SCAZT Cloud Security Architecture Practice Test 3 — 15 Questions

Question 1

Which of the following is a key component of a successful 'Identity and Access Management' (IAM) strategy in the cloud?

Accepted Answer

Centralized identity provider integration with MFA.. A centralized IAM strategy, such as using an IdP (e.g., Microsoft Entra ID or Okta) integrated with Cisco Duo, ensures consistent authentication.

Answer

Creating a separate user account for each cloud application.

Answer

Allowing password sharing for shared service accounts.

Answer

Disabling MFA for administrative accounts for speed.

Question 2

When designing a cloud security architecture, why is 'logging and observability' so critical?

Accepted Answer

To ensure compliance and enable efficient threat hunting.. Centralized logging provides the necessary data for threat hunting, compliance auditing, and troubleshooting in a distributed cloud environment.

Answer

To automatically block all incoming traffic.

Answer

To reduce the cost of cloud storage.

Answer

To increase the speed of the internet connection.

Question 3

A firm is adopting SASE and needs to secure mobile devices. Which component of the Cisco SASE suite is best suited to protect mobile endpoints?

Accepted Answer

Cisco Secure Client (formerly AnyConnect) with Umbrella roaming module.. The Cisco Umbrella roaming client (integrated with the AnyConnect/Cisco Secure Client) provides consistent protection for mobile devices off-network.

Answer

Cisco Meraki Systems Manager.

Answer

Cisco Cloudlock.

Answer

Cisco Stealthwatch.

Question 4

You are designing a secure access path for a BYOD device. What is the most effective approach to ensure the device does not compromise the network?

Accepted Answer

Enforce ZTNA with device posture checks and MFA.. ZTNA ensures that the device is checked for posture and the user is authenticated before allowing access, regardless of device ownership.

Answer

Provide the device with a permanent VPN connection.

Answer

Require the device to join the corporate Active Directory domain.

Answer

Configure an open SSID for BYOD devices.

Question 5

Which Cisco product facilitates 'Cloud-to-Cloud' security by monitoring activities in SaaS platforms like Microsoft 365?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock (part of the Secure Access suite) is a CASB that integrates via API to monitor and protect SaaS applications.

Answer

Cisco Firepower

Answer

Cisco Duo

Answer

Cisco Umbrella

Question 6

What is the primary benefit of using 'SAML' (Security Assertion Markup Language) for cloud application authentication?

Accepted Answer

It enables SSO, reducing the risk associated with password sprawl.. SAML enables Single Sign-On (SSO), allowing users to authenticate once and access multiple cloud applications securely.

Answer

It prevents unauthorized access to the local network.

Answer

It automatically updates the user's password every 30 days.

Answer

It encrypts all data sent to the cloud provider.

Question 7

When deploying a secure remote access solution, how do you handle 'Split Tunneling' safely in a Zero Trust environment?

Accepted Answer

Use a ZTNA agent to tunnel only application-specific traffic while keeping web traffic direct.. By using a ZTNA agent, you can define specific application tunnels, effectively creating a 'split' where only authorized traffic goes through the secure path while general web traffic goes direct.

Answer

Disable split tunneling to ensure all traffic is inspected.

Answer

Force all traffic through the corporate VPN, regardless of destination.

Answer

Allow all traffic to the internet without any inspection.

Question 8

Which feature of the Cisco Umbrella SIG is specifically designed to prevent 'Command and Control' (C2) callbacks from infected endpoints?

Accepted Answer

DNS-layer security. The Umbrella DNS layer security identifies and blocks requests to malicious domains associated with C2 infrastructure.

Answer

Firewall-as-a-Service

Answer

SSL Decryption

Answer

Data Loss Prevention

Question 9

You are setting up a secure hybrid cloud environment. How do you implement 'Micro-segmentation' between virtual machines in the same subnet?

Accepted Answer

Use host-based security policies or a distributed SDN firewall.. Micro-segmentation is achieved using host-based firewalls or SDN controllers (like those provided by Cisco Secure Workload/Tetration) to enforce policy at the individual workload level.

Answer

Rely on the cloud provider's default network ACLs.

Answer

Place each VM in a different subnet.

Answer

Configure a VLAN for every virtual machine.

Question 10

Why is 'SSL/TLS Inspection' necessary in a SASE architecture?

Accepted Answer

To allow the security stack to inspect encrypted payloads for threats and sensitive data.. Without decryption, security tools cannot see the content of encrypted traffic, allowing threats or data leaks to pass undetected.

Answer

To allow the ISP to monitor user traffic.

Answer

To accelerate the connection for the end user.

Answer

To replace the need for end-to-end encryption.

Question 11

A user is using a managed laptop. How does 'Device Posture' in the Cisco SASE model verify that an antivirus solution is active?

Accepted Answer

By querying the OS security APIs via the Secure Client agent.. The Cisco Secure Client (AnyConnect) periodically checks the system's security posture and reports status to the policy engine before allowing connectivity.

Answer

By requesting the antivirus vendor to send a status email.

Answer

By checking the user's browser history.

Answer

By scanning the user's files remotely.

Question 12

What is the primary goal of the 'Cisco SASE' framework?

Accepted Answer

To converge networking and security services into a single cloud-delivered offering.. Cisco SASE combines networking and security capabilities into a single cloud-native service to provide secure, optimized access to users wherever they are.

Answer

To increase the cost of cloud services.

Answer

To replace all physical firewalls in the data center.

Answer

To provide a new type of internet provider service.

Question 13

Which THREE factors are typically considered when evaluating 'Device Posture' in a Zero Trust environment?

Accepted Answer

Disk encryption status. Device Posture in a Zero Trust environment assesses the security hygiene and configuration state of an endpoint before granting access, so option B (Disk encryption status) is correct because full-disk encryption such as BitLocker or FileVault protects data at rest and is a standard compliance signal. Option C (Antivirus status) is correct because the presence, currency, and real-time protection state of endpoint anti-malware (e.g., Defender, CrowdStrike) indicates whether the device can detect and resist threats. Option E (Operating system patch level) is correct because missing OS security updates expose known vulnerabilities, so posture checks verify patch compliance via tools like Intune, Jamf, or conditional access policies. Option A (The user's home internet speed) is not a security posture attribute but a network performance metric, and option D (The user's favorite website) is irrelevant personal preference data with no bearing on device trust.

Answer

The user's home internet speed

Answer

The user's favorite website

Question 14

Which TWO methods can be used to tunnel traffic from a branch office to the Cisco Umbrella SIG?

Accepted Answer

GRE tunnel. Options D and E are correct because Cisco Umbrella SIG (Secure Internet Gateway) supports tunneling branch-office traffic to its cloud security edge using GRE tunnels and IPsec tunnels, which encapsulate the branch traffic and forward it to Umbrella for inspection and policy enforcement. GRE (D) provides a lightweight, stateless tunnel that Umbrella commonly uses for redirecting traffic from branch routers or edge devices to the SIG. IPsec (E) is also supported and adds encryption and authentication, making it suitable when traffic must be protected in transit between the branch and the Umbrella SIG. DNS-over-HTTPS (A) is a DNS resolution privacy mechanism, not a general traffic-tunneling method to the SIG; Bluetooth (B) is a short-range personal-area wireless technology with no role in branch-to-cloud tunneling; and an explicit HTTP proxy (C) forwards web requests but is not one of the two tunnel methods Umbrella SIG uses for branch traffic redirection.

Answer

DNS-over-HTTPS

Answer

Bluetooth connectivity

Answer

HTTP Proxy (explicit)

Question 15

Which TWO capabilities does Cisco Cloudlock bring to a SaaS environment?

Accepted Answer

Data Loss Prevention (DLP). Cisco Cloudlock is a cloud access security broker (CASB) that provides Data Loss Prevention (DLP) for SaaS environments, so option B is correct: it inspects content in sanctioned cloud apps (e.g., Microsoft 365, Google Workspace, Salesforce) and enforces policies to detect and protect sensitive data such as PII, PCI, and PHI. Option E is also correct because Cloudlock includes User and Entity Behavior Analytics (UEBA) that baselines user activity and detects account compromise indicators like impossible travel, anomalous mass downloads, or suspicious login patterns. The remaining options do not belong: power management for laptops (A) is endpoint hardware/firmware functionality, automatic server patching (C) is a vulnerability/patch management capability, and physical building access control (D) is a physical security function—none of which are Cloudlock SaaS security features.

Answer

Power management for laptops

Answer

Automatic server patching

Answer

Physical building access control