SCAZT Network And Cloud Security Practice Test 4 — 15 Questions

Question 1

Which TWO methods can be used to identify internal clients in Cisco Umbrella reports?

Accepted Answer

Umbrella Virtual Appliance (VA). Option A, the Umbrella Virtual Appliance (VA), is correct because it is deployed on-premises and forwards DNS requests to Umbrella while embedding the internal client's IP address in the request metadata, allowing Umbrella to attribute activity to specific internal endpoints in reports. Option C, the Umbrella Roaming Client, is correct because it runs on individual endpoints and tags DNS queries with a device identifier and internal identity, so Umbrella can report on that specific client even when it is off-network. Option B, DHCP relay settings, is not a supported Umbrella client-identification method; DHCP relay is used for IP address assignment, not for tagging DNS traffic to Umbrella. Option D, the public IP address of the ISP, only identifies the network's egress point, not individual internal clients, so it cannot distinguish internal users in reports. Option E, DNS-over-HTTPS, is an encrypted DNS transport protocol and does not by itself provide Umbrella with internal client identity for reporting.

Answer

DHCP relay settings

Answer

Public IP address of the ISP

Answer

DNS-over-HTTPS

Question 2

Which TWO features are part of the Cisco Secure Access suite for remote users?

Accepted Answer

Zero Trust Network Access (ZTNA). Option B, Zero Trust Network Access (ZTNA), is correct because Cisco Secure Access is a cloud-delivered security service edge (SSE) platform that includes ZTNA to provide identity- and context-based, least-privilege access to private applications for remote users without exposing them to the network. Option D, Secure Web Gateway (SWG), is correct because SWG is another core pillar of the Cisco Secure Access suite, filtering web traffic, enforcing acceptable-use and URL/content policies, and blocking malicious sites for remote users. The remaining options do not belong: A (Physical Router Management) and C (Wireless Controller provisioning) are on-premises network device administration functions unrelated to the Secure Access SSE suite, and E (Local DHCP Server) is a LAN IP-address assignment service, not a remote-user security feature.

Answer

Physical Router Management

Answer

Wireless Controller provisioning

Answer

Local DHCP Server

Question 3

Which THREE factors are evaluated by the Umbrella policy engine when processing a DNS request?

Accepted Answer

The time of the request. The Umbrella policy engine evaluates the time of the request (C) because policies can be scheduled to apply only during specific hours or days, so the timestamp of the DNS query is a factor in determining which policy applies. It evaluates the identity of the user or device (D) because Umbrella ties DNS requests to identities via the Roaming Client, AD Connector, or Virtual Appliance, allowing different policies per user, group, or device. It evaluates the destination of the request (E) because the requested domain is categorized (e.g., malware, phishing, or content categories) and matched against block/allow lists to decide the verdict. The local browser version (A) is not evaluated, since Umbrella operates at the DNS layer and does not inspect browser software. The color of the hardware (B) is irrelevant, as physical appearance has no bearing on DNS policy decisions.

Answer

The local browser version

Answer

The color of the hardware

Question 4

Which TWO logging methods can be used to export Umbrella logs for SIEM analysis?

Accepted Answer

Direct API integration for SIEM. Option A is correct because Cisco Umbrella provides a Reporting API that SIEM platforms can query directly to pull DNS, proxy, and firewall logs for correlation and analysis. Option B is correct because Umbrella supports exporting logs to an Amazon S3 bucket, which SIEM tools can then ingest for long-term storage and analysis. Option C is incorrect because logging to a local printer is not a supported Umbrella export method and has no relevance to SIEM ingestion. Option D is incorrect because sending logs via email is not an Umbrella log-export mechanism for SIEM integration. Option E is incorrect because local disk logging on the user endpoint is not how Umbrella exports its cloud logs for SIEM analysis.

Answer

Logging to the local printer

Answer

Sending logs via email

Answer

Local disk logging on the user endpoint

Question 5

Which THREE types of traffic are typically protected by a SIG?

Accepted Answer

DNS queries. A Secure Internet Gateway (SIG) is a cloud-delivered security service that inspects and filters traffic destined for the internet, so the three correct answers are the traffic types that actually traverse it. Option B (DNS queries) is correct because SIGs typically include DNS-layer security that resolves and blocks malicious domains before a connection is made. Option D (HTTP/HTTPS web traffic) is correct because SIGs perform web filtering, TLS inspection, and malware scanning on web requests, which is their core function. Option E (non-web traffic such as FTP and SSH via tunnels) is correct because SIGs also inspect non-web protocols and tunneled traffic through CASB/firewall capabilities to enforce policy and detect threats. Option A (internal VoIP phone calls) is not correct because internal voice traffic stays on the LAN and does not egress to the internet through a SIG. Option C (local printer traffic) is not correct because local printing is on-premises traffic that never reaches the SIG.

Answer

Internal VoIP phone calls

Answer

Local printer traffic

Question 6

Which THREE pieces of information are displayed in the Umbrella 'Activity Search' report?

Accepted Answer

Identity that initiated the request. Option A is correct because the Umbrella Activity Search report shows the identity (the user or internal IP/identity) that initiated the DNS request, allowing admins to attribute traffic to a specific person or device. Option B is correct because the report displays the action taken on each request, such as Allowed or Blocked, based on the applied security policy. Option E is correct because each entry includes a timestamp showing when the request occurred, which is essential for chronological investigation and correlation with other logs. Option C is not included because the report concerns DNS/web request metadata, not endpoint hardware details like a hard drive serial number. Option D is not included because passwords are never displayed in reporting; Umbrella logs authentication identities, not credentials.

Answer

Internal hard drive serial number

Answer

User's password

Question 7

Which THREE components are critical for a successful cloud network segmentation strategy?

Accepted Answer

Access Rules controlling cross-segment traffic. Access Rules controlling cross-segment traffic (A) are critical because segmentation only delivers security value when explicit allow/deny rules govern traffic between segments, enforcing least privilege and limiting lateral movement. Clearly defined Resource Segments (B) are essential because you must logically group workloads, subnets, or services into distinct zones (for example by VPC, subnet, or security group) before any policy can be applied to them. Defined User Identity Groups (D) matter because segmentation policies must map to who or what is accessing resources, using IAM roles, groups, or directory identities so that rules are tied to authenticated principals rather than anonymous access. A flat network architecture (C) is not correct because a flat network with no internal boundaries is the opposite of segmentation and enables unrestricted lateral movement. Shared administrative credentials (E) are not correct because shared credentials eliminate accountability and violate least-privilege identity practices, undermining rather than supporting a segmentation strategy.

Answer

A flat network architecture

Answer

Shared administrative credentials

Question 8

Which TWO conditions must be met for a user to be effectively managed by the Umbrella Roaming Client?

Accepted Answer

The organization's policy must be configured in the dashboard. Option A is correct because the Umbrella Roaming Client only enforces protection when the organization's policy has been configured in the Umbrella dashboard; without an assigned policy the client has no rules to apply. Option B is correct because the roaming client software itself must be installed on the device for that device to be managed by Umbrella at all. Option C is incorrect because the roaming client is specifically designed to protect users off the local LAN, so being on the LAN is not a requirement. Option D is incorrect because the client runs as a service and does not require the user to be logged in as an administrator. Option E is incorrect because the roaming client is intended for endpoints such as laptops and workstations, not servers.

Answer

The device must be on the local LAN

Answer

The user must be logged in as an administrator

Answer

The device must be a server

Question 9

Which TWO pieces of information are required for a 'Network Identity' in Umbrella?

Accepted Answer

A friendly name for the location. A network identity is defined by the public IP address and a descriptive name to identify the location in reports.

Answer

The internal DHCP server IP

Answer

The local VLAN ID

Answer

The ISP account number

Question 10

Which THREE items are necessary for troubleshooting a failed 'Umbrella AD Connector' sync?

Accepted Answer

Logs located on the server running the connector. Option A is correct because the Umbrella AD Connector writes diagnostic logs on the server hosting the connector (e.g., C:\Program Files (x86)\Cisco\Umbrella AD Connector\logs), and these logs reveal sync failures, authentication errors, and LDAP query issues. Option B is correct because the connector runs under a designated service account whose permissions must allow reading the required Active Directory objects (users, groups, OUs); insufficient rights cause sync failures. Option D is correct because the AD Connector must reach a Domain Controller over LDAP/LDAPS (TCP 389/636) to perform directory queries, so DC accessibility and network connectivity are essential to a successful sync. Option C is incorrect because the physical motherboard model is irrelevant to connector synchronization. Option E is incorrect because local printer drivers have no bearing on AD Connector operations or directory synchronization.

Answer

The physical server motherboard model

Answer

The local printer driver version

Question 11

You are implementing Cisco Secure Access and need to configure a Global Policy that restricts access to unsanctioned SaaS applications based on their risk score. Where should this policy be applied in the Secure Access dashboard?

Accepted Answer

Under Policy > Access Policies > Web Policy > CASB. In Cisco Secure Access, policies that restrict access to SaaS applications based on risk score are CASB (Cloud Access Security Broker) policies, and they are configured under Policy > Access Policies > Web Policy > CASB. This is where you define rules that evaluate SaaS app risk scores and enforce block or allow actions for unsanctioned applications.

Answer

Under Policy > Network Policies > DNS Policy

Answer

Under Settings > Device Management > SaaS Controls

Answer

Under Connect > Network > Cloud Firewalls

Question 12

An organization is migrating to a Secure Internet Gateway (SIG) architecture. They currently have an on-premises firewall blocking all traffic except for specific ports. What is the recommended method to forward traffic to the SIG while maintaining existing security policy consistency?

Accepted Answer

Configure an IPsec tunnel from the firewall to the Cisco SIG headend.. Using an IPsec tunnel ensures that the traffic is encrypted and consistently tagged for the SIG to apply the appropriate security policies.

Answer

Configure port forwarding for all traffic on the firewall to an external DNS proxy.

Answer

Disable the existing firewall to prevent conflicts with the SIG cloud services.

Answer

Replace the existing firewall with an Umbrella Roaming Client.

Question 13

You are troubleshooting a scenario where users are unable to access a specific internal cloud resource after migrating to Cisco Secure Access. The traffic is being blocked by a default policy. How should you modify the traffic flow to ensure internal traffic stays off the SIG?

Accepted Answer

Configure a Tunnel Exclusion in the Secure Access tunnel settings for the internal IP ranges.. Tunnel Exclusions in Cisco Secure Access allow administrators to define internal IP ranges (and domains) that should bypass the SIG tunnel entirely, so traffic to those destinations is routed natively rather than being inspected and blocked by the default policy. This is the correct way to keep internal/private traffic off the Secure Access cloud when users are remote or on-network. Configuring the exclusion ensures the internal resource is reachable without being subjected to cloud web filtering.

Answer

Disable the 'Inspect Traffic' setting globally in the Secure Access dashboard.

Answer

Update the DNS policy to include internal domain suffixes as exceptions.

Answer

Assign the users to a separate Group Policy that has no web filtering enabled.

Question 14

Which Cisco Umbrella report provides the most granular visibility into the specific security categories triggered by user traffic?

Accepted Answer

Activity Search Report. The Activity Search Report in Cisco Umbrella provides the most granular, per-request visibility into user traffic, including the specific security categories triggered, the identity of the user or device, the destination, and the action taken. It lets administrators search and filter individual DNS and proxy events, making it the go-to report for drilling into exactly which category a request matched.

Answer

Total Requests Report

Answer

Security Overview Report

Answer

Destination List Report

Question 15

Which TWO settings must be correctly configured to ensure that Cisco Secure Access provides effective decryption and inspection of HTTPS traffic?

Accepted Answer

Install the Cisco Secure Access Root Certificate on all client devices.. Option B is correct because Cisco Secure Access performs TLS/SSL interception by acting as a man-in-the-middle, re-signing HTTPS sessions with its own certificate; for clients to trust those re-signed certificates without errors, the Cisco Secure Access Root Certificate must be installed in each device's trust store. Option C is correct because decryption and inspection are policy-driven: the SSL Inspection setting must be enabled in the relevant Web Policy rules so that Secure Access actually decrypts and inspects HTTPS flows rather than merely passing them through. Option A is incorrect because pointing DNS to the ISP's resolver has no bearing on TLS decryption and would bypass Secure Access's DNS-layer security. Option D is incorrect because disabling local firewall rules is unnecessary and weakens endpoint security without enabling HTTPS inspection. Option E is incorrect because manually configuring a browser proxy IP is not how Secure Access decrypts traffic and would not by itself provide certificate trust or SSL inspection policy.

Answer

Set the DNS server to the ISP's DNS resolver.

Answer

Disable all firewall rules on the local machine.

Answer

Configure the browser to use a specific proxy server IP.