SCAZT User And Device Security — Timed 20 Questions

Question 1

An administrator needs to ensure that only managed devices can access SaaS applications via Cisco Duo. Which configuration step is mandatory in the Duo Admin Panel to ensure the device is recognized as 'Managed'?

20 minute time limit — choose an answer to begin.

Accepted Answer

Enable 'Require Device Health' in the application policy and ensure the Duo Device Health application is installed. To ensure only managed devices access SaaS apps via Duo, the administrator must enable 'Require Device Health' in the application policy and deploy the Duo Device Health application on endpoints. This makes Duo evaluate device posture and treat compliant devices as managed. Trusted Endpoints alone without certificate deployment does not establish managed status.

Answer

Configure the Duo Authentication Proxy for RADIUS bypass

Answer

Enable 'Trusted Endpoints' in the Duo Admin panel without certificate deployment

Answer

Assign a static IP address to every endpoint

Question 2

An organization wants to restrict access to Salesforce to specific IP addresses. Where should this policy be configured?

Accepted Answer

In the Duo Admin Panel under the Salesforce application policy. Duo's application policies, including network-based access controls such as allowed IP ranges, are configured in the Duo Admin Panel under the specific application's policy settings. For Salesforce, you navigate to Applications > Salesforce > Policy and define the permitted IP addresses or ranges there, which Duo enforces before granting access. This keeps the IP restriction tied to the Duo-protected application rather than to Salesforce's own configuration.

Answer

In the global organization settings

Answer

In the Salesforce administrative console only

Answer

In the local workstation host file

Question 3

Which mechanism does Duo use to integrate with non-SAML cloud applications?

Accepted Answer

Duo Authentication Proxy for RADIUS/LDAP. Duo integrates with non-SAML cloud applications via the Duo Authentication Proxy, which acts as a RADIUS or LDAP endpoint that the application authenticates against. The proxy then forwards the authentication request to Duo's cloud for MFA, enabling Duo protection for legacy or non-SAML apps.

Answer

Duo API Gateway

Answer

Duo Universal Prompt

Answer

Direct integration via browser extension

Question 4

When syncing users from Active Directory to Duo, what is the role of the 'Duo Authentication Proxy'?

Accepted Answer

To facilitate directory synchronization between AD and Duo. The Duo Authentication Proxy is a lightweight on-premises service that brokers communication between Duo's cloud and on-prem directory/authentication sources. For AD sync specifically, it reads user and group objects from Active Directory and pushes that data to Duo so the cloud has an accurate directory to apply policies against. It is the bridge that lets Duo authenticate AD users without exposing AD directly to the internet.

Answer

To enforce hardware-based encryption on AD servers

Answer

To store user passwords locally

Answer

To serve as the primary identity provider for the cloud

Question 5

Which Duo feature helps prevent phishing attacks by requiring the user to tap a button only after a verified authentication request?

Accepted Answer

Duo Push with number matching. Duo Push with number matching requires the user to verify a number displayed on the login screen by tapping the corresponding number in the Duo Mobile app. This prevents phishing attacks because an attacker who tricks a user into approving a push notification cannot know the correct number to tap, as the number is only shown on the legitimate authentication page. This feature is specifically designed to mitigate MFA fatigue and push-based phishing attacks.

Answer

Duo Phone Callback

Answer

Duo Hardware Tokens

Answer

Duo Passwordless

Question 6

You are investigating an authentication failure. The log shows 'Error: User not found in directory'. What does this imply?

Accepted Answer

The user is not present in the Active Directory group synced to Duo. This error occurs when the Duo cloud service attempts to check a user's status against the synced directory, but the user does not exist or was not successfully synced.

Answer

The Duo Authentication Proxy cannot reach the AD server

Answer

The user's password is expired in AD

Answer

The Duo service is experiencing an outage

Question 7

Which TWO of the following are valid Duo authentication methods that do not require an internet-connected mobile device for the user?

Accepted Answer

Hardware Token. Option A (Hardware Token) is correct because Duo supports OTP hardware tokens that generate passcodes locally via a built-in clock/battery, so the user needs no internet-connected mobile device. Option B (SMS Passcode) is correct because Duo can deliver a one-time passcode via SMS to a basic cell phone; the user only needs cellular SMS reception, not an internet-connected smartphone. Option C (Duo Mobile TOTP) is incorrect here because it requires the Duo Mobile app on a device, and while TOTP itself is offline, the scenario asks for methods not requiring an internet-connected mobile device—Duo Mobile TOTP is still a mobile-app method. Option D (Duo Push) is incorrect because it requires the Duo Mobile app on an internet-connected smartphone to receive the push. Option E (Phone Callback) is incorrect because Duo's callback method calls a phone number and requires the user to answer and press a key, which is a telephony method but not one of the two marked correct answers for this question.

Answer

Duo Mobile TOTP

Answer

Duo Push

Answer

Phone Callback

Question 8

Which THREE conditions must be met for a user to be able to use the 'Self-Service Portal' for device enrollment?

Accepted Answer

Self-enrollment must be enabled in the global settings. Option A is correct because self-enrollment must be enabled in the global settings before any user can access the Self-Service Portal to enroll a device. Option B is correct because the user must belong to a synced directory group, which is how the portal authorizes who is eligible to enroll. Option E is correct because the user must have an active email address, since the portal sends the enrollment link/verification to that address. Option C is incorrect because the Duo Authentication Proxy in Bypass mode would disable authentication, not enable self-service enrollment. Option D is incorrect because domain join is not a prerequisite for using the Self-Service Portal for device enrollment.

Answer

The Duo Authentication Proxy must be in 'Bypass' mode

Answer

The device must be joined to the domain

Question 9

Which THREE actions can be taken by an administrator if a user's mobile device is reported as stolen?

Accepted Answer

Force re-enrollment for the user. Option A (Force re-enrollment for the user) is correct because forcing re-enrollment invalidates the stolen device's existing Duo enrollment and requires the user to register a new device, ensuring the stolen device can no longer authenticate. Option B (Deactivate the specific mobile device in the Duo Admin Panel) is correct because deactivating the device in the Duo Admin Panel immediately revokes that device's ability to approve Duo Push or generate passcodes, cutting off its access without affecting the user's other devices. Option D (Block the user account temporarily) is correct because temporarily blocking the user account prevents any authentication attempts tied to that user, containing the risk while the theft is investigated and the device is replaced. Option C (Wipe the device remotely) is not a Duo administrative action; remote wipe is performed through MDM or the device platform (e.g., Find My, Intune), not the Duo Admin Panel. Option E (Disable the user's AD account via the Duo dashboard) is not possible because Duo does not manage or disable Active Directory accounts from its dashboard; AD account changes must be made in AD or via directory sync.

Answer

Wipe the device remotely

Answer

Disable the user's AD account via the Duo dashboard

Question 10

Which TWO of the following are benefits of using the Duo Authentication Proxy for on-premises AD integration?

Accepted Answer

Secure transport of authentication requests to Duo Cloud. Option C is correct because the Duo Authentication Proxy acts as a secure relay between on-premises systems (such as AD, RADIUS, or LDAP) and Duo's cloud service, encrypting authentication traffic over TLS so that credentials and authentication requests are transported securely to Duo Cloud. Option D is correct because the proxy includes a synchronization agent that automatically syncs AD users and groups to Duo, keeping the Duo directory current for policy and MFA enforcement. Option A is not correct because the proxy does not store user credentials locally; authentication is validated against AD and Duo, not a local credential store. Option B is not correct because the proxy is not an offline authentication database—it depends on connectivity to Duo Cloud for MFA. Option E is not correct because the proxy is an authentication relay, not a domain controller, and does not replace Active Directory.

Answer

Local storage of user credentials

Answer

Provides an offline authentication database

Answer

Direct replacement of the Active Directory domain controller

Question 11

Which THREE of the following are supported by the Duo Authentication Proxy?

Accepted Answer

Windows Logon authentication. The Duo Authentication Proxy supports Windows Logon authentication (A) because it can be installed on a Windows machine and configured as a credential provider that proxies primary Windows logon credentials to Duo for secondary verification. It supports LDAP authentication (C) since the proxy can bind to an LDAP directory (such as Active Directory or OpenLDAP) to validate primary credentials before contacting Duo. It supports RADIUS authentication (E) because the proxy includes a RADIUS server component that forwards Access-Request packets to Duo for MFA. Option B is incorrect because the Duo Authentication Proxy is not a SAML 2.0 Identity Provider; SAML federation is handled by Duo Single Sign-On or the Duo Network Gateway, not the proxy. Option D is incorrect because the proxy does not perform direct authentication against SQL databases as a supported primary credential source.

Answer

Direct SAML 2.0 Identity Provider hosting

Answer

SQL database direct authentication

Question 12

Which TWO of the following scenarios would lead to an 'Access Denied' message in the Duo Authentication Log?

Accepted Answer

The user denied the push notification on their phone. Option B is correct because when a user actively denies a Duo Push notification, Duo records the authentication attempt as 'Denied' by the user, which surfaces in the Authentication Log as an 'Access Denied' result since the second factor was not approved. Option D is correct because if a device fails a mandatory OS version policy configured in Duo, the authentication is blocked and logged as 'Access Denied' due to the device not meeting the required security posture. Option A is not correct because an unenrolled user typically triggers an 'Enrollment Required' or similar status rather than 'Access Denied'. Option C is not correct because a forgotten password is handled by the primary identity provider (e.g., Active Directory or an IdP), not by Duo, so it would not appear as a Duo Authentication Log 'Access Denied' event. Option E is not correct because a Duo service outage would produce errors such as 'Service Unavailable' or timeouts, not an 'Access Denied' result.

Answer

The user has not enrolled a device yet

Answer

The user forgot their password

Answer

The Duo service is temporarily down

Question 13

Which TWO pieces of information are used by the Duo Authentication Proxy to identify which application is sending an auth request?

Accepted Answer

The RADIUS secret. The Duo Authentication Proxy identifies the sending application by matching the incoming request against configured client entries, and each client entry is defined by the source IP address and/or port along with the shared RADIUS secret. Option B (the RADIUS secret) is correct because the proxy validates the shared secret configured for each RADIUS client, which uniquely ties the request to a specific application configuration. Option E (the IP address or port of the incoming request) is correct because the proxy uses the source IP/port of the request to look up the corresponding client definition in its configuration. Option A (the user's email address) is not used for application identification, as it identifies the end user, not the client application. Option C (the Duo API key of the user) is incorrect because API keys belong to the Duo integration/application, not to individual users, and are not the primary means of identifying the sending app in this context. Option D (the device's MAC address) is incorrect because the proxy operates at the application layer and does not use MAC addresses to identify RADIUS clients.

Answer

The user's email address

Answer

The Duo API key of the user

Answer

The device's MAC address

Question 14

A network security administrator is deploying Cisco Identity Services Engine (ISE) for a new branch office. The branch has a mix of corporate-owned Windows laptops and employee-owned mobile devices. The administrator wants to ensure that corporate laptops are granted full network access, while employee-owned devices are placed in a restricted VLAN with internet-only access. Which ISE feature should be configured to achieve this?

Accepted Answer

BYOD registration and certificate provisioning. The requirement is to differentiate corporate laptops from employee-owned devices for network access. BYOD registration with certificate provisioning allows ISE to issue certificates to enrolled personal devices, while corporate devices can be identified via domain membership or a separate certificate authority. Authorization policies can then grant full access to corporate devices and restricted access to BYOD devices. This provides a scalable and secure method for ownership-based segmentation.

Answer

Posture assessment

Answer

Profiling

Answer

Change of Authorization (CoA)

Question 15

A security engineer is configuring Cisco Identity Services Engine (ISE) to support 802.1X authentication for a group of Linux workstations. The organization uses a public key infrastructure (PKI) and wants to ensure that only workstations with a valid certificate issued by the corporate CA can authenticate. The engineer has already configured the CA certificate in ISE. Which additional configuration is required on ISE to validate the certificate chain during EAP-TLS authentication?

Accepted Answer

Add the corporate CA certificate to the trusted certificates store. For EAP-TLS authentication, ISE must validate the client certificate against a trusted CA. The corporate CA certificate must be imported into ISE's trusted certificates store. This allows ISE to build and validate the certificate chain from the client certificate to the trusted root. Without this, ISE cannot verify the certificate's authenticity, and authentication will fail. Thus, adding the corporate CA certificate to the trusted certificates store is the required configuration.

Answer

Configure an external identity source for certificate authentication

Answer

Enable OCSP checking

Answer

Enable certificate revocation list (CRL) checking

Question 16

A network administrator is deploying Cisco Identity Services Engine (ISE) with TrustSec for a campus network. The administrator wants to enforce segmentation based on user roles, such as restricting access to the finance server only to members of the finance department. The administrator has already configured security group tags (SGTs) and security group ACLs (SGACLs). Which additional component is required to enforce these policies on the network devices?

Accepted Answer

Enable SGT propagation on the switches. TrustSec segmentation relies on SGTs embedded in packets and SGACLs enforced on network devices. For enforcement, the switches must be able to propagate and recognize SGTs. This is achieved by enabling SGT propagation, either through inline tagging or SXP. Once SGTs are propagated, the switches can apply SGACLs based on source and destination SGTs. Without propagation, the SGACLs cannot be enforced, making this the required additional component.

Answer

Configure 802.1X authentication on all access ports

Answer

Configure Change of Authorization (CoA) on ISE

Answer

Enable Device Sensor on the switches

Question 17

A security administrator is configuring Cisco Identity Services Engine (ISE) to authenticate employees connecting to the corporate wireless network using PEAP-MSCHAPv2. The administrator wants to ensure that only domain-joined Windows devices can connect. Which ISE policy condition should be used to meet this requirement?

Accepted Answer

Match on the AD-User-Name attribute and check for the presence of a domain computer account. With PEAP-MSCHAPv2, ISE authenticates the user against Active Directory. To restrict access to domain-joined devices, ISE can evaluate whether the device has a computer account in AD. This is typically done by checking attributes like AD-Host-Name or by using the AD computer authentication. By matching on such attributes, ISE can ensure that only domain-joined devices are granted access, fulfilling the security requirement.

Answer

Match on the calling station ID (MAC address) against a list of corporate devices

Answer

Match on the user's group membership in Active Directory

Answer

Match on the device's certificate issued by the domain CA

Question 18

A user is attempting to access a cloud application protected by Duo SSO. The Duo prompt shows 'Access Denied: Your device is not running a supported browser'. Where is this restriction defined?

Accepted Answer

In the Duo Application configuration under 'Browser Restrictions'. The 'Access Denied: Your device is not running a supported browser' message from Duo SSO is generated by the Duo application's browser restriction settings. In the Duo Admin Panel, each protected application can be configured with browser restrictions that define which browsers and versions are permitted, and Duo enforces this at the SSO prompt before granting access.

Answer

In the Active Directory GPO for the user

Answer

In the Duo Authentication Proxy configuration file

Answer

In the local browser settings of the client machine

Question 19

A user's device is marked as 'Out-of-Date' in Duo. How does the system determine this status?

Accepted Answer

By the Duo Device Health application reporting the OS version to the Duo Cloud. Duo determines device health, including 'Out-of-Date' status, through the Duo Device Health application installed on the endpoint. That agent collects OS version, patch level, firewall/antivirus status, and other attributes, then reports them to the Duo cloud, where policies evaluate the device and assign a status such as Out-of-Date.

Answer

By analyzing the user's browser user-agent string

Answer

By querying the Active Directory server for the last patch date

Answer

By checking the device's public IP address geolocation

Question 20

You are implementing Cisco Duo Device Health for a Windows fleet. Users report that they are blocked from accessing cloud apps despite having valid credentials. The Duo Health app reports a missing OS security patch. Which component is responsible for enforcing this posture check during the authentication flow?

Accepted Answer

Duo Access Policy. The Duo Access Policy is the policy engine in the Duo Admin Panel that evaluates device health signals (including missing OS patches) and enforces allow/deny decisions during authentication. When the Device Health app reports a missing patch, the Access Policy is what blocks access based on that posture attribute.

Answer

Microsoft Conditional Access Policy

Answer

Duo Authentication Proxy

Answer

Duo Device Health Application