SCAZT User And Device Security Practice Test 2 — 15 Questions

Question 1

A network administrator is deploying Cisco Identity Services Engine (ISE) with TrustSec for a campus network. The administrator wants to enforce segmentation based on user roles, such as restricting access to the finance server only to members of the finance department. The administrator has already configured security group tags (SGTs) and security group ACLs (SGACLs). Which additional component is required to enforce these policies on the network devices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SGT propagation on the switches. TrustSec segmentation relies on SGTs embedded in packets and SGACLs enforced on network devices. For enforcement, the switches must be able to propagate and recognize SGTs. This is achieved by enabling SGT propagation, either through inline tagging or SXP. Once SGTs are propagated, the switches can apply SGACLs based on source and destination SGTs. Without propagation, the SGACLs cannot be enforced, making this the required additional component.

Answer

Configure 802.1X authentication on all access ports

Answer

Configure Change of Authorization (CoA) on ISE

Answer

Enable Device Sensor on the switches

Question 2

A security administrator is configuring Cisco Identity Services Engine (ISE) to authenticate employees connecting to the corporate wireless network using PEAP-MSCHAPv2. The administrator wants to ensure that only domain-joined Windows devices can connect. Which ISE policy condition should be used to meet this requirement?

Accepted Answer

Match on the AD-User-Name attribute and check for the presence of a domain computer account. With PEAP-MSCHAPv2, ISE authenticates the user against Active Directory. To restrict access to domain-joined devices, ISE can evaluate whether the device has a computer account in AD. This is typically done by checking attributes like AD-Host-Name or by using the AD computer authentication. By matching on such attributes, ISE can ensure that only domain-joined devices are granted access, fulfilling the security requirement.

Answer

Match on the calling station ID (MAC address) against a list of corporate devices

Answer

Match on the user's group membership in Active Directory

Answer

Match on the device's certificate issued by the domain CA

Question 3

A user is attempting to access a cloud application protected by Duo SSO. The Duo prompt shows 'Access Denied: Your device is not running a supported browser'. Where is this restriction defined?

Accepted Answer

In the Duo Application configuration under 'Browser Restrictions'. The 'Access Denied: Your device is not running a supported browser' message from Duo SSO is generated by the Duo application's browser restriction settings. In the Duo Admin Panel, each protected application can be configured with browser restrictions that define which browsers and versions are permitted, and Duo enforces this at the SSO prompt before granting access.

Answer

In the Active Directory GPO for the user

Answer

In the Duo Authentication Proxy configuration file

Answer

In the local browser settings of the client machine

Question 4

A user's device is marked as 'Out-of-Date' in Duo. How does the system determine this status?

Accepted Answer

By the Duo Device Health application reporting the OS version to the Duo Cloud. Duo determines device health, including 'Out-of-Date' status, through the Duo Device Health application installed on the endpoint. That agent collects OS version, patch level, firewall/antivirus status, and other attributes, then reports them to the Duo cloud, where policies evaluate the device and assign a status such as Out-of-Date.

Answer

By analyzing the user's browser user-agent string

Answer

By querying the Active Directory server for the last patch date

Answer

By checking the device's public IP address geolocation

Question 5

You are implementing Cisco Duo Device Health for a Windows fleet. Users report that they are blocked from accessing cloud apps despite having valid credentials. The Duo Health app reports a missing OS security patch. Which component is responsible for enforcing this posture check during the authentication flow?

Accepted Answer

Duo Access Policy. The Duo Access Policy is the policy engine in the Duo Admin Panel that evaluates device health signals (including missing OS patches) and enforces allow/deny decisions during authentication. When the Device Health app reports a missing patch, the Access Policy is what blocks access based on that posture attribute.

Answer

Microsoft Conditional Access Policy

Answer

Duo Authentication Proxy

Answer

Duo Device Health Application

Question 6

Which Duo feature allows an administrator to visualize the percentage of users who have successfully registered their mobile devices?

Accepted Answer

Duo Dashboard. The Duo Dashboard provides administrators with visualizations and summary metrics, including the percentage of users who have successfully registered their mobile devices (enrollment status). It aggregates enrollment, authentication, and device health data into widgets and reports. The Authentication Log, Policy Editor, and Trust Monitor serve different purposes and do not provide this enrollment percentage visualization.

Answer

Duo Authentication Log

Answer

Duo Policy Editor

Answer

Duo Trust Monitor

Question 7

You are deploying Duo Passwordless authentication. Which factor must be verified on the endpoint before a user can successfully authenticate?

Accepted Answer

The endpoint must have an active WebAuthn-compliant platform authenticator. Duo Passwordless authentication requires the endpoint to have an active WebAuthn-compliant platform authenticator (e.g., Windows Hello, Touch ID, or a security key) to verify the user's identity without a password. This hardware-backed authenticator is the core factor that enables passwordless login.

Answer

The user must be connected to the corporate VPN

Answer

The endpoint must have a Cisco AnyConnect client installed

Answer

The endpoint must have the Duo Authentication Proxy installed

Question 8

An organization uses Duo Access Gateway (DAG) to protect on-premises applications. They want to transition to Duo SSO. What is the primary difference in architecture?

Accepted Answer

Duo SSO eliminates the need for on-premises server infrastructure for the identity provider. Duo Access Gateway (DAG) is an on-premises identity provider that must be installed on a local server to broker authentication for protected applications. Duo SSO is Duo's cloud-hosted identity provider, so migrating to it removes the need to maintain on-premises IdP server infrastructure — authentication is handled in Duo's cloud.

Answer

Duo SSO supports only SAML 1.0 protocols

Answer

Duo SSO requires a dedicated hardware appliance

Answer

Duo SSO requires the installation of the Duo Authentication Proxy on a local server

Question 9

A security engineer is configuring Duo Authentication for Microsoft 365. The organization requires that users must be prompted for MFA only when accessing cloud resources from outside the corporate network. Which configuration setting in the Duo Admin Panel achieves this?

Accepted Answer

Configure a New Authentication Policy with 'Authorized Networks' set to the corporate office IP range. To prompt for MFA only when accessing Microsoft 365 from outside the corporate network, you configure a New Authentication Policy in the Duo Admin Panel with 'Authorized Networks' set to the corporate office IP range. This policy bypasses MFA for requests originating from those trusted IPs while enforcing MFA for all others.

Answer

Enable 'Duo Device Health' on the Microsoft 365 application object

Answer

Set the global MFA mode to 'Bypass' in the Duo Application settings

Answer

Apply a 'Remembered Device' setting of 30 days to the entire group

Question 10

Which of the following is a requirement for using the Duo 'Remembered Devices' feature?

Accepted Answer

The user's browser must accept cookies from the Duo domain. Duo's 'Remembered Devices' feature works by placing a cookie in the user's browser after they complete authentication and choose to remember the device. On subsequent logins, Duo reads that cookie to recognize the device and skip the second factor (within the configured expiration). Therefore the browser must accept cookies from the Duo domain for the feature to function.

Answer

The user must be on the corporate network

Answer

The user must have a registered hardware token

Answer

The endpoint must be joined to a domain

Question 11

What is the primary benefit of the Duo Universal Prompt compared to the traditional iframe-based prompt?

Accepted Answer

It is a hosted redirect that provides a more secure and consistent experience. The Duo Universal Prompt is a hosted, redirect-based authentication experience that replaces the traditional iframe-based prompt. Because it is hosted by Duo rather than embedded in the customer's page, it provides a more secure and consistent experience across browsers and devices, and it is not subject to the restrictions and security risks of iframes (e.g., clickjacking, third-party cookie blocking). This design also simplifies integration and future feature rollouts.

Answer

It supports offline authentication only

Answer

It removes the need for mobile devices

Answer

It requires less bandwidth

Question 12

When configuring Duo Trust Monitor, what is the primary purpose of 'Baseline' behavior?

Accepted Answer

To identify normal authentication patterns for users. Duo Trust Monitor's 'Baseline' behavior establishes what normal authentication looks like for each user by learning patterns such as typical locations, devices, times, and application access. This baseline is then used to detect anomalies that may indicate compromised credentials or risky behavior. It is not an enforcement mechanism, identity sync, or static allow list.

Answer

To enforce MFA for every authentication attempt

Answer

To synchronize identity sources from LDAP

Answer

To define the static list of allowed IP addresses

Question 13

During a Duo enrollment phase, a user is required to install the Duo Mobile app. What is the main security purpose of the app in the MFA flow?

Accepted Answer

To facilitate encrypted push notifications and act as a secure token. The Duo Mobile app serves as the second factor in MFA by receiving encrypted push notifications for authentication requests and generating time-based one-time passcodes (TOTP) as a secure token. It binds the user's identity to a specific device, so possession of the enrolled device is required to approve login attempts. This is the core security purpose of the app in the Duo MFA flow.

Answer

To track the user's location at all times

Answer

To scan the user's local network for unauthorized devices

Answer

To act as a remote desktop client for cloud apps

Question 14

A security auditor notices that Duo authentication logs show an 'Authentication Succeeded' status, but the user was denied access to the SaaS application. Which policy setting is the most likely cause?

Accepted Answer

Device health policy violation detected after MFA. Duo's authentication flow can include device health checks (e.g., OS version, firewall status, screen lock) after primary authentication. If the device fails a health policy, Duo may return 'Authentication Succeeded' for the MFA portion but then deny access to the application based on the device health policy. Thus, the most likely cause is a device health policy violation detected after MFA.

Answer

Incorrect username provided during MFA

Answer

Duo Authentication Proxy is down

Answer

Expired Duo license

Question 15

A administrator wants to implement 'Strict' device health checks. What happens if a device reports an unknown OS version?

Accepted Answer

The access attempt is blocked by the policy. In Duo's device health/trusted endpoint policies, the 'Strict' enforcement mode means any device that fails to meet the defined health criteria — including an unrecognized or unknown OS version — is denied access entirely. Because Duo cannot evaluate the posture of an OS it does not recognize, the safe default under Strict is to block the connection rather than downgrade or redirect. This is the defining behavior that separates Strict from permissive or report-only modes.

Answer

The user is redirected to a temporary guest portal

Answer

The user is prompted to upgrade the OS manually

Answer

The user is granted read-only access