SCAZT User And Device Security — 15 Questions

Question 1

A user is attempting to access a cloud application protected by Duo SSO. The Duo prompt shows 'Access Denied: Your device is not running a supported browser'. Where is this restriction defined?

Accepted Answer

In the Duo Application configuration under 'Browser Restrictions'. Browser restrictions are defined within the Duo Policy applied to the specific application or user group.

Answer

In the Active Directory GPO for the user

Answer

In the Duo Authentication Proxy configuration file

Answer

In the local browser settings of the client machine

Question 2

A user's device is marked as 'Out-of-Date' in Duo. How does the system determine this status?

Accepted Answer

By the Duo Device Health application reporting the OS version to the Duo Cloud. The Duo Device Health application collects system information and compares the OS version against the policy defined in the Duo Admin Panel.

Answer

By analyzing the user's browser user-agent string

Answer

By querying the Active Directory server for the last patch date

Answer

By checking the device's public IP address geolocation

Question 3

You are implementing Cisco Duo Device Health for a Windows fleet. Users report that they are blocked from accessing cloud apps despite having valid credentials. The Duo Health app reports a missing OS security patch. Which component is responsible for enforcing this posture check during the authentication flow?

Accepted Answer

Duo Access Policy. The Duo Central/Duo Access Gateway (DAG) or Duo SSO evaluate the health status passed by the Duo Device Health application before granting access.

Answer

Microsoft Conditional Access Policy

Answer

Duo Authentication Proxy

Answer

Duo Device Health Application

Question 4

Which Duo feature allows an administrator to visualize the percentage of users who have successfully registered their mobile devices?

Accepted Answer

Duo Dashboard. The Duo Admin Panel Dashboard provides analytics and reporting on enrollment progress.

Answer

Duo Authentication Log

Answer

Duo Policy Editor

Answer

Duo Trust Monitor

Question 5

An administrator needs to ensure that only managed devices can access SaaS applications via Cisco Duo. Which configuration step is mandatory in the Duo Admin Panel to ensure the device is recognized as 'Managed'?

Accepted Answer

Enable 'Require Device Health' in the application policy and ensure the Duo Device Health application is installed. To identify a device as managed, the administrator must deploy the Duo Device Health application and ensure the device certificate is present.

Answer

Configure the Duo Authentication Proxy for RADIUS bypass

Answer

Enable 'Trusted Endpoints' in the Duo Admin panel without certificate deployment

Answer

Assign a static IP address to every endpoint

Question 6

You are deploying Duo Passwordless authentication. Which factor must be verified on the endpoint before a user can successfully authenticate?

Accepted Answer

The endpoint must have an active WebAuthn-compliant platform authenticator. Duo Passwordless requires WebAuthn-compatible platforms (like macOS TouchID or Windows Hello) to store the cryptographic keys.

Answer

The user must be connected to the corporate VPN

Answer

The endpoint must have a Cisco AnyConnect client installed

Answer

The endpoint must have the Duo Authentication Proxy installed

Question 7

An organization uses Duo Access Gateway (DAG) to protect on-premises applications. They want to transition to Duo SSO. What is the primary difference in architecture?

Accepted Answer

Duo SSO eliminates the need for on-premises server infrastructure for the identity provider. Duo SSO is a cloud-native IDP, whereas DAG acts as a local proxy requiring on-premises server infrastructure.

Answer

Duo SSO supports only SAML 1.0 protocols

Answer

Duo SSO requires a dedicated hardware appliance

Answer

Duo SSO requires the installation of the Duo Authentication Proxy on a local server

Question 8

A security engineer is configuring Duo Authentication for Microsoft 365. The organization requires that users must be prompted for MFA only when accessing cloud resources from outside the corporate network. Which configuration setting in the Duo Admin Panel achieves this?

Accepted Answer

Configure a New Authentication Policy with 'Authorized Networks' set to the corporate office IP range. Duo Network Policies allow for location-based access control, permitting bypass or mandatory MFA based on IP ranges.

Answer

Enable 'Duo Device Health' on the Microsoft 365 application object

Answer

Set the global MFA mode to 'Bypass' in the Duo Application settings

Answer

Apply a 'Remembered Device' setting of 30 days to the entire group

Question 9

Which of the following is a requirement for using the Duo 'Remembered Devices' feature?

Accepted Answer

The user's browser must accept cookies from the Duo domain. Remembered Devices works by setting a cookie in the user's browser, which requires the browser to accept cookies from the Duo domain.

Answer

The user must be on the corporate network

Answer

The user must have a registered hardware token

Answer

The endpoint must be joined to a domain

Question 10

What is the primary benefit of the Duo Universal Prompt compared to the traditional iframe-based prompt?

Accepted Answer

It is a hosted redirect that provides a more secure and consistent experience. The Universal Prompt is a modern, hosted redirect that improves security and provides a consistent interface across all applications.

Answer

It supports offline authentication only

Answer

It removes the need for mobile devices

Answer

It requires less bandwidth

Question 11

When configuring Duo Trust Monitor, what is the primary purpose of 'Baseline' behavior?

Accepted Answer

To identify normal authentication patterns for users. Trust Monitor establishes a baseline of normal user activity to detect deviations that may indicate an account compromise.

Answer

To enforce MFA for every authentication attempt

Answer

To synchronize identity sources from LDAP

Answer

To define the static list of allowed IP addresses

Question 12

During a Duo enrollment phase, a user is required to install the Duo Mobile app. What is the main security purpose of the app in the MFA flow?

Accepted Answer

To facilitate encrypted push notifications and act as a secure token. The app provides a secure channel for Push notifications and generates TOTP codes, enabling cryptographically secure identity verification.

Answer

To track the user's location at all times

Answer

To scan the user's local network for unauthorized devices

Answer

To act as a remote desktop client for cloud apps

Question 13

An organization wants to restrict access to Salesforce to specific IP addresses. Where should this policy be configured?

Accepted Answer

In the Duo Admin Panel under the Salesforce application policy. Policies are applied per application in the Duo Admin Panel to ensure granular control.

Answer

In the global organization settings

Answer

In the Salesforce administrative console only

Answer

In the local workstation host file

Question 14

Which mechanism does Duo use to integrate with non-SAML cloud applications?

Accepted Answer

Duo Authentication Proxy for RADIUS/LDAP. For applications that do not support SAML/OIDC, Duo uses the Authentication Proxy to bridge RADIUS or LDAP requests to the Duo cloud.

Answer

Duo API Gateway

Answer

Duo Universal Prompt

Answer

Direct integration via browser extension

Question 15

A security auditor notices that Duo authentication logs show an 'Authentication Succeeded' status, but the user was denied access to the SaaS application. Which policy setting is the most likely cause?

Accepted Answer

Device health policy violation detected after MFA. If authentication succeeds but access is denied, the Duo policy likely includes a post-authentication check, such as device health or geo-blocking, that failed.

Answer

Incorrect username provided during MFA

Answer

Duo Authentication Proxy is down

Answer

Expired Duo license