisco's Secure Access cloud, publishing internal applications so that ZTNA policies can be enforced per user and per app without exposing the network. The other options are not required components of this Duo plus Secure Access ZTNA design: Cisco Secure Firewall Management Center (B) is a firewall management platform, Cisco ISE (D) is a NAC/policy server for network access control, and Umbrella Virtual Appliance (E) is used for DNS-layer security and local DNS forwarding, none of which are the essential ZTNA components in this scenario.

Answer

Cisco Secure Firewall Management Center

Answer

Cisco ISE

Answer

Umbrella Virtual Appliance

Question 4

You are integrating Cisco Duo with an on-premises application that does not support SAML. How should you design the access flow to achieve Zero Trust authentication using the Duo Access Gateway (DAG)?

Accepted Answer

Deploy the Duo Authentication Proxy to bridge the application's RADIUS/LDAP traffic to Duo's cloud service.. For legacy applications that lack native SAML support, the Duo Access Gateway (DAG) acts as a SAML service provider for the application and a SAML identity provider for the identity source.

Answer

Install the Duo Mobile app directly on the application server.

Answer

Configure the application to trust the Duo cloud directly via OAuth2.

Answer

Use the Duo Network Gateway to perform URL rewriting on the legacy headers.

Question 5

In a SASE deployment using Cisco SD-WAN and Umbrella, how is traffic steered to the cloud security stack when a branch router loses its direct tunnel connection to the Umbrella SIG headend?

Accepted Answer

Automated tunnel failover to secondary Umbrella SIG DC. In a Cisco SD-WAN and Umbrella SASE deployment, when a branch router loses its direct tunnel to the primary Umbrella SIG headend, the SD-WAN fabric automatically fails over to a secondary Umbrella SIG data center. This automated tunnel failover maintains security inspection and connectivity without manual intervention.

Answer

Local traffic is routed via MPLS only

Answer

Traffic is sent to the Umbrella VA

Answer

Traffic reverts to transparent proxy mode

Answer

Traffic is dropped by default

Question 6

Which TWO of the following are primary components of the Cisco SASE security stack?

Accepted Answer

Cisco Umbrella SIG. Cisco Umbrella SIG (Secure Internet Gateway) is a core component of Cisco's SASE stack because it delivers cloud-delivered secure web gateway (SWG), DNS-layer security, firewall, and CASB capabilities from the Umbrella cloud edge, which is exactly the security half of SASE. Cisco Duo is also a primary SASE component, providing zero-trust identity verification with MFA and device-based access policy enforcement that ties user identity to network and application access. Together, Umbrella SIG and Duo represent the convergence of networking and security-as-a-service that defines Cisco's SASE architecture. Cisco Webex is a collaboration/meeting application, not a SASE security service, so it does not belong. Cisco Identity Services Engine (ISE) is an on-premises NAC/identity policy platform rather than a cloud-delivered SASE security component, and Cisco Meraki Go is a small-business networking line, not part of the SASE security stack.

Answer

Cisco Webex

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Meraki Go

Question 7

You are designing a Zero Trust architecture. How do you handle 'legacy applications' that do not support modern identity protocols?

Accepted Answer

Deploy a gateway or proxy that provides an identity-aware front-end.. An identity-aware proxy or the Duo Authentication Proxy can act as a gateway, translating modern authentication to the application's native protocol.

Answer

multi_select

Answer

Move the application to the cloud immediately.

Answer

Disable authentication for these apps.

Answer

Rewrite the application code to support SAML.

Question 8

Which THREE features are provided by the Cisco Umbrella 'Intelligent Proxy'?

Accepted Answer

File inspection for malware. The Cisco Umbrella Intelligent Proxy is a selective proxy that inspects traffic for risky requests, and option C is correct because it performs file inspection to detect malware in downloaded files before they reach the endpoint. Option D is correct because the Intelligent Proxy enforces URL filtering based on Umbrella's reputation intelligence, blocking or allowing destinations according to their risk score. Option E is correct because the Intelligent Proxy can perform SSL/TLS inspection to decrypt and examine HTTPS traffic for threats and policy violations. Options A and B are not features of the Intelligent Proxy: it is a cloud-delivered secure web gateway capability, not a local DHCP server (A) and not a hardware firewall replacement (B).

Answer

Local DHCP server management

Answer

Hardware firewall replacement

Question 9

Which TWO of the following are benefits of moving from a legacy VPN to a ZTNA-based architecture?

Accepted Answer

Granular, per-application access control. ZTNA improves security through granular access and improves user experience by eliminating hair-pinning.

Answer

Increased network overhead

Answer

Full access to the entire subnet

Answer

Automatic physical hardware upgrades

Answer

Improved user experience by reducing latency

Question 10

Which TWO features of Cisco Umbrella assist in preventing data loss?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) (C) is correct because Cisco Umbrella's DLP capability inspects traffic and blocks sensitive data such as PII, credit card numbers, and other regulated content from leaving the organization, directly preventing data exfiltration. File inspection (sandboxing) (E) is correct because Umbrella's file inspection forwards suspicious files to the Cisco Secure Malware Analytics (Threat Grid) sandbox, where malicious payloads that could steal or encrypt data are detected and blocked before they can cause loss. DNS query logs (A) are only a visibility/auditing record of requested domains and do not themselves block or prevent data loss. Local firewall rules (B) are enforced on-premises by a separate device and are not a Cisco Umbrella feature. Automated DNS updates (D) is not a data-loss prevention feature; it merely describes dynamic DNS resolution behavior and does not inspect or block outbound sensitive content.

Answer

DNS query logs

Answer

Local firewall rules

Answer

Automated DNS updates

Question 11

A security architect is designing a Zero Trust access model for a multinational enterprise where contractors use unmanaged laptops to reach internal finance applications hosted in a private data center. The company wants to verify device posture without installing a persistent agent on contractor machines and wants the policy decision to be centralized. Which combination of Cisco technologies BEST meets these requirements?

Accepted Answer

Cisco Secure Access with ZTNA, integrated with Cisco Duo for device trust and identity verification, using the Duo Desktop application for posture signals.. The requirement is to verify device posture on unmanaged laptops without a persistent agent while keeping policy decisions centralized. Cisco Duo delivers device trust through a lightweight application and integrates with Cisco Secure Access, which acts as the centralized ZTNA policy enforcement point. Agent-based posture through Cisco Secure Client or Umbrella roaming clients fails the unmanaged constraint, and SD-WAN is a WAN transport rather than a Zero Trust access control plane.

Answer

Cisco Catalyst SD-WAN with application-aware routing and embedded security, plus IPsec tunnels from each contractor to the nearest branch.

Answer

Cisco Identity Services Engine (ISE) with posture assessment through the Cisco Secure Client agent, integrated with Cisco Secure Access for ZTNA enforcement.

Answer

Cisco Umbrella SIG with DNS-layer security and a roaming client installed on each contractor laptop, plus firewall rules at the data center edge.

Question 12

A healthcare organization is designing a secure cloud access architecture using Cisco Secure Access. They need to ensure that only compliant devices can access patient records stored in a private cloud. The organization uses Cisco Secure Client with Cisco Secure Access and wants to enforce device posture checks, such as verifying the presence of antivirus software and OS patch level. Which component should be integrated to provide these posture signals to Cisco Secure Access?

Accepted Answer

Cisco Identity Services Engine (ISE) integrated with Cisco Secure Client posture module. Integrating Cisco ISE with the Cisco Secure Client posture module allows the organization to collect and evaluate device compliance data. Cisco Secure Access can then consume these posture signals to enforce conditional access, ensuring only compliant devices reach patient records. This integration is a key design pattern for zero trust in healthcare, where device health is critical.

Answer

Cisco Secure Access DNS-layer security policies

Answer

Cisco Secure Firewall Threat Defense with Remote Access VPN

Answer

Cisco Umbrella Roaming Security module on endpoints

Question 13

A user is attempting to access a SaaS application, but the session is blocked by Cisco Cloudlock due to a detected policy violation. Which component is responsible for analyzing the API calls and triggering the remediation?

Accepted Answer

Cloudlock CASB API engine. Cisco Cloudlock utilizes API-based integration to monitor SaaS environments and enforce security policies, such as DLP or anomaly detection.

Answer

Duo Authentication Proxy

Answer

AnyConnect SASE client

Answer

Umbrella SIG proxy

Question 14

Which THREE factors should be considered when designing an IaaS security architecture using Cisco Secure Workload (formerly Tetration)?

Accepted Answer

Identity-based policy enforcement. Cisco Secure Workload (formerly Tetration) is built around identity-based policy enforcement, so option C is correct because it uses workload attributes such as labels, tags, and process identity to define granular allow/deny rules rather than relying only on IP addresses. Option D is correct because application dependency mapping is a core capability that discovers workload-to-workload communication flows and builds the behavioral baseline needed to create accurate policies. Option E is correct because host-based sensor deployment is required to collect the telemetry (flows, processes, packages) from each workload that feeds the platform's analytics and policy engine. Option A is not correct because physical switch port mirroring is a network-centric monitoring approach and is not the primary mechanism used by Secure Workload in IaaS environments. Option B is not correct because global firewall rule consolidation is a broad network-security practice, not a specific design factor for Cisco Secure Workload's identity- and workload-centric architecture.

Answer

Physical switch port mirroring

Answer

Global firewall rule consolidation

Question 15

When designing a Secure Access Service Edge (SASE) architecture, which principle best describes the shift from traditional hub-and-spoke networking?

Accepted Answer

Direct-to-cloud connectivity. SASE emphasizes connecting users directly to cloud resources rather than backhauling traffic to a central DC.

Answer

On-premise appliance chaining

Answer

Strict MPLS segmentation

Answer

Identity-agnostic security

Answer

Centralized backhauling