SCAZT Cloud Security Architecture — Timed 10 Questions

Question 1

You are integrating Cisco Duo with an on-premises application that does not support SAML. How should you design the access flow to achieve Zero Trust authentication using the Duo Access Gateway (DAG)?

Accepted Answer

Deploy the Duo Authentication Proxy to bridge the application's RADIUS/LDAP traffic to Duo's cloud service.. For legacy applications that lack native SAML support, the Duo Access Gateway (DAG) acts as a SAML service provider for the application and a SAML identity provider for the identity source.

Answer

Install the Duo Mobile app directly on the application server.

Answer

Configure the application to trust the Duo cloud directly via OAuth2.

Answer

Use the Duo Network Gateway to perform URL rewriting on the legacy headers.

Question 2

You are designing a Zero Trust architecture. How do you handle 'legacy applications' that do not support modern identity protocols?

Accepted Answer

Deploy a gateway or proxy that provides an identity-aware front-end.. An identity-aware proxy or the Duo Authentication Proxy can act as a gateway, translating modern authentication to the application's native protocol.

Answer

multi_select

Answer

Move the application to the cloud immediately.

Answer

Disable authentication for these apps.

Answer

Rewrite the application code to support SAML.

Question 3

Which TWO of the following are benefits of moving from a legacy VPN to a ZTNA-based architecture?

Accepted Answer

Granular, per-application access control. ZTNA improves security through granular access and improves user experience by eliminating hair-pinning.

Answer

Increased network overhead

Answer

Full access to the entire subnet

Answer

Automatic physical hardware upgrades

Answer

Improved user experience by reducing latency

Question 4

A user is attempting to access a SaaS application, but the session is blocked by Cisco Cloudlock due to a detected policy violation. Which component is responsible for analyzing the API calls and triggering the remediation?

Accepted Answer

Cloudlock CASB API engine. Cisco Cloudlock utilizes API-based integration to monitor SaaS environments and enforce security policies, such as DLP or anomaly detection.

Answer

Duo Authentication Proxy

Answer

AnyConnect SASE client

Answer

Umbrella SIG proxy

Question 5

Which THREE factors should be considered when designing an IaaS security architecture using Cisco Secure Workload (formerly Tetration)?

Accepted Answer

Identity-based policy enforcement. Secure Workload focuses on visibility, micro-segmentation, and policy enforcement across hybrid clouds.

Answer

Physical switch port mirroring

Answer

Global firewall rule consolidation

Question 6

An organization is deploying Cisco Umbrella SIG to enforce Zero Trust access. You must configure the selective decryption policy. Which setting ensures that specific sensitive traffic, such as financial and healthcare sites, is bypassed for inspection to comply with privacy regulations?

Accepted Answer

Configure a Web Policy rule with a 'Decrypt' action and specify the sensitive categories in the 'Bypass' list.. Within the Cisco Umbrella dashboard, the SSL Decryption policy allows administrators to define bypass lists for specific categories or domains to prevent sensitive traffic from being decrypted.

Answer

Apply a 'Transparent Proxy' setting on the local Cisco ASA firewall.

Answer

Enable 'HTTPS Inspection' in the Cloud Security global settings and select 'Bypass All' for all categories.

Answer

Set the 'Block' action for sensitive categories in the Destination Lists.

Question 7

A network architect is deploying Cisco Umbrella SIG to enforce Zero Trust access. Which mechanism provides the initial posture assessment before allowing a user to access a SaaS application via the Secure Web Gateway?

Accepted Answer

AnyConnect/Secure Client Posture Module. The Cisco Umbrella Roaming Client or AnyConnect module performs device posture checks before establishing the tunnel.

Answer

Umbrella Virtual Appliance

Answer

Cloud-delivered Firewall

Answer

Umbrella DNS Policies

Answer

Umbrella SIG API

Question 8

Which TWO components are essential for implementing a Zero Trust Network Access (ZTNA) model using Cisco Duo and Secure Access?

Accepted Answer

Duo Authentication Proxy. ZTNA requires both identity verification (Duo) and policy-based access control (Secure Access).

Answer

Cisco Secure Firewall Management Center

Answer

Cisco ISE

Answer

Umbrella Virtual Appliance

Question 9

In a SASE deployment using Cisco SD-WAN and Umbrella, how is traffic steered to the cloud security stack when a branch router loses its direct tunnel connection to the Umbrella SIG headend?

Accepted Answer

Automated tunnel failover to secondary Umbrella SIG DC. Cisco SD-WAN uses Cloud OnRamp for SaaS/IaaS which automatically fails over to the next optimal gateway or local breakout based on configured SLA policies.

Answer

Local traffic is routed via MPLS only

Answer

Traffic is sent to the Umbrella VA

Answer

Traffic reverts to transparent proxy mode

Answer

Traffic is dropped by default

Question 10

When designing a Secure Access Service Edge (SASE) architecture, which principle best describes the shift from traditional hub-and-spoke networking?

Accepted Answer

Direct-to-cloud connectivity. SASE emphasizes connecting users directly to cloud resources rather than backhauling traffic to a central DC.

Answer

On-premise appliance chaining

Answer

Strict MPLS segmentation

Answer

Identity-agnostic security

Answer

Centralized backhauling