SCAZT Network And Cloud Security Practice Test 2 — 15 Questions

Question 1

In Cisco Secure Access, you need to configure a Global Policy to block access to specific cloud applications based on risk levels. Where do you define this logic?

Accepted Answer

Policy > Global Policy > Access Rules. In Cisco Secure Access, global policies that block access to cloud applications based on risk levels are defined under Policy > Global Policy > Access Rules (A). This section allows you to create rules that apply to all users and devices, and you can specify conditions such as application risk level.

Answer

Global Settings > Cloud Connectors

Answer

Connectors > Internet Gateway

Answer

Devices > Endpoint Profiles

Question 2

You are troubleshooting an Umbrella SIG tunnel connection. The IPsec tunnel is up, but users report timeouts. What is the most likely cause if the tunnel MTU is not adjusted correctly?

Accepted Answer

MTU mismatch causing packet fragmentation. When an IPsec tunnel's MTU is not adjusted, large packets get encapsulated with additional IPsec headers, exceeding the path MTU and requiring fragmentation. If DF (Don't Fragment) is set and ICMP is blocked, packets are silently dropped, causing the timeouts users report even though the tunnel shows as up.

Answer

DNS resolution failure in the tunnel

Answer

Incorrect IKEv2 Phase 2 proposal

Answer

Missing Proxy PAC file

Question 3

You are deploying Umbrella Virtual Appliances (VAs) in a local Active Directory environment. What is the primary purpose of the VA in this deployment?

Accepted Answer

To provide identity-based reporting for internal clients. The Umbrella Virtual Appliance (VA) is deployed on-premises to forward DNS requests from internal clients to Umbrella's global network while preserving the internal client IP addresses. This allows Umbrella to map DNS queries to specific internal users and devices via Active Directory integration, enabling identity-based policy enforcement and reporting. Without the VA, all internal clients would appear as a single NATed public IP, losing per-user visibility.

Answer

To bypass the ISP DNS settings

Answer

To cache web content locally

Answer

To decrypt HTTPS traffic

Question 4

What is the function of an Umbrella 'Integrations' key?

Accepted Answer

To automate API-based policy and log management. An Umbrella 'Integrations' key (also called an API key) is used to authenticate and authorize API calls that automate policy management, reporting, and log retrieval. It enables programmatic access to Umbrella's Investigate, Reporting, and Enforcement APIs for tasks like adding domains to block lists or pulling security logs.

Answer

To sign digital certificates

Answer

To encrypt DNS queries

Answer

To identify roaming clients

Question 5

Which Cisco Umbrella feature allows you to categorize destinations and apply custom block or allow lists?

Accepted Answer

Destination Lists. Destination Lists in Cisco Umbrella allow administrators to create custom lists of domains, URLs, or IPs that can be allowed or blocked regardless of content category. They are applied within Policy Rules to override default categorization. This is the feature specifically designed for custom block/allow lists.

Answer

Content Categories

Answer

Identity Providers

Answer

Policy Rules

Question 6

Which report in Cisco Umbrella provides the most direct view of security threats identified in your environment?

Accepted Answer

Security Activity. The Security Activity report details all blocked threats, including malware, phishing, and command-and-control attempts.

Answer

Top Identities

Answer

Application Usage

Answer

Web Activity

Question 7

You are analyzing a 'Domain Blocked' event in Umbrella. The explanation says 'Proxy'. What does this imply?

Accepted Answer

The traffic was caught by the selective proxy. In Umbrella, a 'Domain Blocked' event with the explanation 'Proxy' indicates that the traffic was blocked by the selective proxy, which is used for URL filtering and SSL inspection. This means the block occurred at the proxy layer, not at the DNS layer. The selective proxy inspects HTTP/HTTPS requests and applies policies based on URL, category, or other attributes.

Answer

The user is not authenticated

Answer

The request was blocked by the firewall

Answer

The domain was blocked by the DNS resolver

Question 8

When deploying the Cisco Secure Access AnyConnect module, what is the primary role of the Umbrella DNS module within it?

Accepted Answer

To intercept and secure DNS queries. The Umbrella DNS module inside AnyConnect intercepts DNS queries and sends them to Umbrella resolvers for security filtering.

Answer

To manage local network segmentation

Answer

To authenticate users to the cloud

Answer

To encrypt traffic payloads

Question 9

You are setting up cloud network segmentation. In the context of Secure Access, how are groups of resources isolated from each other?

Accepted Answer

By using Access Rules and Policies. Security Policies and Access Rules are used to control traffic flows between segments in the cloud environment.

Answer

By assigning different DNS suffixes

Answer

By physical VLANs

Answer

By physical cable separation

Question 10

You want to ensure that users are warned before visiting a newly registered domain. Which feature in Cisco Umbrella handles this?

Accepted Answer

Security Settings. In Cisco Umbrella, the Security Settings section includes a feature called 'Newly Seen Domains' that allows you to block or warn users about domains that have been recently registered or observed. When enabled, Umbrella displays a warning page before allowing access, helping to prevent phishing and malware attacks that often use newly registered domains. This is a core part of Umbrella's DNS-layer security and is configured under Security Settings, not under application or category-based policies.

Answer

Application Settings

Answer

Platform Logs

Answer

Web Policy Categories

Question 11

Which component is required to allow Umbrella to perform SSL decryption on web traffic?

Accepted Answer

Deployment of the Umbrella Root CA. To perform SSL decryption, the Umbrella Root CA certificate must be installed on all client endpoints to prevent browser certificate warnings.

Answer

DNS-over-HTTPS setup

Answer

VPN client configuration

Answer

Public IP whitelisting

Question 12

What is the main advantage of using a Secure Internet Gateway (SIG) over a traditional on-premises firewall?

Accepted Answer

Consistent protection for off-network users. A SIG provides security for users regardless of their location, unlike an on-premises firewall which only protects the office network.

Answer

Lower bandwidth costs

Answer

Faster internal LAN speed

Answer

Elimination of the need for DNS

Question 13

What is the primary benefit of the Cisco Umbrella 'Global Network' architecture?

Accepted Answer

It provides low-latency connectivity via Anycast. Cisco Umbrella's Global Network is built on a globally distributed Anycast DNS infrastructure. Anycast allows the same IP address to be advertised from multiple points of presence (PoPs) worldwide, so a user's DNS query is automatically routed to the nearest available PoP. This minimizes latency and ensures fast, reliable resolution and enforcement of security policies without backhauling traffic to a central data center.

Answer

It acts as an ISP replacement

Answer

It eliminates the need for bandwidth

Answer

It automatically updates the OS

Question 14

You notice that some of your users are bypassing the Umbrella SIG by using a personal VPN. What is the most effective way to prevent this with Cisco products?

Accepted Answer

Block 'Proxy and Filter Avoidance' categories in the Web Policy. Umbrella's Web Policy includes a 'Proxy and Filter Avoidance' category that blocks known VPN, proxy, and anonymizer services used to circumvent DNS-layer and SIG filtering. Blocking that category prevents users from reaching the very tools (personal VPNs, Tor, web proxies) that would let them bypass Umbrella. This is the native, scalable control within the Umbrella platform itself.

Answer

Install a local firewall on all machines

Answer

Set the TTL on DNS queries to 0

Answer

Disable the user's internet

Question 15

You are seeing 'SSL Inspection Error' in your logs. What is the most likely cause?

Accepted Answer

The Umbrella Root CA is not trusted on the client. SSL inspection errors typically occur when the client cannot validate the certificate presented by the proxy, often due to the missing Root CA.

Answer

The destination server is down

Answer

The policy is set to 'Allow'

Answer

The tunnel is disconnected