317 questions total · 5pages · All types, answers revealed
Page 1 of 5
Page 2Which TWO capabilities does Cisco Cloudlock bring to a SaaS environment?
Cloudlock monitors for PII and other sensitive data in SaaS files.
Why this answer
Cloudlock provides DLP for sensitive data and threat detection for compromised accounts.
Which THREE items must be configured to successfully implement an Umbrella SIG tunnel?
Needed to establish the tunnel endpoint.
Why this answer
A tunnel needs the remote IP address, the encryption parameters (IKEv2), and the traffic to be routed through the tunnel.
Which TWO of the following are valid Duo authentication methods that do not require an internet-connected mobile device for the user?
Works offline.
Why this answer
Hardware tokens and SMS passcodes (if telephony is available) or bypass codes work without the Duo Mobile app.
You are configuring a SASE design to secure traffic from a branch office to the cloud. What is the recommended method for routing internet-bound traffic from the branch to the Cisco Umbrella SIG?
IPsec tunneling is the standard design pattern for branch-to-cloud security.
Why this answer
IPsec tunnels from the branch edge device (such as a Cisco ISR or Meraki MX) to the Cisco Umbrella SIG provide a secure, encrypted transit for all traffic.
In Cisco Secure Cloud Analytics, what is the function of the 'Host Group' configuration?
Logical grouping is the primary purpose of Host Groups.
Why this answer
Host groups allow administrators to organize IP addresses into logical categories (e.g., 'Servers', 'Internal', 'Guest') for clearer reporting and policy application.
Which TWO factors are critical when configuring an automated remediation workflow in Cisco Cloudlock to prevent data loss?
Correct. You must define the automated step to take.
Why this answer
Effective remediation requires an action (what to do) and a trigger condition (when to do it based on policy severity).
Which Cisco Umbrella feature allows you to categorize destinations and apply custom block or allow lists?
Destination Lists are the mechanism for custom allow/block lists.
Why this answer
Destination Lists allow administrators to manually define domains, IPs, or URLs that should be blocked or allowed regardless of global categories.
In the context of cloud compliance, you are reviewing the Cisco Cloudlock dashboard. Which feature allows you to identify users who are sharing sensitive documents publicly across corporate SaaS applications like Google Workspace or Office 365?
The Exposure dashboard specifically maps file sharing permissions to identify public access.
Why this answer
Cloudlock's 'Exposure' dashboard provides visibility into file sharing settings and identifies public or externally shared content.
A security engineer is designing a SOAR playbook in Cisco SecureX Orchestration to isolate a compromised virtual machine in AWS. The playbook must query Cisco Secure Endpoint (AMP for Endpoints) for file trajectory data before performing the isolation. Which activity node should be placed first to ensure the endpoint is correctly identified in the cloud environment?
The 'Get Computer' call is necessary to obtain the specific connector GUID required for subsequent API-based isolation actions.
Why this answer
To isolate a host, the orchestration must first identify the unique resource ID or endpoint GUID from the Cisco Secure Endpoint API to ensure the correct asset is isolated.
Which TWO methods can Cisco Cloudlock use to notify an administrator of a policy violation?
Standard notification mechanism.
Why this answer
Cloudlock provides multiple notification channels, including email alerts and integration with webhooks/ticketing systems.
Which THREE types of data are commonly visualized in a Cisco Secure Cloud Analytics dashboard?
Identity mapping is a key visibility feature.
Why this answer
Secure Cloud Analytics provides visibility into traffic flows, user identity activity, and network host behavior.
Which THREE features are provided by the Cisco Umbrella 'Intelligent Proxy'?
The proxy scans files to block malicious payloads.
Why this answer
The Intelligent Proxy performs file analysis, URL filtering, and SSL inspection to protect users.
When designing incident response playbooks, which THREE of the following are considered best practices for maintaining security and operational continuity?
Logging is essential for troubleshooting and post-incident auditing.
Why this answer
Best practices include using dedicated service accounts, logging all actions for audit, and ensuring playbooks are modular for reuse.
Which feature in Cisco Cloudlock allows administrators to view a dashboard of users who are behaving outside of their normal baseline?
UBA is specifically designed for behavioral anomalies.
Why this answer
Cloudlock's UBA (User Behavior Analytics) module uses machine learning to establish a baseline and flag anomalies.
When configuring visibility for SaaS applications in Cloudlock, which TWO of the following tasks are necessary to ensure the solution can inspect and protect the files in the SaaS environment? (Choose two.)
Policies are required to perform the actual audit of the ingested data.
Why this answer
Cloudlock requires an OAuth-based integration (API connector) to gain visibility and the enabling of specific monitoring policies to trigger scans.
Which THREE pieces of information are displayed in the Umbrella 'Activity Search' report?
Identifies the user/device.
Why this answer
Activity logs show the time of the request, the identity that made it, and the action taken (allowed/blocked).
Which THREE steps are involved in the standard SecureX orchestration lifecycle for a new workflow?
Security credentials must be set up.
Why this answer
The lifecycle includes designing the logic, configuring the required credentials, and testing the execution before moving to production.
An organization requires that users on iOS devices must have a passcode enabled to access cloud resources. Which Duo feature enforces this?
This policy allows enforcing device settings like screen locks for mobile access.
Why this answer
Duo Device Health (or mobile posture checks) can inspect for common mobile security settings, such as screen locks/passcodes.
When implementing a Zero Trust architecture, what is the 'Principle of Least Privilege' (PoLP) specifically intended to achieve?
This is the definition of PoLP in a Zero Trust context.
Why this answer
PoLP ensures that users and devices are granted the minimum level of access required to perform their jobs, minimizing the blast radius of a potential breach.
Which TWO actions can be taken in the SecureX 'Threat Response' investigation graph to aid in incident analysis?
Adding context helps with incident tracking.
Why this answer
You can pivot to related indicators and add notes or labels to artifacts in the graph to document findings.
Which TWO actions can a user take if a file is quarantined by Cisco Cloudlock?
The user is notified via this file.
Why this answer
Quarantine moves the original file to a secure location and replaces it with a placeholder (tombstone) file; the user can typically only access the tombstone.
When creating a policy in Cisco Cloudlock, what is the significance of setting a 'Threshold'?
Thresholds prevent false-positive alerts on single occurrences.
Why this answer
Thresholds allow you to define how many times a violation must occur (or how many instances of sensitive data are found) before an incident is triggered, reducing noise.
You are integrating a cloud-native security tool with SecureX. Which authentication method is generally preferred for the API integration?
SecureX utilizes Credential objects to securely store API keys/tokens.
Why this answer
OAuth2 or API keys are standard, but the 'Credential' object in SecureX is the mechanism used to manage these securely.
You are deploying Umbrella Virtual Appliances (VAs) in a local Active Directory environment. What is the primary purpose of the VA in this deployment?
VAs integrate with AD to provide granular identity information.
Why this answer
The VA is used to map internal IP addresses to specific identities in the Umbrella dashboard, allowing for per-user or per-group reporting.
Which TWO of the following are required to successfully deploy a SecureX Orchestration workflow that interacts with a Cisco Secure Endpoint API?
The workflow must have an activity to execute the call.
Why this answer
To interact with an API, one needs the credentials (client ID/secret) and a properly configured workflow activity that uses those credentials.
You are configuring Cisco SecureX orchestration to automate threat containment. You need to trigger a playbook when a high-severity alert is ingested from Cisco Secure Endpoint. Which component must be defined to map the alert fields to the playbook input variables?
The input schema defines the structure and data types for incoming triggers.
Why this answer
In Cisco SecureX orchestration, atomic actions and workflows use input schema definitions to map data incoming from webhooks or API events into actionable variables.
Which THREE items are included in a Duo Authentication Log entry?
Essential for troubleshooting.
Why this answer
The logs contain the time, the username, and the result (success/failure) of the transaction.
What is the primary role of a Cloud Access Security Broker (CASB)?
Core definition of a CASB.
Why this answer
A CASB acts as a gatekeeper, sitting between users and cloud services to enforce security policies and monitor activity.
Which TWO components are essential for a complete Cisco Umbrella deployment on end-user laptops?
Essential for DNS protection.
Why this answer
Roaming client handles DNS, while the AnyConnect module integrates with the broader security suite.
A user's device is marked as 'Out-of-Date' in Duo. How does the system determine this status?
The Health application actively reports the version, which the policy evaluates.
Why this answer
The Duo Device Health application collects system information and compares the OS version against the policy defined in the Duo Admin Panel.
Which THREE components are critical for a successful cloud network segmentation strategy?
Policies enforce the isolation.
Why this answer
Effective segmentation requires clear definitions of user groups, resource groups, and the access policies that govern their interaction.
You need to export compliance data from the Cisco Security Management Appliance (SMA) regarding web traffic policy violations. Which format ensures the most efficient ingestion into a SIEM via the SecureX orchestration workflow?
JSON is natively supported by SecureX orchestration for object mapping.
Why this answer
For automation and orchestration via SecureX, JSON is the industry-standard format for parsing and manipulating data within workflow activities.
In a SASE deployment, why is the integration between Cisco ISE and Cisco Secure Access considered a critical design pattern?
This integration bridges the gap between campus network access and cloud service access policies.
Why this answer
Integrating ISE with Secure Access allows consistent policy application across both on-premises network resources and cloud-based applications.
Which THREE items are typically included in a SecureX compliance report?
Threat status is crucial for compliance reporting.
Why this answer
Compliance reports focus on policy status, asset health, and threat activity summaries.
Which TWO settings should be verified if a Cisco Cloudlock API connector to Google Workspace is showing a 'Warning' status?
Insufficient scopes will prevent the API from functioning.
Why this answer
Connector warnings usually stem from insufficient API permissions (scopes) or expired credentials/tokens.
Which THREE criteria are used by Cisco Secure Access to determine if a connection should be allowed?
Confirming the user's identity is the first check.
Why this answer
Access decisions are made based on user identity, device posture, and the specific application policies.
You are troubleshooting a workflow where an API call to Cisco Secure Email fails with a 401 error. What is the most likely cause?
401 errors are specifically related to unauthorized/expired credentials.
Why this answer
A 401 error indicates an authorization issue, likely due to expired or incorrect credentials in the Credential object.
Which feature of the Cisco Umbrella SIG is specifically designed to prevent 'Command and Control' (C2) callbacks from infected endpoints?
Blocking the resolution of C2 domains prevents the malware from 'calling home'.
Why this answer
The Umbrella DNS layer security identifies and blocks requests to malicious domains associated with C2 infrastructure.
In an automated threat response scenario, you want to block a malicious domain globally across your environment using Cisco Umbrella. Which API endpoint is utilized by the SecureX orchestrator?
The Enforcement API is the correct endpoint for blocking domains.
Why this answer
The Umbrella Investigate and Enforcement APIs allow for programmatic blocking of domains within the Umbrella dashboard.
In Cisco SecureX, which dashboard component allows a security analyst to view the real-time status of triggered automated workflows and their execution history?
This is the dedicated management interface for tracking workflow execution and history.
Why this answer
The 'Orchestration' tab within the SecureX dashboard provides a centralized view of workflows, including execution logs, status, and failure points.
You want to restrict access to specific cloud apps (e.g., Dropbox). Which Umbrella feature is used?
This feature manages SaaS application visibility and blocking.
Why this answer
Application Control allows administrators to discover and block access to specific cloud applications.
You are analyzing a 'Domain Blocked' event in Umbrella. The explanation says 'Proxy'. What does this imply?
The proxy allows for deeper inspection and URL-level filtering.
Why this answer
If the block reason is 'Proxy', it means the traffic was routed through the Umbrella SIG proxy and was blocked by a web policy (such as URL filtering or file inspection).
Which THREE metrics are useful for assessing the security posture of an endpoint in Cisco Secure Endpoint?
Scanning history indicates recent coverage.
Why this answer
Posture assessment involves checking the presence of the agent, the last scan result, and the current policy version.
IPsec adds overhead; if the path MTU is not adjusted, large packets are dropped.
When configuring a SIG tunnel in Umbrella, which protocol is typically used to establish the encrypted connection between the branch office firewall and the Umbrella data center?
IPsec is the standard protocol for SIG site-to-site connectivity.
Why this answer
Umbrella SIG tunnels primarily use IKEv2/IPsec to establish secure connections for traffic redirection.
You are configuring Cisco SecureX threat response to investigate a file hash. You notice that the integration module for Cisco Umbrella is showing a status of 'Partial Success'. What is the most likely cause?
Partial success indicates the connection works, but specific data points are restricted by scope.
Why this answer
A partial success status in SecureX integration modules often indicates that while the API connection is authenticated, certain permissions or granular scopes required for specific threat intelligence lookups are missing or misconfigured in the source platform.
A security engineer is configuring Duo Authentication for Microsoft 365. The organization requires that users must be prompted for MFA only when accessing cloud resources from outside the corporate network. Which configuration setting in the Duo Admin Panel achieves this?
The Authorized Networks feature in Duo policies allows defining specific ranges where MFA can be bypassed.
Why this answer
Duo Network Policies allow for location-based access control, permitting bypass or mandatory MFA based on IP ranges.
In Cisco Secure Access, you need to configure a Global Policy to block access to specific cloud applications based on risk levels. Where do you define this logic?
Access Rules define the permit/deny logic for web and cloud destinations.
Why this answer
The Secure Access policy engine uses Access Rules within the Global Policy section to define application-specific restrictions.
Which TWO pieces of information are used by the Duo Authentication Proxy to identify which application is sending an auth request?
Matches the client to the configuration.
Why this answer
The proxy identifies incoming traffic by the shared secret and the IP address or port of the sending device.
Which TWO of the following are benefits of moving from a legacy VPN to a ZTNA-based architecture?
This is the primary security benefit over legacy VPNs.
Why this answer
ZTNA improves security through granular access and improves user experience by eliminating hair-pinning.
What is the primary function of an 'atomic action' in the context of SecureX orchestration?
Atomic actions encapsulate one specific function.
Why this answer
Atomic actions are the building blocks of playbooks, performing a single, specific task such as querying an API or sending a notification.
Which of the following is a key component of a successful 'Identity and Access Management' (IAM) strategy in the cloud?
Centralization and MFA are pillars of secure cloud identity management.
Why this answer
A centralized IAM strategy, such as using an IdP (e.g., Azure AD or Okta) integrated with Cisco Duo, ensures consistent authentication.
In a SASE deployment using Cisco SD-WAN and Umbrella, how is traffic steered to the cloud security stack when a branch router loses its direct tunnel connection to the Umbrella SIG headend?
SD-WAN tunnels are multi-homed to multiple Umbrella data centers for redundancy.
When integrating Duo with an application that uses the OIDC protocol, where are the 'Client ID' and 'Client Secret' configured?
This is where the OIDC parameters are created.
Why this answer
The client ID and secret are generated within the Duo Admin Panel application configuration and provided to the OIDC-compliant application.
Which TWO identity sources can be integrated with Cisco Duo for user authentication?
LDAP is natively supported by Duo.
Why this answer
Duo integrates with standard directories like Active Directory and LDAP.
You are auditing your Cisco Defense Orchestrator (CDO) environment. Why would a device appear in 'Staging' mode instead of 'Managed'?
Staging indicates that the object exists in CDO but isn't fully managed yet.
Why this answer
Devices in Staging are discovered but have not yet been fully onboarded or had their configuration pushed to the CDO management state.
In a SOAR playbook, which THREE types of data can be used to enrich an incident within a case?
File analysis identifies malware properties.
Why this answer
Enrichment involves gathering additional details about IP addresses, file hashes, and domain names from threat intelligence sources.
Which TWO methods can be used to tunnel traffic from a branch office to the Cisco Umbrella SIG?
GRE is also a supported method for connecting branch traffic.
Why this answer
IPsec tunnels and GRE tunnels are the standard methods for connecting site-level traffic to the Umbrella cloud.
Which TWO settings should you check if a SecureX integration module shows 'Offline' status?
Invalid credentials cause authentication failure.
Why this answer
An offline module usually indicates an issue with the API connection (credentials) or the network path between SecureX and the product.
A user is attempting to upload a file to a SaaS application, but the Cisco Umbrella Intelligent Proxy blocks it. What is the most effective way to troubleshoot the block?
This dashboard identifies the policy that triggered the block.
Why this answer
The Umbrella Activity Search is the primary tool to see why a specific request (domain/URL) was blocked by policy.
When migrating from an explicit proxy to the Umbrella SIG, what is the primary challenge for legacy applications?
Cloud SIG requires specific configurations or auto-proxy support.
Why this answer
Legacy applications often have hardcoded proxy settings or require specific authentication methods that may not be supported by the cloud SIG.
What does the 'Umbrella dashboard' allow you to do regarding DNS security?
This is the primary function of the management interface.
Why this answer
The dashboard provides centralized management, reporting, and policy enforcement for DNS-based security across an entire organization.
You are using a 'Loop' node in a SecureX workflow to process a list of IPs. How do you access the current item within the loop iteration?
The iterator variable holds the value for the current pass.
Why this answer
The loop construct provides a specific variable (usually named 'item' or similar) that holds the current iteration value.
Which THREE settings are part of the 'Authentication Policy' in the Duo Admin Panel?
Controls user experience during MFA.
Why this answer
Authentication policies control the MFA prompt, remembered device settings, and location-based access.
You need to ensure that only corporate-managed devices can access Microsoft 365. Which component should be configured to verify the device's security posture before granting access?
Duo performs posture checks (Trusted Endpoints) at login.
Why this answer
Duo's Device Health and Trusted Endpoint features specifically check for device management status before allowing access to applications.
You notice an alert in SecureX indicating 'Identity Correlation Failure'. What is the most common reason for this when integrating Cisco Secure Endpoint and Cisco Identity Services Engine (ISE)?
Correlation engines rely on timestamps; if the systems are not synced via NTP, the events cannot be mapped to the same identity window.
Why this answer
Identity correlation requires a common identifier (like IP address or MAC) and time-synchronization; discrepancies often stem from mapping failures due to time offsets or missing context exchange.
You are auditing your Cisco Secure Cloud Analytics environment. Which metric is most critical for identifying potential data exfiltration attempts?
High volumes of outbound data to unknown or external IPs are primary indicators of exfiltration.
Why this answer
Data exfiltration is typically detected by observing unusual volumes of outbound traffic to unauthorized or suspicious destinations.
Where can you view the overall security posture and threat trends across your organization within the Umbrella dashboard?
The main Dashboard provides the aggregate overview requested.
Why this answer
The Umbrella dashboard provides a 'Dashboard' overview page which displays high-level threat trends and posture metrics.
An organization wants to restrict access to Salesforce to specific IP addresses. Where should this policy be configured?
Policies in the Duo Admin Panel are assigned to specific applications.
Why this answer
Policies are applied per application in the Duo Admin Panel to ensure granular control.
An administrator needs to ensure that only managed devices can access sensitive data in Box. Which Cisco solution feature enables this verification?
Correct. Posture checking verifies device health before granting SaaS access.
Why this answer
Cisco Secure Access with device posture checks ensures that only devices meeting minimum security requirements can access defined SaaS applications.
An organization is using Cisco Duo for MFA and wants to monitor for suspicious administrative activity. Which report type in the Duo dashboard provides the most granular visibility into changes made to global settings by an administrator?
This log provides a clear audit trail of who changed what setting and when.
Why this answer
The 'Administrator Actions' log in Duo specifically tracks all changes made to the account settings, policies, and integrations by admin users.
You have a branch office with a static IP. You want to secure it without a local virtual appliance. What is the best method?
Network identities link static public IPs to policies.
Why this answer
Configuring network identity in Umbrella by defining the public IP (Network Identity) allows the gateway to associate traffic with your organization without a tunnel or VA.
A user is experiencing 'SSL Certificate Mismatch' errors. You suspect it is caused by the Umbrella proxy. How do you resolve this permanently?
This builds the necessary trust chain.
Why this answer
The issue stems from the client not trusting the proxy's certificate. Installing the Umbrella Root CA certificate ensures the client validates the proxy as a trusted entity.
In Cisco Cloudlock, what is the purpose of an 'Incident'?
Correct definition of an incident.
Why this answer
An incident is an alert generated when a specific policy rule is triggered by a user or data action within a protected SaaS app.
When an alert is triggered in Cisco Secure Cloud Analytics, which action is most appropriate to perform first?
Verification and scope assessment are critical initial steps.
Why this answer
The first step in any incident response process is to verify the alert's validity and understand the scope of the potential threat.
Page 1 of 5
Page 2Practice SCAZT by domain
Target a specific domain to shore up weak areas.