SCAZT Cloud Security Architecture Practice Test 2 — 15 Questions

Question 1

You are configuring a SASE design to secure traffic from a branch office to the cloud. What is the recommended method for routing internet-bound traffic from the branch to the Cisco Umbrella SIG?

Accepted Answer

Establish an IPsec tunnel from the branch edge device to the nearest Umbrella data center.. IPsec tunnels from the branch edge device (such as a Cisco ISR or Meraki MX) to the Cisco Umbrella SIG provide a secure, encrypted transit for all traffic.

Answer

Configure DNS forwarding only.

Answer

Use an AnyConnect agent on every endpoint in the branch.

Answer

Deploy a local proxy server that intercepts all traffic.

Question 2

When designing a Zero Trust architecture using Cisco Secure Access, how does the 'Device Posture' check specifically influence the access decision for a managed laptop?

Accepted Answer

It requires the presence of an MDM-enrolled certificate or specific registry key before authorizing the session.. Device posture checks in Cisco Secure Access verify the health and security configuration of the endpoint before granting access to protected applications.

Answer

It switches the user's connection to a VPN tunnel.

Answer

It forces a mandatory password reset if the device is out of compliance.

Answer

It checks the user's IP address against a geo-blocking database.

Question 3

Which component of the Cisco SASE architecture provides the primary security enforcement point for remote users browsing the web from untrusted networks?

Accepted Answer

Cisco Umbrella SIG. The Cisco Umbrella Secure Internet Gateway (SIG) provides the cloud-native security stack for remote users.

Answer

Cisco Firepower Threat Defense (FTD)

Answer

Cisco Meraki MX

Answer

Cisco Identity Services Engine (ISE)

Question 4

In a SASE deployment, why is the integration between Cisco ISE and Cisco Secure Access considered a critical design pattern?

Accepted Answer

It enables context-aware policy enforcement based on user identity and device state across the hybrid environment.. Integrating ISE with Secure Access allows consistent policy application across both on-premises network resources and cloud-based applications.

Answer

It enables direct firewall inspection of internal traffic.

Answer

It allows ISE to act as a cloud proxy server.

Answer

It automates the deployment of AnyConnect agents.

Question 5

You are designing a secure remote access solution for a hybrid cloud environment. Which Cisco technology should you implement to replace a traditional VPN while enforcing Zero Trust principles?

Accepted Answer

Cisco Secure Access (ZTNA). Cisco Secure Access (the ZTNA offering) provides per-application access based on identity and posture, replacing the broad network access of a VPN.

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Meraki Client VPN

Answer

Cisco Firepower VPN

Question 6

When evaluating cloud security reference architectures, what is the primary purpose of a 'Cloud Access Security Broker' (CASB)?

Accepted Answer

To enforce security policies and provide visibility into SaaS and cloud applications.. A CASB sits between cloud service consumers and providers to enforce security policies, ensuring visibility, compliance, and threat protection.

Answer

To act as a secondary DNS server for the enterprise.

Answer

To manage physical access to cloud data centers.

Answer

To perform load balancing for cloud traffic.

Question 7

A security architect is designing a SASE solution. What is the significance of 'Identity-Based Segmentation' in this design?

Accepted Answer

It allows for access control based on user identity rather than network topology.. Identity-Based Segmentation in SASE decouples access control from physical network location, using user identity (often via IdP integration) to define which resources a user can reach. This is a core Zero Trust principle: never trust, always verify, and enforce least privilege regardless of whether the user is on-prem or remote. It allows consistent policy enforcement across cloud and on-prem environments, which is essential for SASE's converged network and security architecture.

Answer

It allows for faster internet speeds by bypassing the firewall.

Answer

It enables automatic IP address assignment for cloud users.

Answer

It reduces the complexity of managing VLANs.

Question 8

You are troubleshooting a connection issue where a remote user cannot access a private cloud application via the Cisco Secure Access ZTNA connector. Which step is most likely to resolve the issue?

Accepted Answer

Check the health status of the ZTNA connector in the Secure Access dashboard.. Verifying the connectivity of the ZTNA connector to the private resource is the first diagnostic step to ensure the tunnel is active.

Answer

Increase the timeout value on the client browser.

Answer

Flush the DNS cache on the corporate firewall.

Answer

Reboot the user's laptop.

Question 9

When implementing a Zero Trust architecture, what is the 'Principle of Least Privilege' (PoLP) specifically intended to achieve?

Accepted Answer

Granting only the necessary permissions required for a user to perform their task.. PoLP ensures that users and devices are granted the minimum level of access required to perform their jobs, minimizing the blast radius of a potential breach.

Answer

Allowing open access to all company resources from the office.

Answer

Giving administrative access to all power users.

Answer

Automating the password rotation process.

Question 10

Which capability of the Cisco Umbrella SIG ensures that sensitive data, such as PII or credit card numbers, does not leave the organization via web traffic?

Accepted Answer

Cloud-based Data Loss Prevention (DLP). Cisco Umbrella's Data Loss Prevention (DLP) capability inspects outgoing traffic for sensitive information based on pre-defined or custom data patterns.

Answer

Firewall-as-a-Service (FWaaS)

Answer

DNS-layer security

Answer

Intelligent Proxy

Question 11

A global company needs to ensure that users in different regions have the lowest latency when accessing cloud applications. How should the SASE architecture be configured?

Accepted Answer

Ensure users are routed through the global anycast network to the nearest Umbrella data center.. Cisco Umbrella uses a globally distributed anycast network, which automatically routes users to the nearest data center, minimizing latency.

Answer

Manually configure the proxy settings for each user based on their country.

Answer

Install an on-premises proxy server in every region.

Answer

Direct all traffic to a single corporate data center before cloud access.

Question 12

You are designing a secure hybrid cloud environment and need to ensure that traffic between the public cloud and private data center is inspected. Which architecture pattern is most effective?

Accepted Answer

Centralized inspection via a Transit Gateway with an integrated cloud firewall.. Centralized inspection via a Transit Gateway with an integrated cloud firewall ensures that all traffic between the public cloud and private data center is routed through a single inspection point. The Transit Gateway acts as a hub, and the cloud firewall enforces security policies on inter-VPC and hybrid traffic, providing consistent east-west and north-south inspection.

Answer

Use a public load balancer without any security policies.

Answer

Rely on the cloud provider's default security groups only.

Answer

Allow all traffic to bypass the firewall for maximum speed.

Question 13

Which Cisco technology should be used to provide visibility and threat detection for traffic traversing between cloud workloads in a VPC?

Accepted Answer

Cisco Secure Workload (Tetration). Cisco Tetration (Secure Workload) provides micro-segmentation and deep observability of traffic between workloads to detect anomalies and threats.

Answer

Cisco Umbrella

Answer

Cisco AnyConnect

Answer

Cisco Duo

Question 14

In the context of SASE, what is the primary role of the 'Global Anycast Network'?

Accepted Answer

To provide high availability and optimal latency by routing traffic to the nearest security node.. Anycast allows the enterprise to use a single IP address to reach the nearest Umbrella data center, improving performance and reliability.

Answer

To hide the internal IP addresses of the users.

Answer

To manage user credentials across multiple cloud providers.

Answer

To encrypt traffic between the user and the cloud.

Question 15

When implementing a ZTNA solution, which factor is most crucial when defining an 'Application Access Policy'?

Accepted Answer

The identity of the user and the specific application they require.. In ZTNA, policies must be defined based on the user identity and the specific application, rather than network segments.

Answer

The physical location of the cloud data center.

Answer

The source IP address of the user's laptop.

Answer

The user's department in Active Directory.