SCAZT Cloud Security Architecture — Timed 20 Questions

Question 1

You are integrating Cisco Duo with an on-premises application that does not support SAML. How should you design the access flow to achieve Zero Trust authentication using the Duo Access Gateway (DAG)?

Accepted Answer

Deploy the Duo Authentication Proxy to bridge the application's RADIUS/LDAP traffic to Duo's cloud service.. For legacy applications that lack native SAML support, the Duo Access Gateway (DAG) acts as a SAML service provider for the application and a SAML identity provider for the identity source.

Answer

Install the Duo Mobile app directly on the application server.

Answer

Configure the application to trust the Duo cloud directly via OAuth2.

Answer

Use the Duo Network Gateway to perform URL rewriting on the legacy headers.

Question 2

You are designing a Zero Trust architecture. How do you handle 'legacy applications' that do not support modern identity protocols?

Accepted Answer

Deploy a gateway or proxy that provides an identity-aware front-end.. An identity-aware proxy or the Duo Authentication Proxy can act as a gateway, translating modern authentication to the application's native protocol.

Answer

multi_select

Answer

Move the application to the cloud immediately.

Answer

Disable authentication for these apps.

Answer

Rewrite the application code to support SAML.

Question 3

Which TWO of the following are benefits of moving from a legacy VPN to a ZTNA-based architecture?

Accepted Answer

Granular, per-application access control. ZTNA improves security through granular access and improves user experience by eliminating hair-pinning.

Answer

Increased network overhead

Answer

Full access to the entire subnet

Answer

Automatic physical hardware upgrades

Answer

Improved user experience by reducing latency

Question 4

A user is attempting to access a SaaS application, but the session is blocked by Cisco Cloudlock due to a detected policy violation. Which component is responsible for analyzing the API calls and triggering the remediation?

Accepted Answer

Cloudlock CASB API engine. Cisco Cloudlock utilizes API-based integration to monitor SaaS environments and enforce security policies, such as DLP or anomaly detection.

Answer

Duo Authentication Proxy

Answer

AnyConnect SASE client

Answer

Umbrella SIG proxy

Question 5

Which THREE factors should be considered when designing an IaaS security architecture using Cisco Secure Workload (formerly Tetration)?

Accepted Answer

Identity-based policy enforcement. Secure Workload focuses on visibility, micro-segmentation, and policy enforcement across hybrid clouds.

Answer

Physical switch port mirroring

Answer

Global firewall rule consolidation

Question 6

An organization is deploying Cisco Umbrella SIG to enforce Zero Trust access. You must configure the selective decryption policy. Which setting ensures that specific sensitive traffic, such as financial and healthcare sites, is bypassed for inspection to comply with privacy regulations?

Accepted Answer

Configure a Web Policy rule with a 'Decrypt' action and specify the sensitive categories in the 'Bypass' list.. Within the Cisco Umbrella dashboard, the SSL Decryption policy allows administrators to define bypass lists for specific categories or domains to prevent sensitive traffic from being decrypted.

Answer

Apply a 'Transparent Proxy' setting on the local Cisco ASA firewall.

Answer

Enable 'HTTPS Inspection' in the Cloud Security global settings and select 'Bypass All' for all categories.

Answer

Set the 'Block' action for sensitive categories in the Destination Lists.

Question 7

A network architect is deploying Cisco Umbrella SIG to enforce Zero Trust access. Which mechanism provides the initial posture assessment before allowing a user to access a SaaS application via the Secure Web Gateway?

Accepted Answer

AnyConnect/Secure Client Posture Module. The Cisco Umbrella Roaming Client or AnyConnect module performs device posture checks before establishing the tunnel.

Answer

Umbrella Virtual Appliance

Answer

Cloud-delivered Firewall

Answer

Umbrella DNS Policies

Answer

Umbrella SIG API

Question 8

Which TWO components are essential for implementing a Zero Trust Network Access (ZTNA) model using Cisco Duo and Secure Access?

Accepted Answer

Duo Authentication Proxy. ZTNA requires both identity verification (Duo) and policy-based access control (Secure Access).

Answer

Cisco Secure Firewall Management Center

Answer

Cisco ISE

Answer

Umbrella Virtual Appliance

Question 9

In a SASE deployment using Cisco SD-WAN and Umbrella, how is traffic steered to the cloud security stack when a branch router loses its direct tunnel connection to the Umbrella SIG headend?

Accepted Answer

Automated tunnel failover to secondary Umbrella SIG DC. Cisco SD-WAN uses Cloud OnRamp for SaaS/IaaS which automatically fails over to the next optimal gateway or local breakout based on configured SLA policies.

Answer

Local traffic is routed via MPLS only

Answer

Traffic is sent to the Umbrella VA

Answer

Traffic reverts to transparent proxy mode

Answer

Traffic is dropped by default

Question 10

When designing a Secure Access Service Edge (SASE) architecture, which principle best describes the shift from traditional hub-and-spoke networking?

Accepted Answer

Direct-to-cloud connectivity. SASE emphasizes connecting users directly to cloud resources rather than backhauling traffic to a central DC.

Answer

On-premise appliance chaining

Answer

Strict MPLS segmentation

Answer

Identity-agnostic security

Answer

Centralized backhauling

Question 11

You are configuring a SASE design to secure traffic from a branch office to the cloud. What is the recommended method for routing internet-bound traffic from the branch to the Cisco Umbrella SIG?

Accepted Answer

Establish an IPsec tunnel from the branch edge device to the nearest Umbrella data center.. IPsec tunnels from the branch edge device (such as a Cisco ISR or Meraki MX) to the Cisco Umbrella SIG provide a secure, encrypted transit for all traffic.

Answer

Configure DNS forwarding only.

Answer

Use an AnyConnect agent on every endpoint in the branch.

Answer

Deploy a local proxy server that intercepts all traffic.

Question 12

When designing a Zero Trust architecture using Cisco Secure Access, how does the 'Device Posture' check specifically influence the access decision for a managed laptop?

Accepted Answer

It requires the presence of an MDM-enrolled certificate or specific registry key before authorizing the session.. Device posture checks in Cisco Secure Access verify the health and security configuration of the endpoint before granting access to protected applications.

Answer

It switches the user's connection to a VPN tunnel.

Answer

It forces a mandatory password reset if the device is out of compliance.

Answer

It checks the user's IP address against a geo-blocking database.

Question 13

Which component of the Cisco SASE architecture provides the primary security enforcement point for remote users browsing the web from untrusted networks?

Accepted Answer

Cisco Umbrella SIG. The Cisco Umbrella Secure Internet Gateway (SIG) provides the cloud-native security stack for remote users.

Answer

Cisco Firepower Threat Defense (FTD)

Answer

Cisco Meraki MX

Answer

Cisco Identity Services Engine (ISE)

Question 14

In a SASE deployment, why is the integration between Cisco ISE and Cisco Secure Access considered a critical design pattern?

Accepted Answer

It enables context-aware policy enforcement based on user identity and device state across the hybrid environment.. Integrating ISE with Secure Access allows consistent policy application across both on-premises network resources and cloud-based applications.

Answer

It enables direct firewall inspection of internal traffic.

Answer

It allows ISE to act as a cloud proxy server.

Answer

It automates the deployment of AnyConnect agents.

Question 15

You are designing a secure remote access solution for a hybrid cloud environment. Which Cisco technology should you implement to replace a traditional VPN while enforcing Zero Trust principles?

Accepted Answer

Cisco Secure Access (ZTNA). Cisco Secure Access (the ZTNA offering) provides per-application access based on identity and posture, replacing the broad network access of a VPN.

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Meraki Client VPN

Answer

Cisco Firepower VPN

Question 16

When evaluating cloud security reference architectures, what is the primary purpose of a 'Cloud Access Security Broker' (CASB)?

Accepted Answer

To enforce security policies and provide visibility into SaaS and cloud applications.. A CASB sits between cloud service consumers and providers to enforce security policies, ensuring visibility, compliance, and threat protection.

Answer

To act as a secondary DNS server for the enterprise.

Answer

To manage physical access to cloud data centers.

Answer

To perform load balancing for cloud traffic.

Question 17

A security architect is designing a SASE solution. What is the significance of 'Identity-Based Segmentation' in this design?

Accepted Answer

It allows for access control based on user identity rather than network topology.. Identity-based segmentation allows for granular access control, ensuring users can only access applications they are authorized to use, regardless of their location.

Answer

It allows for faster internet speeds by bypassing the firewall.

Answer

It enables automatic IP address assignment for cloud users.

Answer

It reduces the complexity of managing VLANs.

Question 18

You are troubleshooting a connection issue where a remote user cannot access a private cloud application via the Cisco Secure Access ZTNA connector. Which step is most likely to resolve the issue?

Accepted Answer

Check the health status of the ZTNA connector in the Secure Access dashboard.. Verifying the connectivity of the ZTNA connector to the private resource is the first diagnostic step to ensure the tunnel is active.

Answer

Increase the timeout value on the client browser.

Answer

Flush the DNS cache on the corporate firewall.

Answer

Reboot the user's laptop.

Question 19

When implementing a Zero Trust architecture, what is the 'Principle of Least Privilege' (PoLP) specifically intended to achieve?

Accepted Answer

Granting only the necessary permissions required for a user to perform their task.. PoLP ensures that users and devices are granted the minimum level of access required to perform their jobs, minimizing the blast radius of a potential breach.

Answer

Allowing open access to all company resources from the office.

Answer

Giving administrative access to all power users.

Answer

Automating the password rotation process.

Question 20

Which capability of the Cisco Umbrella SIG ensures that sensitive data, such as PII or credit card numbers, does not leave the organization via web traffic?

Accepted Answer

Cloud-based Data Loss Prevention (DLP). Cisco Umbrella's Data Loss Prevention (DLP) capability inspects outgoing traffic for sensitive information based on pre-defined or custom data patterns.

Answer

Firewall-as-a-Service (FWaaS)

Answer

DNS-layer security

Answer

Intelligent Proxy