SCAZT Network And Cloud Security Practice Test 3 — 15 Questions

Question 1

When using Umbrella's 'Selective Proxy', how is the determination made to route traffic through the proxy vs. direct to destination?

Accepted Answer

Based on the domain categorization. The Selective Proxy uses a list of domains (like those known to host malware) to decide whether to route traffic through the proxy for deep inspection.

Answer

Based on the packet source IP

Answer

Based on the browser type

Answer

Based on the time of day

Question 2

Where do you manage the Umbrella Roaming Client deployment configuration?

Accepted Answer

Dashboard > Deployments. The Umbrella Roaming Client deployment configuration is managed from Dashboard > Deployments. This section is where administrators download the roaming client installer, generate the associated deployment tokens/keys, and configure the identity and profile settings that the client will use when it registers with Umbrella. It is the dedicated console area for distributing and managing endpoint client rollouts.

Answer

Dashboard > Reporting

Answer

Dashboard > Policies

Answer

Dashboard > Settings > API

Question 3

You are integrating Cisco Secure Access with an IdP. What protocol is used to facilitate this authentication?

Accepted Answer

SAML 2.0. SAML (Security Assertion Markup Language) is the standard protocol used by Cisco Secure Access for cloud-based identity federation.

Answer

LDAP

Answer

SNMP

Answer

ICMP

Question 4

What is the purpose of 'Internal Networks' in the Umbrella dashboard?

Accepted Answer

To identify traffic from specific office locations. In the Umbrella dashboard, 'Internal Networks' are used to identify traffic originating from specific office locations or internal network ranges. By defining internal networks, administrators can apply different policies to traffic based on its source, such as allowing or blocking certain categories for users on the corporate network versus remote users. This helps in distinguishing internal traffic from external or guest traffic.

Answer

To cache internal traffic

Answer

To define user groups

Answer

To segment internal VLANs

Question 5

You have a branch office with a static IP. You want to secure it without a local virtual appliance. What is the best method?

Accepted Answer

Use an IP-based Network Identity. Configuring network identity in Umbrella by defining the public IP (Network Identity) allows the gateway to associate traffic with your organization without a tunnel or VA.

Answer

Use a PAC file

Answer

Use DNS-over-HTTPS

Answer

Use the Umbrella Roaming Client

Question 6

In Secure Access, how are 'Traffic Forwarding' profiles used?

Accepted Answer

To define how traffic is routed to the cloud gateway. Traffic Forwarding profiles define which traffic (web, non-web, specific ports) should be sent to the Secure Access cloud.

Answer

To set up load balancing

Answer

To encrypt cloud storage

Answer

To define user roles

Question 7

What is the role of a 'Policy' in Cisco Umbrella?

Accepted Answer

To define security and filtering rules for identities. In Cisco Umbrella, a Policy is the construct that defines the security and filtering rules applied to a given identity (users, groups, networks, or roaming computers). Policies determine which categories, domains, and security threat types are allowed or blocked, and they are the core mechanism for enforcing acceptable-use and protection requirements.

Answer

To configure hardware settings

Answer

To monitor bandwidth usage

Answer

To manage API credentials

Question 8

Which component is required to enable Active Directory integration with Umbrella for user-level reporting?

Accepted Answer

Umbrella AD Connector. The Umbrella AD Connector is a lightweight Windows service that synchronizes user and group information from on-premises Active Directory to the Umbrella dashboard. It enables user-level reporting by mapping internal IP addresses to AD user identities, which is essential for granular visibility and policy enforcement. Without the AD Connector, Umbrella can only report on network-level data, not per-user activity.

Answer

SAML Provider

Answer

Virtual Appliance

Answer

AnyConnect Agent

Answer

Cisco Secure Firewall

Question 9

When troubleshooting DNS queries in Umbrella, which command is most useful on a local machine to see if it is using the Umbrella resolvers?

Accepted Answer

nslookup debug.opendns.com. Running 'nslookup debug.opendns.com' confirms if the query is being answered by the Umbrella infrastructure.

Answer

ping 8.8.8.8

Answer

ipconfig /flushdns

Answer

tracert 208.67.222.222

Question 10

Which method is the most secure way to authenticate users for Cisco Secure Access?

Accepted Answer

SAML 2.0 integration with an IdP. SAML 2.0 integration with an external Identity Provider (IdP) is the most secure authentication method for Cisco Secure Access because it enables federated SSO, centralized credential management, and support for MFA and conditional access policies. Credentials are never stored in Secure Access itself, reducing the attack surface. This aligns with zero-trust principles and is Cisco's recommended approach.

Answer

Local user accounts

Answer

Using the default admin account

Answer

Static IP-based authentication

Question 11

A user is experiencing 'SSL Certificate Mismatch' errors. You suspect it is caused by the Umbrella proxy. How do you resolve this permanently?

Accepted Answer

Install the Umbrella Root CA certificate on the endpoint. The 'SSL Certificate Mismatch' error occurs because the Umbrella proxy intercepts SSL traffic and presents its own certificate, which the endpoint does not trust. Installing the Umbrella Root CA certificate on the endpoint allows the endpoint to trust the proxy's certificate, resolving the mismatch permanently.

Answer

Disable SSL decryption in the policy

Answer

Update the browser

Answer

Add the domain to the 'Always Allow' list

Question 12

Which TWO of the following are primary benefits of Cisco Umbrella DNS-layer security?

Accepted Answer

Uses a cloud-native architecture. Option B is correct because Cisco Umbrella is built on a cloud-native architecture, meaning its DNS resolution and security enforcement are delivered from globally distributed cloud infrastructure rather than on-premises hardware, so protection follows users wherever they connect. Option E is correct because Umbrella inspects DNS queries and blocks malicious domains at the DNS layer, preventing the connection from ever being established to the attacker's infrastructure, which stops threats earlier than post-connection inspection. Option A is incorrect because Umbrella does not require manual firewall updates; policy is managed centrally in the cloud dashboard. Option C is incorrect because Umbrella is a cloud-delivered service and does not need a physical appliance at each site. Option D is incorrect because Umbrella can protect roaming users and unmanaged or BYOD devices via DNS settings or the roaming client, not only corporate-managed endpoints.

Answer

Requires manual firewall updates

Answer

Requires a physical appliance at every site

Answer

Only works on corporate-managed devices

Question 13

You want to restrict access to specific cloud apps (e.g., Dropbox). Which Umbrella feature is used?

Accepted Answer

Application Control. Application Control allows administrators to discover and block access to specific cloud applications.

Answer

Content Categories

Answer

Firewall Rules

Answer

URL Filtering

Question 14

What does the 'Umbrella dashboard' allow you to do regarding DNS security?

Accepted Answer

Configure global security policies and view reports. The Umbrella dashboard is the central management interface for configuring global security policies, viewing reports, and managing all aspects of DNS security. It allows administrators to set block lists, allow lists, and custom policies that apply across the organization. Additionally, it provides detailed reporting and analytics on DNS requests and security events.

Answer

Provision new ISP links

Answer

Manage local server hardware

Answer

Flash router firmware

Question 15

When migrating from an explicit proxy to the Umbrella SIG, what is the primary challenge for legacy applications?

Accepted Answer

Hardcoded proxy configurations may break. Legacy applications often have hardcoded proxy settings or require specific authentication methods that may not be supported by the cloud SIG.

Answer

The OS must be upgraded

Answer

The local DNS server will fail

Answer

The bandwidth requirement increases