Cisco Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT, 300-740, CCNP Security) (SCAZT) (SCAZT) — Questions 1–75

Cloudlock inspects content within sanctioned SaaS applications, applying DLP policies to files and posts in platforms such as Microsoft 365 and Google Workspace. This satisfies the requirement to detect and control sensitive data exposure directly inside the SaaS environment.

An IPsec tunnel from the branch edge to the nearest Umbrella data centre satisfies the stem's requirement for routing internet-bound branch traffic into the SIG. This is Umbrella's Tunnel-to-SIG model, which forwards all branch egress traffic to Umbrella for DNS-layer and secure web gateway inspection without requiring client agents on every endpoint.

Host Groups let administrators map subnets, VLANs or address ranges into named logical entities, so Secure Cloud Analytics baselines behaviour and raises alerts per segment rather than per flat address space. This satisfies the stem's requirement to organise network segments for meaningful analysis.

The private resource connector establishes an outbound-only connection from the AWS VPC to Cisco Secure Access, allowing ZTNA enforcement without inbound firewall openings or public exposure. Identity and device posture policies are evaluated before access is granted, aligning with zero trust principles. This design directly addresses the need to protect private applications while leveraging existing ISE and Secure Access investments.

Selecting the remediation action determines what Cloudlock does once a policy matches — delete, notify or quarantine the offending item. Without an action, the workflow detects violations but never prevents data loss, so action selection is critical to the stem's remediation outcome.

Destination Lists let administrators group domains and IPs into custom lists, then apply block or allow actions to those lists within policies. This satisfies the categorisation requirement by overriding default category verdicts with organisation-specific exceptions, giving granular control beyond standard content categories.

The Exposure dashboard's policy violations surface files and documents shared publicly or externally, attributing each to the responsible user across Google Workspace and Office 365. This directly satisfies the requirement to identify users exposing sensitive documents publicly in corporate SaaS applications.

Email notification satisfies the requirement by delivering policy-violation alerts directly to an administrator's inbox through Cisco Cloudlock's built-in notification engine. Cloudlock generates the alert when a policy rule matches monitored content, then dispatches it via SMTP to configured recipients, requiring no additional infrastructure or third-party integration.

Secure Cloud Analytics dashboards surface identity context, correlating user authentication events with observed network activity. This identity dimension lets analysts attribute flows and detections to specific users, complementing host and traffic telemetry within the same visualisation.

Comprehensive logging of every workflow execution step preserves an audit trail of automated actions, enabling post-incident review and troubleshooting. This supports operational continuity by making playbook behaviour traceable, satisfying the stem's requirement to maintain security and continuity during incident response.

User Behaviour Analytics baselines each user's normal activity and surfaces deviations from it, exactly matching the requirement to view users behaving outside their normal baseline. The dashboard aggregates these anomalies, distinguishing UBA from static policy or DLP-based Cloudlock features.

Activity Search records the identity that initiated each request, satisfying the requirement to surface the requesting user. Umbrella logs this as the identity field, populated from directory or roaming client authentication, letting administrators trace DNS and web activity back to a specific user or device during investigations.

Credentials are configured so activities can authenticate to external systems such as firewalls, endpoints and ticketing platforms. This satisfies the lifecycle requirement that target accounts and API keys exist before workflow logic can be built and executed.

Duo Mobile Application Policy enforces device-side requirements on managed iOS endpoints, including requiring a passcode before granting access. This directly satisfies the stem's constraint that iOS users must have a passcode enabled to reach cloud resources, since the policy is evaluated by Duo Mobile on the device itself.

Least privilege restricts each identity to the minimum entitlements needed for its current task, removing standing access to unrelated resources. This satisfies the stem's requirement for limiting blast radius, since compromised or misused accounts cannot reach data beyond their explicit, task-scoped permissions.

Adding notes or tags to artifacts records analyst findings directly on the investigation graph, supporting collaboration and audit trails during incident analysis. This satisfies the scenario's requirement to aid analysis by preserving context alongside the visualised threat data, letting responders document conclusions without leaving the SecureX interface or exporting evidence elsewhere.

Cloudlock replaces quarantined content with a tombstone placeholder, so the user can still open and read that tombstone file to see the quarantine notice and metadata. This satisfies the scenario's requirement for an action available on a quarantined file.

The Threshold sets how many matching occurrences within the policy's scope must accumulate before Cisco Cloudlock raises an alert, preventing single benign events from generating noise. It defines the minimum count that triggers notification, directly matching the stated significance.

Credential Objects store API keys and tokens centrally in SecureX, letting the cloud-native tool authenticate without embedding secrets in code or configuration files. This satisfies the integration's security constraint by enabling scoped, revocable credentials that can be rotated independently of the tool itself.

Threat Response aggregates data from multiple integrated intelligence modules into one investigation, showing verdicts such as malicious or unknown, sightings, and pivotable observables. For a clicked domain, this lets the analyst quickly see whether any source has flagged it and pivot to related indicators, which directly supports the decision to escalate or close the incident.

The VA forwards internal client DNS queries to Umbrella alongside the client's AD user identity, enabling per-user policy and reporting for on-premises devices. This satisfies the identity-based reporting requirement in a local Active Directory environment.

A configured Orchestration workflow containing an API-call activity is required because that activity performs the actual HTTP request to the Secure Endpoint API. Without it, the workflow has no mechanism to invoke the endpoint, so the interaction described in the stem cannot occur.

Each Duo Authentication Log entry records the authentication outcome, showing whether the attempt succeeded or failed. This result field satisfies the stem's requirement, letting administrators filter failures and trace denied or rejected access attempts during investigations.

A CASB sits inline between cloud users and cloud applications, enforcing policies such as authentication, authorisation, data-loss prevention and threat protection on that traffic. This directly satisfies the stem's requirement for the primary role: mediating and controlling access, rather than merely monitoring or configuring the cloud service itself.

The Duo Device Health application collects the endpoint's OS version and reports it to Duo's cloud service, which compares it against the minimum version defined in your device health policy. That comparison produces the 'Out-of-Date' status, satisfying the stem's requirement for how Duo determines the flag.

Access rules governing cross-segment traffic enforce least-privilege east-west control, ensuring only explicitly permitted flows traverse segment boundaries. This directly satisfies the segmentation requirement by preventing lateral movement between workloads, rather than merely isolating them at the perimeter. Without such rules, segments remain logically separated but effectively reachable, defeating the strategy's containment objective.

JSON preserves nested policy-violation fields as structured key–value pairs, so SecureX orchestration can map them directly into SIEM fields without parsing overhead. CSV flattens that hierarchy, and syslog lacks schema, both requiring custom extraction. This satisfies the stem's efficiency constraint for automated ingestion.

Cisco ISE supplies user identity and device posture, which Cisco Secure Access consumes to apply context-aware policy across hybrid environments. This integration satisfies the stem's critical design pattern by enforcing identity and device-state-based access decisions.

A compliance report aggregates detected threats into a summary of active security threats, giving auditors and security teams a consolidated view of current risk. This satisfies the requirement to evidence monitored threat status across the environment.

Selective TLS decryption allows inspection of chosen SaaS traffic while bypassing categories such as banking and healthcare to preserve privacy. Adding pinned applications to a decryption exemption list prevents certificate errors and broken functionality. Together, these features meet the inspection, privacy, and application compatibility requirements without globally disabling decryption.

Cloudlock's API connector authenticates to Google Workspace through a service account; if its scopes are revoked or misassigned, the connector cannot enumerate users and files, triggering the Warning status. Verifying these permissions restores the API access the connector requires.

NetFlow is the standard protocol for exporting flow data from Cisco switches and routers to a flow collector. Secure Network Analytics Flow Collectors are designed to receive NetFlow, IPFIX, and sFlow. Enabling NetFlow on the Catalyst switches allows the Flow Collector to analyze traffic patterns, detect anomalies, and provide visibility. This is the correct protocol for this scenario.

Microsoft Entra ID-sourced user identity is evaluated against policy so Secure Access can permit or deny the connection based on who is requesting it. Identity is one of the three criteria determining whether a connection should be allowed.

The Sightings tab in Cisco SecureX threat response lists every module that has observed the observable, along with timestamps. Sorting ascending reveals the earliest detection. This directly answers the need to find the first endpoint that observed the hash, and the data comes from integrated modules such as Cisco Secure Endpoint, Umbrella, and others.

HTTP 401 means the request lacked valid authentication, and an expired API token or credential is the usual cause. The endpoint is reachable and the payload well-formed, so the failure sits at the authentication layer, not connectivity or syntax.

Malware frequently resolves C2 domains before beaconing outbound, so DNS-layer security blocks those lookups at resolution time, before any connection is established. This satisfies the requirement to stop callbacks originating from already-infected endpoints, unlike IP or file inspection which act later.

Application Control identifies and blocks or allows traffic by cloud application, using Umbrella's application signatures and categories. This satisfies the requirement to restrict specific apps such as Dropbox independently of broad domain or content filtering.

Umbrella's selective proxy intercepts only the traffic it is configured to inspect, so a 'Proxy' explanation confirms the request was redirected to that proxy and blocked there, rather than by DNS resolution or a firewall rule. This satisfies the stem's requirement to identify the enforcement point that generated the Domain Blocked event.

A stale scan date signals the endpoint has not been inspected recently, so detection coverage may have lapsed. Recency of the last completed scan therefore directly reflects whether the agent is actively assessing the device, satisfying the posture-assessment requirement in the stem.

An unadjusted tunnel MTU lets large packets exceed the path limit, so they are dropped rather than fragmented, producing timeouts despite the IPsec tunnel showing up. Lowering the tunnel MTU prevents this black-holing, satisfying the scenario's requirement that oversized traffic traverse the tunnel successfully.

Partial Success typically means the module authenticated but some API calls were rejected, which points to insufficient API scopes or permissions granted on the Umbrella dashboard. Expanding those scopes restores full integration functionality for threat response investigations.

An authentication policy scoped with Authorized Networks containing the corporate IP range means Duo prompts for MFA only when the access originates outside that range, satisfying the requirement to challenge solely off-network cloud access. Users inside the office bypass the prompt.

Global Policy Access Rules define the ordered rule logic that evaluates traffic and applies block or allow actions based on destination risk. Configuring cloud application risk conditions here satisfies the requirement to block apps by risk level.

A single workflow can chain a Secure Web Appliance action with a casebook update, so the block and the record happen together. This satisfies the requirement for one automated action performing both steps and keeps the audit trail synchronized with the enforcement. Sequencing the casebook entry after the block also captures the actual outcome.

An atomic action performs one discrete task, such as querying a threat intelligence feed or blocking an IP address, and cannot be subdivided further. This granularity satisfies the stem's requirement for the primary function, letting SecureX orchestration chain these indivisible building blocks into larger workflows without internal branching logic.

Federating a central identity provider with Microsoft Entra ID and enforcing MFA gives one authoritative identity source, consistent authentication policy and strong credential assurance across cloud workloads. This satisfies the stem's requirement for a key IAM strategy component by unifying identity and verifying users.

Duo's OIDC integration requires the Client ID and Client Secret to be entered in the Duo Admin Panel's application settings, where Duo acts as the identity provider. That location satisfies the stem by storing the credentials Duo presents to the relying application.

OpenLDAP is a supported directory source that Cisco Duo can synchronise users from for authentication, satisfying the identity-source integration requirement. Duo's Directory Sync and Authentication Proxy both support LDAP-based directories, enabling user import and primary or secondary authentication.

Staging mode indicates the device record exists in Cisco Defense Orchestrator but onboarding has not completed, so configuration and policy are not yet synchronised. Only after successful onboarding does the device transition to Managed and become fully controllable.

File hash analysis enriches incidents by querying reputation services and threat-intelligence feeds for known-malicious indicators, returning verdicts, detection names and prevalence data. This satisfies the playbook's enrichment requirement by supplying automated, indicator-level context that analysts use to triage files observed within the case.

GRE encapsulates the branch traffic inside IP packets and delivers it to the Umbrella SIG headend, providing a native tunnel type for branch-to-SIG connectivity. It satisfies the scenario's requirement for tunnelling branch office traffic to Cisco Umbrella SIG.

Expired or revoked API credentials cause the integration module's authentication handshake to fail, so SecureX marks it Offline. Checking credential validity directly addresses the authentication failure constraint in the stem, restoring the module's connection to Microsoft Entra ID-protected endpoints.

Umbrella's Activity Search dashboard records every Intelligent Proxy verdict, showing the exact identity, destination, and category that triggered the block. This directly satisfies the troubleshooting constraint by revealing why the upload was denied, rather than guessing at policy or inspecting endpoint logs.

Legacy applications with hardcoded proxy IP addresses or ports cannot automatically discover the new SIG egress points, so their traffic fails once the explicit proxy is retired. This satisfies the stem's focus on the primary migration challenge.

The Umbrella dashboard is the central management plane where administrators configure global DNS security policies, blocklists and allowed domains, then view activity and threat reports. This satisfies the stem by covering both policy configuration and reporting for DNS security.

The Loop node exposes each list element through its iterator variable, so referencing that variable inside the iteration yields the current IP. Hard-coding an index or reading the whole list fails once the loop advances, so the iterator is the only binding that tracks the active item.

MFA prompt behaviour, such as auto-push, is configured within the Authentication Policy, controlling whether Duo pushes automatically or requires the user to choose a method. It is one of the three settings the question asks for.

TLS inspection requires the SIG to present a certificate that endpoints trust. Distributing the Umbrella root certificate to managed endpoints through Group Policy or an MDM ensures browsers and applications accept the re-signed certificates, enabling malware and data-loss inspection of encrypted traffic. Without this trust anchor, decryption causes certificate warnings and broken sessions, so this is the critical design step for the scenario.

Outbound transfer volume is measured against each host's established baseline; a sharp deviation indicates data leaving the network abnormally. This metric directly satisfies the stem's requirement to detect exfiltration, since stolen data must traverse the egress path in unusual quantities.

The Dashboard view aggregates Umbrella's security posture and threat trends across the organisation, presenting deployment status, top threats and activity summaries. It is the central location for reviewing overall organisational security posture within the Umbrella interface.

Secure Access device posture checks verify endpoint compliance attributes before granting access, ensuring only managed devices reach Box. This satisfies the stem's requirement that sensitive data be accessible exclusively from managed devices, enforced at the identity-aware proxy rather than relying on user credentials alone.

The Administrator Actions Log records granular administrative events, including changes to global settings, capturing the acting administrator, timestamp and modified values. This satisfies the stem's requirement for the most granular visibility into global-settings changes, unlike authentication or summary reports.

An IP-based Network Identity registers the branch's static public IP as a known identity in Umbrella, so DNS requests from that address inherit the assigned policy without any on-site virtual appliance. This satisfies the no-local-appliance constraint.

Installing the Umbrella Root CA certificate lets the endpoint trust certificates the proxy re-signs, eliminating the mismatch. Umbrella performs SSL inspection by intercepting TLS and presenting its own certificate; without the root CA in the local trust store, validation fails. This satisfies the requirement for a permanent fix rather than a bypass.

An Incident in Cisco Cloudlock is generated when a policy violation is detected, alerting administrators so they can investigate and respond. It satisfies the stem's requirement by representing the notification mechanism for policy breaches, distinct from dashboards or reports that merely display data without triggering admin alerts.

Secure Cloud Analytics alerts can be noisy, so validating the detection in the dashboard and scoping which hosts, users and timeframes are involved confirms whether it is genuine before escalation. This satisfies the first-action requirement by establishing accuracy and blast radius prior to response.

Duo Windows Logon authenticates at the interactive desktop, requiring the Duo Authentication for Windows Logon agent installed on each endpoint to intercept the credential provider. Cloud SSO instead redirects users to Duo's hosted service via SAML or OIDC, needing no endpoint software.

Umbrella's Shadow IT report ranks discovered cloud applications by the volume of traffic generated, exposing which unsanctioned services consume the most bandwidth. Traffic volume is one of the three classification criteria the stem requests, alongside category and risk level.

Connector logs on the host server record the actual LDAP bind, directory query and authentication failures occurring during sync, which is precisely the diagnostic evidence the scenario requires. Without them, you cannot identify whether the fault lies in credentials, network reachability or directory permissions.

Cisco Umbrella's CASB category enforces granular control over sanctioned and unsanctioned cloud applications, including blocking uploads or restricting actions. This governs application usage and controls data movement, satisfying the requirement to manage shadow IT and prevent data exfiltration.

A red-marked Observable in SecureX denotes a high-severity malicious indicator, satisfying the scenario's requirement to interpret the colour coding correctly. SecureX assigns red to observables judged highly malicious, distinguishing them from lower-confidence amber or neutral verdicts, so the marking signals confirmed threat intelligence rather than mere suspicion.

Zero Trust Network Access enforces per-application, identity-based access rather than broad network-level connectivity, directly satisfying the suite's requirement for least-privilege remote access. Cisco Secure Access integrates ZTNA with Microsoft Entra ID for continuous verification, so remote users reach only authorised private applications without full VPN tunnel exposure.

The Authentication Proxy sits in front of legacy applications and translates their native RADIUS or LDAP authentication requests into Duo's modern protocol, applying MFA before forwarding credentials. This satisfies the stem's constraint of protecting an application that cannot itself speak modern authentication protocols.

Setting the exposure filter to 'Public' scopes the PII inspection engine to objects with public sharing, satisfying the stem's public-facing constraint. Cloudlock evaluates exposure metadata alongside content matches, so detection triggers only when sensitive data lands in a publicly accessible object rather than any internal record.

A ZTNA agent enforces per-application microtunnels, so only traffic destined for protected internal apps traverses the corporate path while general web browsing egresses directly. This satisfies the stem's Zero Trust constraint by applying identity- and context-based policy to each session, rather than blanket-routing all traffic through a VPN concentrator.