SCAZT Multiple Select — 30 Questions

Question 1

Which THREE types of information are typically displayed in the Cisco Umbrella 'App Discovery' report?

Accepted Answer

Risk Score. The Cisco Umbrella App Discovery report is designed to give visibility into the SaaS and cloud applications in use across the environment, and it surfaces three key data points per application: the Application Name (C), which identifies the discovered app; the Traffic Volume (D), which shows how much bandwidth or request activity that app generates; and the Risk Score (A), which rates the app's security/privacy risk based on Cisco's Cloudlock/Umbrella intelligence. These three fields let administrators quickly triage shadow IT by knowing what the app is, how much it is used, and how risky it is. The other options do not belong: a User's home address (B) is personal data never shown in this report, and an Application's source code (E) is proprietary code that Umbrella has no access to and does not display.

Answer

User's home address

Answer

Application's source code

Question 2

Which THREE items are considered primary components of the Cisco Umbrella 'Identity' structure when creating security policies?

Accepted Answer

Roaming Computer. In Cisco Umbrella, the Identity structure used when building policies is built around three primary identity types: Roaming Computers (A), which are endpoints running the Umbrella Roaming Client/SIG agent and are identified by their registered identity; Networks (B), which are defined by public IP addresses/subnets (or dynamic IPs via the Umbrella network device/AD integration) so all traffic egressing that IP is attributed to the network identity; and Active Directory User/Group (D), which ties DNS requests to AD users or groups via the AD Connector or Virtual Appliance for user-based policy enforcement. These three map directly to Umbrella's policy identity selectors (Roaming Computers, Networks, and AD Users/Groups) and are the standard building blocks for differentiated security policies. A printer's MAC address (C) is not an Umbrella identity construct—Umbrella identities are based on roaming client registration, public IP/network, or AD user/group, not endpoint MAC addresses. A public cloud instance ID (E) is likewise not a primary Umbrella identity type; cloud workloads are typically covered via network/IP identities or the Umbrella SIG/cloud firewall integrations rather than an instance-ID identity.

Answer

MAC Address of the Printer

Answer

Public Cloud Instance ID

Question 3

Which THREE factors are typically considered when evaluating 'Device Posture' in a Zero Trust environment?

Accepted Answer

Disk encryption status. Device Posture in a Zero Trust environment assesses the security hygiene and configuration state of an endpoint before granting access, so option B (Disk encryption status) is correct because full-disk encryption such as BitLocker or FileVault protects data at rest and is a standard compliance signal. Option C (Antivirus status) is correct because the presence, currency, and real-time protection state of endpoint anti-malware (e.g., Defender, CrowdStrike) indicates whether the device can detect and resist threats. Option E (Operating system patch level) is correct because missing OS security updates expose known vulnerabilities, so posture checks verify patch compliance via tools like Intune, Jamf, or conditional access policies. Option A (The user's home internet speed) is not a security posture attribute but a network performance metric, and option D (The user's favorite website) is irrelevant personal preference data with no bearing on device trust.

Answer

The user's home internet speed

Answer

The user's favorite website

Question 4

Which THREE mechanisms are commonly used by a CASB to enforce access control to SaaS applications?

Accepted Answer

API-based integration.. A CASB commonly enforces access control to SaaS applications through three primary deployment modes. API-based integration (C) connects directly to the SaaS provider's REST APIs to scan content, apply DLP policies, and enforce access rules without inline traffic inspection. Reverse Proxy (D) sits between users and the SaaS app, intercepting sessions so the CASB can apply authentication, authorization, and policy controls inline. Forward Proxy (E) routes user traffic from the endpoint through the CASB, enabling inline enforcement of access policies for SaaS sessions. Local host firewall rules (A) operate at the OS/network layer and cannot inspect SaaS application context or user identity, so they are not a CASB enforcement mechanism. Direct switch-to-server connection (B) is a network topology concept, not an access-control mechanism used by a CASB.

Answer

Local host firewall rules.

Answer

Direct switch-to-server connection.

Question 5

Which THREE types of information are analyzed by Cisco Secure Workload (Tetration) to enforce micro-segmentation?

Accepted Answer

User identity context. Cisco Secure Workload (formerly Tetration) enforces micro-segmentation by analyzing rich workload telemetry, and user identity context (B) is correct because it correlates authenticated user and group information (e.g., via AD/LDAP integration) with flows so policies can be scoped to who is communicating, not just IP addresses. Process-level information (C) is correct because Tetration agents collect process and package details (executable names, hashes, parent-child relationships, listening ports) on each workload, enabling policies based on what process is generating or receiving traffic. Network flow telemetry (E) is correct because the platform continuously ingests flow data (5-tuple, ports, protocols, byte counts) from agents and network devices to build the dependency maps and behavioral baselines used for micro-segmentation policy recommendations. The remaining options are not analyzed: the color of the server rack (A) and the user's home address (D) are physical or personal attributes with no bearing on workload communication behavior or segmentation policy.

Answer

The color of the server rack

Answer

User's home address

Question 6

Which TWO methods are used to verify compliance against security policies in Cisco Defense Orchestrator?

Accepted Answer

Generating compliance reports on policy configurations. Option A is correct because Cisco Defense Orchestrator (CDO) provides compliance reporting that evaluates managed device configurations against security policies and highlights violations, giving administrators an auditable view of policy adherence. Option B is correct because CDO's 'Check for Changes' feature compares the running configuration against the last-known-good or baseline configuration to detect configuration drift, which is a core mechanism for verifying ongoing compliance. Options C, D, and E are incorrect because rebooting appliances, running traceroutes from endpoints, and manually reconfiguring firewalls are operational or troubleshooting actions that do not verify compliance against security policies in CDO.

Answer

Rebooting all security appliances

Answer

Executing a manual traceroute from every endpoint

Answer

Manually re-configuring the entire firewall

Question 7

Which THREE components are part of the Cisco SecureX suite?

Accepted Answer

Threat Response. Cisco SecureX is a cloud-native security platform whose core components include Threat Response (option A), which provides integrated investigation, threat hunting, and response workflows across Cisco and third-party security products, making it a correct answer. Dashboard (option C) is also a SecureX component, offering a single-pane-of-glass view that aggregates security intelligence, metrics, and alerts from integrated products. Orchestration (option E) is likewise part of SecureX, delivering automation and workflow orchestration through prebuilt playbooks and APIs to streamline security operations. The remaining options do not belong: Cisco IOS-XE CLI (option B) is the command-line interface for Cisco's IOS-XE network operating system, not a SecureX component, and Cisco Webex Meetings (option D) is a collaboration/meeting application unrelated to the SecureX security suite.

Answer

Cisco IOS-XE CLI

Answer

Cisco Webex Meetings

Question 8

When designing a SOAR playbook for cloud security incidents, which TWO factors are critical for ensuring successful execution?

Accepted Answer

Input validation logic. Input validation logic (A) is critical because SOAR playbooks consume data from alerts, tickets, and external feeds; validating and normalizing that input prevents malformed or malicious values from breaking conditional branches, causing failed API calls, or triggering unintended automated actions. Correct API permissions for integrated tools (D) is equally critical because each playbook action (e.g., isolating an EC2 instance, disabling an IAM key, posting to Slack) executes under a service account or integration credential, and least-privilege scopes must be granted for those specific APIs or the steps will fail with 401/403 errors. Full administrative privileges (B) is not required and violates least privilege, increasing blast radius if the playbook or credential is compromised. Manual intervention steps (C) are optional and can even reduce automation value, so they are not a critical success factor. Frequent database reindexing (E) is unrelated to playbook execution and addresses search performance, not SOAR workflow reliability.

Answer

Full administrative privileges

Answer

Manual intervention steps

Answer

Frequent database reindexing

Question 9

What are TWO benefits of integrating Cisco Secure Email with SecureX orchestration?

Accepted Answer

Global threat purging. Option B (Global threat purging) is correct because SecureX orchestration can trigger Secure Email's message remediation capabilities across the organization, allowing an administrator to search for and delete malicious messages from all mailboxes at once rather than manually hunting them per-user. Option D (Automated threat extraction) is correct because orchestration workflows can automatically invoke Secure Email's threat extraction feature, which strips active content and attachments from messages and replaces them with safe renditions before delivery, removing the need for manual analyst intervention. The remaining options do not belong: real-time video monitoring (A) is not a Secure Email or SecureX orchestration function, manual email routing (C) contradicts the automation benefit that orchestration provides, and hardware load balancing (E) is an infrastructure/networking concern unrelated to email security integration.

Answer

Real-time video monitoring

Answer

Manual email routing

Answer

Hardware load balancing

Question 10

Which TWO methods can be used to bypass Duo authentication in an emergency?

Accepted Answer

Add the user to a group that has a 'Bypass' policy applied. Option C is correct because Duo policies can be applied to groups, and a group assigned a policy with the "Bypass" setting allows its members to authenticate without completing Duo's second factor. Option E is correct because Duo administrators can generate a temporary bypass code for a specific user, which the user enters in place of the Duo passcode to skip the normal authentication flow for a limited time. Option A is incorrect because renaming an AD account does not affect Duo's authentication enforcement and would not bypass the second factor. Option B is incorrect because resetting the password to '12345' only changes the primary credential and does not disable or bypass Duo MFA. Option D is incorrect because setting the global MFA mode to 'Bypass' for all users is not a supported Duo emergency bypass method and would disable MFA organization-wide rather than for a single user.

Answer

Rename the user's AD account

Answer

Reset the user's password to '12345'

Answer

Set the global MFA mode to 'Bypass' for all users

Question 11

Which TWO ways does Cisco Secure Cloud Analytics provide visibility into encrypted traffic?

Accepted Answer

TLS fingerprinting. Cisco Secure Cloud Analytics gains visibility into encrypted traffic without decrypting it, and option A (TLS fingerprinting) is correct because it inspects the unencrypted TLS handshake fields — such as the JA3/JA3S hash derived from ClientHello/ServerHello parameters, cipher suites, and extensions — to identify the client or server application even though the payload remains encrypted. Option E (Behavioral analysis of flow patterns) is also correct because the product uses metadata from flow records (for example NetFlow/IPFIX) to model traffic behavior, detecting anomalies like unusual destinations, volumes, or beaconing patterns without needing to see inside the encrypted session. Option B is wrong because Secure Cloud Analytics is a cloud-delivered network telemetry and analytics platform, not an endpoint agent that reads local browser history files. Option C is wrong because installing a root CA on mobile devices is a TLS interception technique used by other tools, not a visibility method of Secure Cloud Analytics. Option D is wrong because Secure Cloud Analytics does not perform full payload decryption at the cloud edge; its value proposition is metadata- and fingerprint-based analytics that preserve privacy and avoid decryption.

Answer

Analyzing the local browser history files

Answer

Installing a root CA on all mobile devices

Answer

Full payload decryption at the cloud edge

Question 12

Which THREE factors should be considered when designing an IaaS security architecture using Cisco Secure Workload (formerly Tetration)?

Accepted Answer

Identity-based policy enforcement. Cisco Secure Workload (formerly Tetration) is built around identity-based policy enforcement, so option C is correct because it uses workload attributes such as labels, tags, and process identity to define granular allow/deny rules rather than relying only on IP addresses. Option D is correct because application dependency mapping is a core capability that discovers workload-to-workload communication flows and builds the behavioral baseline needed to create accurate policies. Option E is correct because host-based sensor deployment is required to collect the telemetry (flows, processes, packages) from each workload that feeds the platform's analytics and policy engine. Option A is not correct because physical switch port mirroring is a network-centric monitoring approach and is not the primary mechanism used by Secure Workload in IaaS environments. Option B is not correct because global firewall rule consolidation is a broad network-security practice, not a specific design factor for Cisco Secure Workload's identity- and workload-centric architecture.

Answer

Physical switch port mirroring

Answer

Global firewall rule consolidation

Question 13

Which TWO pieces of information are required for a 'Network Identity' in Umbrella?

Accepted Answer

A friendly name for the location. A network identity is defined by the public IP address and a descriptive name to identify the location in reports.

Answer

The internal DHCP server IP

Answer

The local VLAN ID

Answer

The ISP account number

Question 14

Which TWO are common 'secure access design patterns' in a hybrid cloud?

Accepted Answer

ZTNA for remote user access. Standard patterns include ZTNA for users and secure transit gateways for inter-cloud traffic.

Answer

Connecting all apps to the local LAN only

Answer

Open access for all traffic

Answer

Public internet bypass for all traffic

Question 15

Which TWO settings should you check if a SecureX integration module shows 'Offline' status?

Accepted Answer

Verify the validity of the API credentials. Option A is correct because a SecureX integration module authenticates to the remote API using its configured API credentials, and if the API key, token, or client secret is expired, revoked, or incorrect, the module cannot establish its session and will report 'Offline'. Option C is correct because the module must reach the API endpoint over the network (typically HTTPS/TCP 443); blocked firewall rules, DNS failures, proxy misconfiguration, or routing problems will prevent the heartbeat/health check from succeeding and cause the Offline status. Options B and D are incorrect because monitor resolution and local browser installation have no bearing on the server-side integration module's connectivity or authentication state. Option E is incorrect because a power cable issue would affect the whole appliance or host, not selectively produce an integration module Offline status while the rest of SecureX remains operational.

Answer

Change the resolution of the computer monitor

Answer

Reinstall the local web browser

Answer

Check the local power cable of the SecureX server

Question 16

When managing incidents in SecureX, which TWO actions can be performed directly from a Casebook?

Accepted Answer

Trigger a workflow. Casebook allows analysts to add observables for investigation and trigger pre-configured workflows to automate response.

Answer

Manage user passwords

Answer

Modify firewall firmware

Answer

Delete all historical logs

Question 17

When integrating Cisco Umbrella with a SaaS application, which TWO methods can be used to ensure secure user authentication?

Accepted Answer

Duo MFA integration. Duo MFA integration (C) is correct because Cisco Umbrella supports Duo as a multi-factor authentication provider, adding a second verification factor to user logins and thereby strengthening secure authentication for SaaS access. SAML integration with an IdP (E) is correct because Umbrella can federate authentication to an identity provider such as Okta, Microsoft Entra ID, or OneLogin via SAML 2.0, enabling single sign-on and centralized, policy-based user authentication. SNMP monitoring (A) is only for collecting device and performance telemetry, not for authenticating users. A local LDAP database (B) is a directory store, not an authentication integration method Umbrella uses for SaaS SSO, and WPA2-Enterprise (D) is a wireless LAN 802.1X security standard unrelated to SaaS user authentication.

Answer

SNMP monitoring

Answer

Local LDAP database

Answer

WPA2-Enterprise

Question 18

Which THREE types of traffic are typically protected by a SIG?

Accepted Answer

DNS queries. A Secure Internet Gateway (SIG) is a cloud-delivered security service that inspects and filters traffic destined for the internet, so the three correct answers are the traffic types that actually traverse it. Option B (DNS queries) is correct because SIGs typically include DNS-layer security that resolves and blocks malicious domains before a connection is made. Option D (HTTP/HTTPS web traffic) is correct because SIGs perform web filtering, TLS inspection, and malware scanning on web requests, which is their core function. Option E (non-web traffic such as FTP and SSH via tunnels) is correct because SIGs also inspect non-web protocols and tunneled traffic through CASB/firewall capabilities to enforce policy and detect threats. Option A (internal VoIP phone calls) is not correct because internal voice traffic stays on the LAN and does not egress to the internet through a SIG. Option C (local printer traffic) is not correct because local printing is on-premises traffic that never reaches the SIG.

Answer

Internal VoIP phone calls

Answer

Local printer traffic

Question 19

When designing incident response playbooks, which THREE of the following are considered best practices for maintaining security and operational continuity?

Accepted Answer

Implement comprehensive logging for every workflow execution step.. Option B is correct because comprehensive logging of every workflow execution step provides the audit trail and forensic evidence needed to trace actions during an incident, verify playbook behavior, and support post-incident reviews and compliance requirements. Option D is correct because dedicated service accounts scoped with least privilege limit the blast radius if a playbook or its credentials are compromised, preventing lateral movement and unauthorized access to unrelated systems. Option E is correct because modular, reusable playbooks reduce duplication and maintenance overhead, allow consistent response procedures across different incident types, and enable faster adaptation when new threats emerge. Option A is not a best practice because running playbooks only in Production without staging validation risks untested automation causing outages or destructive actions. Option C is not a best practice because sharing administrative credentials in plaintext destroys accountability, violates least privilege and separation of duties, and exposes privileged access to anyone who sees the text.

Answer

Run all playbooks in 'Production' mode without testing in a staging environment.

Answer

Share administrative credentials with all team members in plaintext.

Question 20

Which THREE pieces of information are displayed in the Umbrella 'Activity Search' report?

Accepted Answer

Identity that initiated the request. Option A is correct because the Umbrella Activity Search report shows the identity (the user or internal IP/identity) that initiated the DNS request, allowing admins to attribute traffic to a specific person or device. Option B is correct because the report displays the action taken on each request, such as Allowed or Blocked, based on the applied security policy. Option E is correct because each entry includes a timestamp showing when the request occurred, which is essential for chronological investigation and correlation with other logs. Option C is not included because the report concerns DNS/web request metadata, not endpoint hardware details like a hard drive serial number. Option D is not included because passwords are never displayed in reporting; Umbrella logs authentication identities, not credentials.

Answer

Internal hard drive serial number

Answer

User's password