SCAZT Cloud Security Architecture — Timed 10 Questions

Question 1

An organization is deploying Cisco Umbrella SIG to enforce Zero Trust access. You must configure the selective decryption policy. Which setting ensures that specific sensitive traffic, such as financial and healthcare sites, is bypassed for inspection to comply with privacy regulations?

10 minute time limit — choose an answer to begin.

Accepted Answer

Configure a Web Policy rule with a 'Decrypt' action and specify the sensitive categories in the 'Bypass' list.. In Cisco Umbrella SIG selective decryption, the Web Policy rule controls which traffic is decrypted for inspection. To comply with privacy regulations for financial and healthcare sites, you configure a Web Policy rule with a 'Decrypt' action and add those sensitive categories to the 'Bypass' list, so their TLS traffic is not decrypted while other traffic is inspected.

Answer

Apply a 'Transparent Proxy' setting on the local Cisco ASA firewall.

Answer

Enable 'HTTPS Inspection' in the Cloud Security global settings and select 'Bypass All' for all categories.

Answer

Set the 'Block' action for sensitive categories in the Destination Lists.

Question 2

A network architect is deploying Cisco Umbrella SIG to enforce Zero Trust access. Which mechanism provides the initial posture assessment before allowing a user to access a SaaS application via the Secure Web Gateway?

Accepted Answer

AnyConnect/Secure Client Posture Module. The Cisco Umbrella Roaming Client or AnyConnect module performs device posture checks before establishing the tunnel.

Answer

Umbrella Virtual Appliance

Answer

Cloud-delivered Firewall

Answer

Umbrella DNS Policies

Answer

Umbrella SIG API

Question 3

Which TWO components are essential for implementing a Zero Trust Network Access (ZTNA) model using Cisco Duo and Secure Access?

Accepted Answer

Duo Authentication Proxy. Duo Authentication Proxy (A) is essential because it acts as the on-premises broker that forwards authentication requests from Duo's cloud service to the local identity sources (such as Active Directory or RADIUS/LDAP), enabling identity verification for ZTNA. Cisco Secure Access Connector (C) is essential because it establishes the outbound-only tunnel from the private network to Cisco's Secure Access cloud, publishing internal applications so that ZTNA policies can be enforced per user and per app without exposing the network. The other options are not required components of this Duo plus Secure Access ZTNA design: Cisco Secure Firewall Management Center (B) is a firewall management platform, Cisco ISE (D) is a NAC/policy server for network access control, and Umbrella Virtual Appliance (E) is used for DNS-layer security and local DNS forwarding, none of which are the essential ZTNA components in this scenario.

Answer

Cisco Secure Firewall Management Center

Answer

Cisco ISE

Answer

Umbrella Virtual Appliance

Question 4

You are integrating Cisco Duo with an on-premises application that does not support SAML. How should you design the access flow to achieve Zero Trust authentication using the Duo Access Gateway (DAG)?

Accepted Answer

Deploy the Duo Authentication Proxy to bridge the application's RADIUS/LDAP traffic to Duo's cloud service.. For legacy applications that lack native SAML support, the Duo Access Gateway (DAG) acts as a SAML service provider for the application and a SAML identity provider for the identity source.

Answer

Install the Duo Mobile app directly on the application server.

Answer

Configure the application to trust the Duo cloud directly via OAuth2.

Answer

Use the Duo Network Gateway to perform URL rewriting on the legacy headers.

Question 5

In a SASE deployment using Cisco SD-WAN and Umbrella, how is traffic steered to the cloud security stack when a branch router loses its direct tunnel connection to the Umbrella SIG headend?

Accepted Answer

Automated tunnel failover to secondary Umbrella SIG DC. In a Cisco SD-WAN and Umbrella SASE deployment, when a branch router loses its direct tunnel to the primary Umbrella SIG headend, the SD-WAN fabric automatically fails over to a secondary Umbrella SIG data center. This automated tunnel failover maintains security inspection and connectivity without manual intervention.

Answer

Local traffic is routed via MPLS only

Answer

Traffic is sent to the Umbrella VA

Answer

Traffic reverts to transparent proxy mode

Answer

Traffic is dropped by default

Question 6

Which TWO of the following are primary components of the Cisco SASE security stack?

Accepted Answer

Cisco Umbrella SIG. Cisco Umbrella SIG (Secure Internet Gateway) is a core component of Cisco's SASE stack because it delivers cloud-delivered secure web gateway (SWG), DNS-layer security, firewall, and CASB capabilities from the Umbrella cloud edge, which is exactly the security half of SASE. Cisco Duo is also a primary SASE component, providing zero-trust identity verification with MFA and device-based access policy enforcement that ties user identity to network and application access. Together, Umbrella SIG and Duo represent the convergence of networking and security-as-a-service that defines Cisco's SASE architecture. Cisco Webex is a collaboration/meeting application, not a SASE security service, so it does not belong. Cisco Identity Services Engine (ISE) is an on-premises NAC/identity policy platform rather than a cloud-delivered SASE security component, and Cisco Meraki Go is a small-business networking line, not part of the SASE security stack.

Answer

Cisco Webex

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Meraki Go

Question 7

You are designing a Zero Trust architecture. How do you handle 'legacy applications' that do not support modern identity protocols?

Accepted Answer

Deploy a gateway or proxy that provides an identity-aware front-end.. An identity-aware proxy or the Duo Authentication Proxy can act as a gateway, translating modern authentication to the application's native protocol.

Answer

multi_select

Answer

Move the application to the cloud immediately.

Answer

Disable authentication for these apps.

Answer

Rewrite the application code to support SAML.

Question 8

Which THREE features are provided by the Cisco Umbrella 'Intelligent Proxy'?

Accepted Answer

File inspection for malware. The Cisco Umbrella Intelligent Proxy is a selective proxy that inspects traffic for risky requests, and option C is correct because it performs file inspection to detect malware in downloaded files before they reach the endpoint. Option D is correct because the Intelligent Proxy enforces URL filtering based on Umbrella's reputation intelligence, blocking or allowing destinations according to their risk score. Option E is correct because the Intelligent Proxy can perform SSL/TLS inspection to decrypt and examine HTTPS traffic for threats and policy violations. Options A and B are not features of the Intelligent Proxy: it is a cloud-delivered secure web gateway capability, not a local DHCP server (A) and not a hardware firewall replacement (B).

Answer

Local DHCP server management

Answer

Hardware firewall replacement

Question 9

Which TWO of the following are benefits of moving from a legacy VPN to a ZTNA-based architecture?

Accepted Answer

Granular, per-application access control. ZTNA improves security through granular access and improves user experience by eliminating hair-pinning.

Answer

Increased network overhead

Answer

Full access to the entire subnet

Answer

Automatic physical hardware upgrades

Answer

Improved user experience by reducing latency

Question 10

Which TWO features of Cisco Umbrella assist in preventing data loss?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) (C) is correct because Cisco Umbrella's DLP capability inspects traffic and blocks sensitive data such as PII, credit card numbers, and other regulated content from leaving the organization, directly preventing data exfiltration. File inspection (sandboxing) (E) is correct because Umbrella's file inspection forwards suspicious files to the Cisco Secure Malware Analytics (Threat Grid) sandbox, where malicious payloads that could steal or encrypt data are detected and blocked before they can cause loss. DNS query logs (A) are only a visibility/auditing record of requested domains and do not themselves block or prevent data loss. Local firewall rules (B) are enforced on-premises by a separate device and are not a Cisco Umbrella feature. Automated DNS updates (D) is not a data-loss prevention feature; it merely describes dynamic DNS resolution behavior and does not inspect or block outbound sensitive content.

Answer

DNS query logs

Answer

Local firewall rules

Answer

Automated DNS updates