SCAZT Network And Cloud Security — 25 Questions

Question 1

When configuring a SIG tunnel in Umbrella, which protocol is typically used to establish the encrypted connection between the branch office firewall and the Umbrella data center?

Accepted Answer

IKEv2/IPsec. Umbrella SIG tunnels are typically established using IKEv2/IPsec, which provides strong encryption and authentication for site-to-site VPN connections. This protocol is widely supported by branch office firewalls and ensures secure transport of traffic to Umbrella's data centers. IKEv2 offers improved reliability and mobility over IKEv1, making it the standard choice for Umbrella's secure internet gateway tunnels.

Answer

GRE (Generic Routing Encapsulation)

Answer

TLS 1.3

Answer

SSH Tunneling

Question 2

You have a requirement to perform 'File Analysis' on downloads. Which Umbrella product component must be enabled?

Accepted Answer

Umbrella SIG. File Analysis requires the Umbrella SIG (Secure Internet Gateway) with the Cisco Talos malware inspection engine enabled.

Answer

Roaming Client

Answer

DNS-layer security

Answer

Virtual Appliance

Question 3

Which THREE items must be configured to successfully implement an Umbrella SIG tunnel?

Accepted Answer

Public IP address of the branch. Option A (Public IP address of the branch) is correct because the Umbrella SIG tunnel is an IPsec-based tunnel that must be initiated from a routable public IP, which is registered as the tunnel endpoint in the Umbrella dashboard so the head-end can identify and terminate the branch connection. Option B (IKEv2 and IPsec security parameters) is correct because the tunnel is negotiated using IKEv2 for phase 1 and IPsec for phase 2, requiring matching pre-shared keys, encryption/integrity algorithms, and lifetime values on both the branch device and Umbrella. Option D (Policy-Based Routing (PBR) on the router) is correct because PBR is needed to selectively redirect the traffic that should traverse the SIG tunnel (for example, matching specific source/destination or application traffic) rather than sending all traffic through the default route. Option C is not required because Umbrella SIG is a Cisco cloud security service, not a third-party VPN provider subscription. Option E is not required because the tunnel configuration depends on public IP endpoints and routing, not on specifying an internal DNS server IP.

Answer

An active subscription to a VPN provider

Answer

Internal DNS server IP

Question 4

Which THREE actions can be taken in an Umbrella policy based on content categories?

Accepted Answer

Block access. In an Umbrella policy, content categories can be used to Block access (A), which denies the DNS request so the user cannot reach the categorized domain; Warn the user (B), which displays a block page that lets the user acknowledge the risk and proceed; and Allow access (D), which permits the request to resolve normally. These three are the standard category-based policy actions available in Umbrella's DNS-layer security. Sending an email alert to the user (C) is not a per-category policy action, and encrypting the traffic (E) is not an Umbrella policy action at all, since Umbrella enforces DNS/URL filtering rather than encrypting user traffic.

Answer

Send an email alert to the user

Answer

Encrypt the traffic

Question 5

Which TWO components are essential for a complete Cisco Umbrella deployment on end-user laptops?

Accepted Answer

Umbrella Roaming Client. For a complete Cisco Umbrella deployment on end-user laptops, the Umbrella Roaming Client (B) is essential because it is the software agent installed on each endpoint that redirects DNS queries to Umbrella's global network of resolvers, enforcing security and policy even when users are off the corporate network. Cisco Secure Client (AnyConnect) (C) is also correct because it provides the Umbrella module (Umbrella Roaming Security module) that can be deployed as part of the AnyConnect/Secure Client package, enabling DNS-layer protection and integration with the Umbrella dashboard for endpoint roaming. A dedicated VPN server (A) is not required for Umbrella itself, as Umbrella is a cloud-delivered DNS security service and does not depend on a VPN concentrator. Local Active Directory (D) is not essential for endpoint deployment, though it can be used for user/group policy integration in some scenarios. A physical router (E) is not an endpoint component and is not required for laptop-based Umbrella deployment, since the Roaming Client or Secure Client module handles DNS redirection on the device.

Answer

A dedicated VPN server

Answer

Local Active Directory

Answer

A physical router

Question 6

An administrator is configuring Cisco Umbrella for a branch office and needs to ensure that all DNS requests are inspected for malicious domains without requiring a client-side agent. Which configuration approach should the administrator implement?

Accepted Answer

Establish an IPsec tunnel from the branch edge router to the Umbrella data center.. To inspect DNS requests for malicious domains at a branch office without a client-side agent, the administrator should point the branch's DNS resolution to Cisco Umbrella's public resolvers, typically by establishing an IPsec tunnel from the branch edge router to the Umbrella data center. This routes all DNS queries through Umbrella's cloud for policy enforcement and threat inspection, and Umbrella identifies the branch by the tunnel's source IP. This is the standard 'network-based' deployment model for Umbrella when endpoint agents cannot be installed.

Answer

Deploy the Umbrella Virtual Appliance (VA) in a DMZ and configure it for direct Internet access.

Answer

Enable the 'DNS over HTTPS' feature in the browser settings for all end-user workstations.

Answer

Configure a PAC file on each endpoint to route traffic to the Umbrella Roaming Client.

Question 7

In Cisco Umbrella, which component is used to associate internal IP addresses with Active Directory user identities for granular policy reporting?

Accepted Answer

Umbrella Virtual Appliance. The Umbrella Virtual Appliance (VA) is deployed on-premises and forwards DNS queries from internal clients to Umbrella while tagging them with the internal IP address, which Umbrella correlates with Active Directory user identities via the AD Connector. This IP-to-user mapping enables granular policy enforcement and reporting by user or group rather than just by network. The VA is the component that bridges internal IP space with AD identity data.

Answer

Cisco Secure Endpoint

Answer

AnyConnect Management Tunnel

Answer

Umbrella Roaming Client

Question 8

A company wants to prevent users from bypassing security policies by using unauthorized VPNs or proxies. Which feature in Cisco Umbrella should be enabled to mitigate this risk?

Accepted Answer

Select the 'Proxy and VPN' category within the Destination Lists of the Web Policy.. The 'Proxy and VPN' category in the Umbrella destination lists allows administrators to block access to services that can bypass security filters.

Answer

Deploy the Cisco Secure Endpoint agent to detect unauthorized VPN software.

Answer

Enable the 'Web Proxy' feature in the Global Settings.

Answer

Configure an SSL Inspection rule for all traffic.

Question 9

Which THREE actions are required when configuring a new IPsec tunnel for the Cisco SIG (Secure Internet Gateway)?

Accepted Answer

Configure the local firewall with the correct Cisco SIG headend IP address.. Option C is correct because the local firewall/edge device must permit outbound IKE (UDP 500) and NAT-T (UDP 4500) traffic to the specific Cisco SIG headend IP address, otherwise the tunnel cannot be established. Option D is correct because the local edge device must be configured with matching IKEv2 proposal parameters (encryption, integrity, DH group, and authentication) so that Phase 1 negotiation with the SIG headend succeeds. Option E is correct because the tunnel endpoint IP address of the branch edge device must be registered in the Umbrella dashboard so the SIG headend knows which peer to build the IPsec tunnel with. Option A is not required because the IPsec tunnel terminates on the edge router/firewall, not on individual endpoints, so no client-side agent is needed for the tunnel itself. Option B is not required because 'AnyConnect Tunnel' is a separate remote-access VPN feature and is not part of configuring a site-to-site IPsec tunnel to Cisco SIG.

Answer

Install a client-side agent on every endpoint behind the router.

Answer

Enable the 'AnyConnect Tunnel' feature on the device.

Question 10

A multinational enterprise uses Cisco Secure Access with the ZTNA proxy for private applications. The security team wants to enforce device posture checks (e.g., disk encryption and antivirus) for contractors accessing an internal finance app without installing a VPN client on contractor laptops. Which Cisco Secure Access component should be configured to achieve this?

Accepted Answer

Cisco Secure Client with the ZTNA module and posture profile assigned to the contractor identity group. Enforcing device posture for private applications in Cisco Secure Access requires an endpoint component that can inspect the device and share that context with the policy engine. Cisco Secure Client with the ZTNA module provides these posture checks, and assigning a posture profile to the contractor identity group ensures the checks apply to the correct users. The ZTNA proxy then uses posture and identity to allow or deny access without a traditional VPN client.

Answer

Cloud firewall policy on the Secure Access egress that inspects traffic to the finance application

Answer

SAML identity provider attribute mapping that includes a device-compliance claim in the assertion

Answer

Resource Connector deployed in the private network with posture profiles bound to the application

Question 11

A security administrator is configuring Cisco Secure Access to enforce a policy that restricts access to unsanctioned cloud applications for remote users. The administrator wants to ensure that when a user attempts to access a cloud app that is not explicitly allowed, the connection is blocked and a notification is displayed. Which configuration in Cisco Secure Access should the administrator use to achieve this?

Accepted Answer

Create a rule in the Global Policy with action 'Block' and enable the 'User Notification' option.. The correct answer is to create a rule in the Global Policy with action 'Block' and enable the 'User Notification' option. This approach uses Cisco Secure Access's policy engine to enforce access control at the application level and informs users when access is denied. Other options either use the wrong product or do not provide the necessary enforcement and notification.

Answer

Set up a firewall rule on the Secure Access Connector to deny traffic to the cloud app's IP range.

Answer

Enable the 'Block Unsanctioned Apps' setting in the Secure Access dashboard's Cloud App Discovery section.

Answer

Configure a DNS policy in Umbrella to block the domain and redirect to a block page.

Question 12

You need to ensure that all web traffic from a branch office is inspected by the Umbrella SIG. Which configuration step is mandatory on your perimeter router?

Accepted Answer

Create a PBR (Policy Based Routing) to direct traffic to the tunnel. To ensure all web traffic from a branch office is inspected by Umbrella SIG, the perimeter router must be configured with Policy Based Routing (PBR) to redirect traffic into the IPsec tunnel that connects to Umbrella's SIG infrastructure. PBR overrides the default routing table and forces traffic matching specific criteria (e.g., all HTTP/HTTPS) through the tunnel interface. Without PBR, traffic would follow normal default routes and bypass the tunnel.

Answer

Install the Roaming Client on the router

Answer

Define an ACL to permit all traffic to Umbrella

Answer

Enable DNS-over-HTTPS on the router

Question 13

You are implementing Cisco Secure Access and want to use PAC files for browsers. Where must the PAC file be hosted for automatic proxy configuration?

Accepted Answer

On an accessible HTTP/HTTPS web server. A PAC (Proxy Auto-Configuration) file is a JavaScript file that browsers download to determine which proxy to use for a given URL. For automatic proxy configuration, the PAC file must be hosted on an accessible HTTP or HTTPS web server so browsers can retrieve it via its URL. Cisco Secure Access documentation specifies hosting the PAC file on a web server reachable by the endpoints.

Answer

Inside the browser settings directly

Answer

On the Secure Access cloud gateway

Answer

In the local Windows Registry

Question 14

You are configuring Cisco Umbrella to protect roaming users. Which component must be installed on the endpoint to ensure consistent policy enforcement when the user is off-VPN?

Accepted Answer

Cisco Umbrella Roaming Client. The Cisco Umbrella Roaming Client is a lightweight endpoint agent installed on laptops and desktops that enforces Umbrella DNS-layer security even when the user is off the corporate network or VPN. It intercepts DNS queries locally on the endpoint and forwards them to Umbrella's global network, ensuring consistent policy enforcement regardless of location. This makes it the correct component for protecting roaming users.

Answer

Secure Firewall Management Center

Answer

Umbrella Virtual Appliance

Answer

AnyConnect Management VPN Tunnel

Question 15

A user on a corporate laptop is unable to reach a specific SaaS application that is blocked by the Cisco Secure Access SIG. How can you verify the specific rule causing this block?

Accepted Answer

Use the Activity Search tool in the Secure Access dashboard. The Activity Search tool in the Cisco Secure Access dashboard provides detailed logs of all traffic events, including the specific rule that blocked a request. By searching for the user's identity and the destination SaaS application, you can see the exact policy rule that triggered the block. This is the primary troubleshooting tool for verifying policy enforcement in Secure Access.

Answer

Check the firewall NAT table

Answer

Run 'nslookup' on the destination

Answer

Check the local endpoint hosts file

Answer

Review the Umbrella roaming client logs on the device

Question 16

In Cisco Secure Access, you need to configure a Global Policy to block access to specific cloud applications based on risk levels. Where do you define this logic?

Accepted Answer

Policy > Global Policy > Access Rules. In Cisco Secure Access, global policies that block access to cloud applications based on risk levels are defined under Policy > Global Policy > Access Rules (A). This section allows you to create rules that apply to all users and devices, and you can specify conditions such as application risk level.

Answer

Global Settings > Cloud Connectors

Answer

Connectors > Internet Gateway

Answer

Devices > Endpoint Profiles

Question 17

You are troubleshooting an Umbrella SIG tunnel connection. The IPsec tunnel is up, but users report timeouts. What is the most likely cause if the tunnel MTU is not adjusted correctly?

Accepted Answer

MTU mismatch causing packet fragmentation. When an IPsec tunnel's MTU is not adjusted, large packets get encapsulated with additional IPsec headers, exceeding the path MTU and requiring fragmentation. If DF (Don't Fragment) is set and ICMP is blocked, packets are silently dropped, causing the timeouts users report even though the tunnel shows as up.

Answer

DNS resolution failure in the tunnel

Answer

Incorrect IKEv2 Phase 2 proposal

Answer

Missing Proxy PAC file

Question 18

You are deploying Umbrella Virtual Appliances (VAs) in a local Active Directory environment. What is the primary purpose of the VA in this deployment?

Accepted Answer

To provide identity-based reporting for internal clients. The Umbrella Virtual Appliance (VA) is deployed on-premises to forward DNS requests from internal clients to Umbrella's global network while preserving the internal client IP addresses. This allows Umbrella to map DNS queries to specific internal users and devices via Active Directory integration, enabling identity-based policy enforcement and reporting. Without the VA, all internal clients would appear as a single NATed public IP, losing per-user visibility.

Answer

To bypass the ISP DNS settings

Answer

To cache web content locally

Answer

To decrypt HTTPS traffic

Question 19

What is the function of an Umbrella 'Integrations' key?

Accepted Answer

To automate API-based policy and log management. An Umbrella 'Integrations' key (also called an API key) is used to authenticate and authorize API calls that automate policy management, reporting, and log retrieval. It enables programmatic access to Umbrella's Investigate, Reporting, and Enforcement APIs for tasks like adding domains to block lists or pulling security logs.

Answer

To sign digital certificates

Answer

To encrypt DNS queries

Answer

To identify roaming clients

Question 20

Which Cisco Umbrella feature allows you to categorize destinations and apply custom block or allow lists?

Accepted Answer

Destination Lists. Destination Lists in Cisco Umbrella allow administrators to create custom lists of domains, URLs, or IPs that can be allowed or blocked regardless of content category. They are applied within Policy Rules to override default categorization. This is the feature specifically designed for custom block/allow lists.

Answer

Content Categories

Answer

Identity Providers

Answer

Policy Rules