Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.
Start Scenario PracticeWhich THREE types of information are typically displayed in the Cisco Umbrella 'App Discovery' report?
Explanation: The Cisco Umbrella App Discovery report is designed to give visibility into the SaaS and cloud applications in use across the environment, and it surfaces three key data points per application: the Application Name (C), which identifies the discovered app; the Traffic Volume (D), which shows how much bandwidth or request activity that app generates; and the Risk Score (A), which rates the app's security/privacy risk based on Cisco's Cloudlock/Umbrella intelligence. These three fields let administrators quickly triage shadow IT by knowing what the app is, how much it is used, and how risky it is. The other options do not belong: a User's home address (B) is personal data never shown in this report, and an Application's source code (E) is proprietary code that Umbrella has no access to and does not display.
Which THREE items are considered primary components of the Cisco Umbrella 'Identity' structure when creating security policies?
Explanation: In Cisco Umbrella, the Identity structure used when building policies is built around three primary identity types: Roaming Computers (A), which are endpoints running the Umbrella Roaming Client/SIG agent and are identified by their registered identity; Networks (B), which are defined by public IP addresses/subnets (or dynamic IPs via the Umbrella network device/AD integration) so all traffic egressing that IP is attributed to the network identity; and Active Directory User/Group (D), which ties DNS requests to AD users or groups via the AD Connector or Virtual Appliance for user-based policy enforcement. These three map directly to Umbrella's policy identity selectors (Roaming Computers, Networks, and AD Users/Groups) and are the standard building blocks for differentiated security policies. A printer's MAC address (C) is not an Umbrella identity construct—Umbrella identities are based on roaming client registration, public IP/network, or AD user/group, not endpoint MAC addresses. A public cloud instance ID (E) is likewise not a primary Umbrella identity type; cloud workloads are typically covered via network/IP identities or the Umbrella SIG/cloud firewall integrations rather than an instance-ID identity.
Which THREE factors are typically considered when evaluating 'Device Posture' in a Zero Trust environment?
Explanation: Device Posture in a Zero Trust environment assesses the security hygiene and configuration state of an endpoint before granting access, so option B (Disk encryption status) is correct because full-disk encryption such as BitLocker or FileVault protects data at rest and is a standard compliance signal. Option C (Antivirus status) is correct because the presence, currency, and real-time protection state of endpoint anti-malware (e.g., Defender, CrowdStrike) indicates whether the device can detect and resist threats. Option E (Operating system patch level) is correct because missing OS security updates expose known vulnerabilities, so posture checks verify patch compliance via tools like Intune, Jamf, or conditional access policies. Option A (The user's home internet speed) is not a security posture attribute but a network performance metric, and option D (The user's favorite website) is irrelevant personal preference data with no bearing on device trust.
Which THREE mechanisms are commonly used by a CASB to enforce access control to SaaS applications?
Explanation: A CASB commonly enforces access control to SaaS applications through three primary deployment modes. API-based integration (C) connects directly to the SaaS provider's REST APIs to scan content, apply DLP policies, and enforce access rules without inline traffic inspection. Reverse Proxy (D) sits between users and the SaaS app, intercepting sessions so the CASB can apply authentication, authorization, and policy controls inline. Forward Proxy (E) routes user traffic from the endpoint through the CASB, enabling inline enforcement of access policies for SaaS sessions. Local host firewall rules (A) operate at the OS/network layer and cannot inspect SaaS application context or user identity, so they are not a CASB enforcement mechanism. Direct switch-to-server connection (B) is a network topology concept, not an access-control mechanism used by a CASB.
Which THREE types of information are analyzed by Cisco Secure Workload (Tetration) to enforce micro-segmentation?
Explanation: Cisco Secure Workload (formerly Tetration) enforces micro-segmentation by analyzing rich workload telemetry, and user identity context (B) is correct because it correlates authenticated user and group information (e.g., via AD/LDAP integration) with flows so policies can be scoped to who is communicating, not just IP addresses. Process-level information (C) is correct because Tetration agents collect process and package details (executable names, hashes, parent-child relationships, listening ports) on each workload, enabling policies based on what process is generating or receiving traffic. Network flow telemetry (E) is correct because the platform continuously ingests flow data (5-tuple, ports, protocols, byte counts) from agents and network devices to build the dependency maps and behavioral baselines used for micro-segmentation policy recommendations. The remaining options are not analyzed: the color of the server rack (A) and the user's home address (D) are physical or personal attributes with no bearing on workload communication behavior or segmentation policy.
+15 more scenario questions available
Practice all Select Two (Multi-Select) QuestionsMulti-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination. These appear throughout the SCAZT and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the SCAZT. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free SCAZT scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Select Two (Multi-Select) Questions session with instant scoring and detailed explanations.
Start Scenario Practice →