SCAZT Timed Practice Test 3 — 10 Questions

Question 1

Which THREE types of information are analyzed by Cisco Secure Workload (Tetration) to enforce micro-segmentation?

Accepted Answer

User identity context. Cisco Secure Workload (formerly Tetration) enforces micro-segmentation by analyzing rich workload telemetry, and user identity context (B) is correct because it correlates authenticated user and group information (e.g., via AD/LDAP integration) with flows so policies can be scoped to who is communicating, not just IP addresses. Process-level information (C) is correct because Tetration agents collect process and package details (executable names, hashes, parent-child relationships, listening ports) on each workload, enabling policies based on what process is generating or receiving traffic. Network flow telemetry (E) is correct because the platform continuously ingests flow data (5-tuple, ports, protocols, byte counts) from agents and network devices to build the dependency maps and behavioral baselines used for micro-segmentation policy recommendations. The remaining options are not analyzed: the color of the server rack (A) and the user's home address (D) are physical or personal attributes with no bearing on workload communication behavior or segmentation policy.

Answer

The color of the server rack

Answer

User's home address

Question 2

A user is experiencing 'Access Denied' when trying to access a cloud resource. You are using the SecureX 'Pivot' menu to investigate. What are you looking for in the logs?

Accepted Answer

Policy enforcement logs showing a 'Deny' action. When a user gets 'Access Denied' on a cloud resource, the relevant evidence is the policy enforcement decision — a log entry showing a 'Deny' action from the policy engine (e.g., a cloud security policy, conditional access, or firewall rule). Using SecureX Pivot, you correlate the user, resource, and timestamp to find that deny event, which tells you which policy blocked access and why. This is the direct causal evidence for the denial.

Answer

CPU utilization trends

Answer

Successful authentication logs

Answer

Packet drop counters on the switch

Question 3

What is the primary function of the 'Duo Network Gateway'?

Accepted Answer

To provide secure access to on-premises apps without a VPN. The Duo Network Gateway (DNG) is a reverse-proxy appliance deployed on-premises that lets remote users reach internal web applications through Duo's cloud service without requiring a traditional VPN client. It authenticates users via Duo's MFA and then brokers the connection to the internal app, effectively replacing VPN for browser-based access. This is its defining purpose within the Duo Zero Trust portfolio.

Answer

To act as a firewall for the cloud application

Answer

To sync local AD groups to the cloud

Answer

To perform load balancing for the Duo service

Question 4

What is the primary benefit of using 'Parameters' within a SecureX orchestration workflow?

Accepted Answer

Dynamic input at runtime. Parameters in SecureX orchestration are designed to accept values supplied at runtime when a workflow is triggered, enabling the same workflow to be reused with different inputs (e.g., IPs, usernames, ticket IDs) without editing the workflow itself. This makes workflows dynamic and reusable across many scenarios rather than static.

Answer

Defining global constants

Answer

Hardcoding values

Answer

Securing credentials

Question 5

An administrator wants to audit all Duo administrative actions. Which log provides this information?

Accepted Answer

Administrator Actions Log. The Administrator Actions Log in Duo records all administrative actions performed in the Duo Admin Panel, such as user creation, policy changes, and integration modifications. This log is specifically designed for auditing administrative activities. The other logs serve different purposes.

Answer

Authentication Log

Answer

Telephony Log

Answer

Trust Monitor Log

Question 6

Which interface in Cisco SecureX allows users to manually trigger an orchestration workflow?

Accepted Answer

Workflows Tab. The Workflows Tab in Cisco SecureX is the interface where orchestration workflows are listed, created, edited, and manually executed. From this tab, users can select a workflow and trigger it on demand, as well as view its run history and status.

Answer

Settings Tab

Answer

Reporting Tab

Answer

Help Tab

Question 7

Which of the following is a key component of the SecureX 'Dashboard' customization?

Accepted Answer

Adding and configuring Widgets. SecureX dashboards are customized by adding, removing, and arranging widgets — prebuilt or custom tiles that display data from integrated modules and APIs. This is done through the dashboard UI without touching code or backend systems. Widgets can be resized, repositioned, and configured with filters, making them the primary customization unit.

Answer

Modifying the SecureX source code

Answer

Editing the backend SQL database

Answer

Installing custom browser plugins

Answer

Changing the global CSS file

Question 8

Which TWO methods are used to verify compliance against security policies in Cisco Defense Orchestrator?

Accepted Answer

Generating compliance reports on policy configurations. Option A is correct because Cisco Defense Orchestrator (CDO) provides compliance reporting that evaluates managed device configurations against security policies and highlights violations, giving administrators an auditable view of policy adherence. Option B is correct because CDO's 'Check for Changes' feature compares the running configuration against the last-known-good or baseline configuration to detect configuration drift, which is a core mechanism for verifying ongoing compliance. Options C, D, and E are incorrect because rebooting appliances, running traceroutes from endpoints, and manually reconfiguring firewalls are operational or troubleshooting actions that do not verify compliance against security policies in CDO.

Answer

Rebooting all security appliances

Answer

Executing a manual traceroute from every endpoint

Answer

Manually re-configuring the entire firewall

Question 9

You are creating a custom report in SecureX for compliance auditing. You need to include data from both Cisco Secure Endpoint and Cisco Secure Firewall. What is the requirement to make this possible?

Accepted Answer

Both integration modules must be configured and authenticated in SecureX. To include data from both Cisco Secure Endpoint and Cisco Secure Firewall in a SecureX custom report, both integration modules must be configured and authenticated within SecureX. This ensures SecureX can query each product's API and aggregate the data into a unified report.

Answer

The devices must be on the same VLAN

Answer

You must use the CLI to enable the report feature

Answer

They must be in the same physical rack

Question 10

When implementing a Zero Trust architecture, what is the 'Principle of Least Privilege' (PoLP) specifically intended to achieve?

Accepted Answer

Granting only the necessary permissions required for a user to perform their task.. PoLP ensures that users and devices are granted the minimum level of access required to perform their jobs, minimizing the blast radius of a potential breach.

Answer

Allowing open access to all company resources from the office.

Answer

Giving administrative access to all power users.

Answer

Automating the password rotation process.