Practise command-choice questions where the task is to identify the correct verification, configuration or troubleshooting command.
Start Scenario PracticeYou are troubleshooting a scenario where users are unable to access a specific internal cloud resource after migrating to Cisco Secure Access. The traffic is being blocked by a default policy. How should you modify the traffic flow to ensure internal traffic stays off the SIG?
Explanation: Tunnel Exclusions in Cisco Secure Access allow administrators to define internal IP ranges (and domains) that should bypass the SIG tunnel entirely, so traffic to those destinations is routed natively rather than being inspected and blocked by the default policy. This is the correct way to keep internal/private traffic off the Secure Access cloud when users are remote or on-network. Configuring the exclusion ensures the internal resource is reachable without being subjected to cloud web filtering.
When troubleshooting DNS queries in Umbrella, which command is most useful on a local machine to see if it is using the Umbrella resolvers?
Explanation: Running 'nslookup debug.opendns.com' confirms if the query is being answered by the Umbrella infrastructure.
A global company needs to ensure that users in different regions have the lowest latency when accessing cloud applications. How should the SASE architecture be configured?
Explanation: Cisco Umbrella uses a globally distributed anycast network, which automatically routes users to the nearest data center, minimizing latency.
Which TWO methods are used to verify compliance against security policies in Cisco Defense Orchestrator?
Explanation: Option A is correct because Cisco Defense Orchestrator (CDO) provides compliance reporting that evaluates managed device configurations against security policies and highlights violations, giving administrators an auditable view of policy adherence. Option B is correct because CDO's 'Check for Changes' feature compares the running configuration against the last-known-good or baseline configuration to detect configuration drift, which is a core mechanism for verifying ongoing compliance. Options C, D, and E are incorrect because rebooting appliances, running traceroutes from endpoints, and manually reconfiguring firewalls are operational or troubleshooting actions that do not verify compliance against security policies in CDO.
When troubleshooting a Cisco Umbrella roaming client visibility issue, what does the 'Diagnostic Tool' verify?
Explanation: The Umbrella Roaming Client Diagnostic Tool checks connectivity to the Umbrella resolvers and verifies that the client is successfully syncing policy and identity information from the Umbrella dashboard. It reports on DNS resolution path, tunnel status, and whether the client is registered and communicating with the Umbrella service. This directly addresses visibility issues where the client is installed but not enforcing or reporting.
+10 more scenario questions available
Practice all Which Command Should the Administrator Use Practice QuestionsPractise command-choice questions where the task is to identify the correct verification, configuration or troubleshooting command. These appear throughout the SCAZT and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the SCAZT. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free SCAZT scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Which Command Should the Administrator Use Practice Questions session with instant scoring and detailed explanations.
Start Scenario Practice →