SCAZT Timed Practice Test 1 — 10 Questions

Question 1

Which THREE types of information are typically displayed in the Cisco Umbrella 'App Discovery' report?

Accepted Answer

Risk Score. The Cisco Umbrella App Discovery report is designed to give visibility into the SaaS and cloud applications in use across the environment, and it surfaces three key data points per application: the Application Name (C), which identifies the discovered app; the Traffic Volume (D), which shows how much bandwidth or request activity that app generates; and the Risk Score (A), which rates the app's security/privacy risk based on Cisco's Cloudlock/Umbrella intelligence. These three fields let administrators quickly triage shadow IT by knowing what the app is, how much it is used, and how risky it is. The other options do not belong: a User's home address (B) is personal data never shown in this report, and an Application's source code (E) is proprietary code that Umbrella has no access to and does not display.

Answer

User's home address

Answer

Application's source code

Question 2

What is the main advantage of using a Secure Internet Gateway (SIG) over a traditional on-premises firewall?

Accepted Answer

Consistent protection for off-network users. A SIG provides security for users regardless of their location, unlike an on-premises firewall which only protects the office network.

Answer

Lower bandwidth costs

Answer

Faster internal LAN speed

Answer

Elimination of the need for DNS

Question 3

You notice an employee is accessing a cloud app that is not approved by IT. Which Umbrella feature allows you to see this activity?

Accepted Answer

App Discovery. App Discovery in Cisco Umbrella provides visibility into all cloud applications being accessed by users on the network, including those not sanctioned by IT. It uses DNS traffic analysis to identify and categorize thousands of SaaS applications, highlighting shadow IT. This feature allows administrators to see which unapproved apps are in use, assess risk, and take action. Thus, App Discovery directly answers the need to see the employee's activity.

Answer

Activity Search

Answer

DNS Policy

Answer

SSL Inspection

Question 4

A user is prompted for MFA but their phone is dead. Which administrative feature allows for a temporary bypass?

Accepted Answer

Issue a temporary bypass code in the Duo Admin Panel. The Duo Admin Panel allows administrators to generate a temporary bypass code for a specific user, which the user can enter in place of the normal MFA push or passcode. This is the designed administrative mechanism for scenarios like a lost or dead phone, and the code can be set with an expiration and usage limit.

Answer

Disable the user's account in Active Directory

Answer

Enable the 'Remembered Device' setting

Answer

Reset the user's password

Question 5

You are troubleshooting a scenario where users are unable to access a specific internal cloud resource after migrating to Cisco Secure Access. The traffic is being blocked by a default policy. How should you modify the traffic flow to ensure internal traffic stays off the SIG?

Accepted Answer

Configure a Tunnel Exclusion in the Secure Access tunnel settings for the internal IP ranges.. Tunnel Exclusions in Cisco Secure Access allow administrators to define internal IP ranges (and domains) that should bypass the SIG tunnel entirely, so traffic to those destinations is routed natively rather than being inspected and blocked by the default policy. This is the correct way to keep internal/private traffic off the Secure Access cloud when users are remote or on-network. Configuring the exclusion ensures the internal resource is reachable without being subjected to cloud web filtering.

Answer

Disable the 'Inspect Traffic' setting globally in the Secure Access dashboard.

Answer

Update the DNS policy to include internal domain suffixes as exceptions.

Answer

Assign the users to a separate Group Policy that has no web filtering enabled.

Question 6

You want to ensure that users are warned before visiting a newly registered domain. Which feature in Cisco Umbrella handles this?

Accepted Answer

Security Settings. In Cisco Umbrella, the Security Settings section includes a feature called 'Newly Seen Domains' that allows you to block or warn users about domains that have been recently registered or observed. When enabled, Umbrella displays a warning page before allowing access, helping to prevent phishing and malware attacks that often use newly registered domains. This is a core part of Umbrella's DNS-layer security and is configured under Security Settings, not under application or category-based policies.

Answer

Application Settings

Answer

Platform Logs

Answer

Web Policy Categories

Question 7

Which of the following is a requirement for using the Duo 'Remembered Devices' feature?

Accepted Answer

The user's browser must accept cookies from the Duo domain. Duo's 'Remembered Devices' feature works by placing a cookie in the user's browser after they complete authentication and choose to remember the device. On subsequent logins, Duo reads that cookie to recognize the device and skip the second factor (within the configured expiration). Therefore the browser must accept cookies from the Duo domain for the feature to function.

Answer

The user must be on the corporate network

Answer

The user must have a registered hardware token

Answer

The endpoint must be joined to a domain

Question 8

Which capability is provided by the Cisco Umbrella 'Reporting' tab?

Accepted Answer

Visibility into blocked domains and security categories. The Cisco Umbrella Reporting tab provides visibility into security activity, including which domains were blocked, the security categories that triggered the block, and the identities or locations involved. This is the primary place to investigate user activity and verify that policies are working as intended.

Answer

Configuration of VPN tunnels

Answer

Automated remediation of endpoint viruses

Answer

Real-time packet inspection of encrypted traffic

Question 9

When troubleshooting DNS queries in Umbrella, which command is most useful on a local machine to see if it is using the Umbrella resolvers?

Accepted Answer

nslookup debug.opendns.com. Running 'nslookup debug.opendns.com' confirms if the query is being answered by the Umbrella infrastructure.

Answer

ping 8.8.8.8

Answer

ipconfig /flushdns

Answer

tracert 208.67.222.222

Question 10

When monitoring compliance in Cisco Defense Orchestrator (CDO), which action should you perform to identify out-of-sync configurations across your Cisco ASA and Firepower Threat Defense devices?

Accepted Answer

Perform a 'Check for Changes' operation. In Cisco Defense Orchestrator (CDO), the 'Check for Changes' operation compares the running configuration on a managed device against the last-known or intended configuration stored in CDO. It surfaces out-of-sync devices — those whose configs drifted due to manual CLI edits or failed deployments — so you can review and remediate. This is the native CDO mechanism for configuration compliance and drift detection across ASA and FTD fleets.

Answer

Run a packet capture on the ASA interface

Answer

Generate a Compliance Report in SecureX

Answer

Reset the device credentials