316 questions total · 5pages · All types, answers revealed
Which THREE criteria can be used to classify a 'Shadow IT' application in Cisco Umbrella?
High traffic volume often flags an app for review.
Why this answer
Shadow IT identification is based on traffic volumes, application category, and risk scores assigned by Umbrella.
Which THREE items are necessary for troubleshooting a failed 'Umbrella AD Connector' sync?
Primary source for troubleshooting sync errors.
Why this answer
Sync issues require checking the connectivity to the DC, the service account permissions, and the logs on the connector server.
You need to ensure that an orchestration workflow is only triggered during business hours. Which logical component allows you to restrict execution?
A decision node evaluates conditions to determine the execution path.
Why this answer
A 'Decision' or 'Conditional' node can evaluate time-based metadata or environment variables to control flow execution.
What is the primary function of the 'CASB' category in Cisco Umbrella's web policy?
CASB controls enable granular governance of SaaS access.
Why this answer
The CASB category in Umbrella allows admins to enforce policies specifically for cloud applications, such as blocking uploads to unsanctioned tenants.
You are analyzing an incident in SecureX. You see an 'Observable' marked in red. What does this indicate?
Red signifies a verified malicious status.
Why this answer
Red observables typically indicate a high-severity threat or a known malicious indicator based on intelligence feeds.
Which TWO features are part of the Cisco Secure Access suite for remote users?
ZTNA provides secure access to private applications.
Why this answer
Secure Access includes both ZTNA (Zero Trust Network Access) and SWG (Secure Web Gateway) functionality.
When defining a 'Decision' node in SecureX orchestration, which THREE types of comparison operators are commonly available?
Checks for an exact match.
Why this answer
Decision nodes support common logic operators such as equality, inequality, and numeric comparisons to control workflow branches.
How does Duo protect an application that does not support modern authentication protocols?
This is the classic way to protect legacy systems.
You are configuring a Cisco Cloudlock policy to detect sensitive PII in a Salesforce instance. Which configuration step ensures that the policy specifically triggers when sensitive data is uploaded to a public-facing object?
Correct. The exposure filter is the mechanism used to restrict policy enforcement to publicly accessible data.
Why this answer
Cisco Cloudlock allows scoping of policies to specific application objects and exposure levels. Selecting the 'Public' exposure flag ensures that only data accessible to unauthorized external users triggers the alert.
When deploying a secure remote access solution, how do you handle 'Split Tunneling' safely in a Zero Trust environment?
This allows for secure application access without hair-pinning all user traffic.
Why this answer
By using a ZTNA agent, you can define specific application tunnels, effectively creating a 'split' where only authorized traffic goes through the secure path while general web traffic goes direct.
You are designing a playbook that isolates a host based on its IP. What is the standard practice for handling the dynamic IP address of an endpoint using DHCP?
Persistent identifiers prevent issues caused by IP churn.
Why this answer
Instead of IP addresses, use persistent identifiers like Hostname, MAC address, or Secure Endpoint GUID to ensure the correct device is targeted.
What is the primary benefit of the Cisco Umbrella 'Global Network' architecture?
Anycast routes traffic to the optimal PoP.
Why this answer
The anycast network ensures users connect to the nearest data center, minimizing latency and providing high availability.
You are building a custom integration in SecureX orchestration to fetch identity data from an external IDP. If the IDP uses OAuth2, which field must be secured using the 'Credential' object type?
Client Secrets are sensitive and must be stored in Credential objects.
Why this answer
The Client Secret must always be stored in a Credential object, which is encrypted and masked in the orchestration environment.
When investigating a file hash in SecureX Threat Response, which TWO sources can provide intelligence?
Talos is the primary intelligence source.
Why this answer
SecureX Threat Response integrates with both Cisco-native intelligence (Talos) and third-party threat feeds to provide context.
When configuring an OAuth policy in Cisco Cloudlock, which TWO actions can be taken against third-party applications granted access to user data?
Quarantining restricts the app's scope until reviewed.
Why this answer
Cloudlock provides the ability to audit third-party app permissions and revoke them if the application is deemed risky.
When setting up a DLP policy for cloud storage, which TWO elements should be defined to ensure accurate classification of sensitive data?
Correct. This limits the scan to the relevant data subset.
Why this answer
DLP policies rely on content inspection patterns (regex/keywords) and scope (the folders/apps) to function correctly.
The Secure Client Posture module evaluates device criteria to ensure compliance before authorizing access.
Why this answer
The Cisco Umbrella Roaming Client or AnyConnect module performs device posture checks before establishing the tunnel.
A firm is adopting SASE and needs to secure mobile devices. Which component of the Cisco SASE suite is best suited to protect mobile endpoints?
This client ensures that traffic from the device is always routed through the Umbrella SIG.
Why this answer
The Cisco Umbrella roaming client (integrated with the AnyConnect/Cisco Secure Client) provides consistent protection for mobile devices off-network.
What is the primary benefit of the Duo Universal Prompt compared to the traditional iframe-based prompt?
The redirect ensures the user interacts with a secure, Duo-controlled domain.
Why this answer
The Universal Prompt is a modern, hosted redirect that improves security and provides a consistent interface across all applications.
You are auditing a Cisco Cloudlock deployment for O365. Which TWO methods can be used to remediate a file that violates a Data Loss Prevention policy?
Cloudlock can trigger a delete command via API to remove the sensitive document.
Why this answer
Cloudlock provides automated remediation actions including changing the permission level of the file or deleting the file entirely.
When integrating Cisco Secure Endpoint with SecureX, which API key type is recommended for long-term integration stability?
This is the secure, standard method for machine-to-machine integration.
Why this answer
For long-term integration stability, using an API client with specifically scoped permissions (Read/Write as needed) via the API credentials console is best practice.
Which TWO pieces of information are required for a 'Network Identity' in Umbrella?
Used for reporting labels.
Why this answer
A network identity is defined by the public IP address and a descriptive name to identify the location in reports.
What is the benefit of the 'One-Click Investigation' feature in the SecureX browser extension?
This is the primary value of the browser extension pivot.
Why this answer
The extension allows analysts to highlight an indicator (IP, URL, file) on any webpage and right-click to send it directly to Threat Response.
You have integrated Cisco Secure Firewall with SecureX. You want to automate the addition of a suspicious IP address to a dynamic object group. Which component in the FMC API architecture is primarily used for this?
The Network Object API is used to manage and update IP objects.
Why this answer
FMC allows management of network objects via the REST API, enabling dynamic updates to object groups used in access control policies.
Which feature in Cisco Cloudlock allows you to identify if a SaaS user is logging in from an anonymizer or TOR exit node?
Correct. UBA identifies impossible travel and suspicious login sources like TOR nodes.
Why this answer
Cisco Cloudlock's Threat Intelligence engine correlates user login logs with known malicious IP reputation lists.
A security auditor notices that Duo authentication logs show an 'Authentication Succeeded' status, but the user was denied access to the SaaS application. Which policy setting is the most likely cause?
Duo permits the MFA request to pass, then checks the health policy before passing the claim to the service provider.
Why this answer
If authentication succeeds but access is denied, the Duo policy likely includes a post-authentication check, such as device health or geo-blocking, that failed.
How do you verify if your cloud-native security posture meets a specific compliance framework like PCI-DSS within the Cisco platform ecosystem?
These tools have built-in mappings for common compliance standards like PCI-DSS.
Why this answer
The Security Analytics platforms and SecureX provide compliance-specific dashboard templates or report filters that map technical controls to compliance requirements.
You notice that some of your users are bypassing the Umbrella SIG by using a personal VPN. What is the most effective way to prevent this with Cisco products?
This policy category specifically blocks VPN/proxy tools.
Why this answer
Blocking known VPN/Proxy categories within the Web Policy is the standard way to restrict unauthorized tunnel usage.
You are troubleshooting a missing event in Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud). Which configuration should you verify to ensure the cloud gateway is successfully pushing traffic metadata?
Without enabling VPC flow logs, no traffic metadata can be sent to the analytics platform.
Why this answer
The flow collector or cloud gateway configuration on the target VPC/VNet is critical to ensure traffic is being mirrored and sent to the analytics platform.
You are designing a secure hybrid cloud environment and need to ensure that traffic between the public cloud and private data center is inspected. Which architecture pattern is most effective?
Transit Gateways provide a centralized point to force traffic through a virtual firewall appliance for inspection.
Which TWO methods are natively supported within Cisco SecureX Orchestration for passing data between disparate security tools in a single workflow?
JSON data objects are the standard way to map inputs and outputs between nodes.
Why this answer
SecureX Orchestration uses JSON-formatted input/output variables and 'Atomic Actions' (pre-built integration blocks) to share data across different product modules.
When configuring a SecureX integration for a third-party product, what is the 'Client ID' used for?
Client ID is a standard part of OAuth2-style authentication.
Why this answer
The Client ID, along with the Client Secret, is used to authenticate the SecureX platform to the third-party API so it can pull the necessary data.
Which TWO components are essential for implementing a Zero Trust Network Access (ZTNA) model using Cisco Duo and Secure Access?
Essential for integrating legacy apps into the ZTNA flow.
Why this answer
ZTNA requires both identity verification (Duo) and policy-based access control (Secure Access).
When designing a Secure Access Service Edge (SASE) architecture, which principle best describes the shift from traditional hub-and-spoke networking?
SASE enables users to connect directly to the cloud edge, minimizing latency.
Why this answer
SASE emphasizes connecting users directly to cloud resources rather than backhauling traffic to a central DC.
During a Duo enrollment phase, a user is required to install the Duo Mobile app. What is the main security purpose of the app in the MFA flow?
The app acts as a verified, trusted device for MFA.
Why this answer
The app provides a secure channel for Push notifications and generates TOTP codes, enabling cryptographically secure identity verification.
Which TWO items can trigger an orchestration workflow in SecureX?
Alerts are a common trigger for automated response.
Why this answer
Workflows can be triggered by external webhooks or by specific events (like a security alert) detected by an integration module.
When a threat response workflow completes, what is the best practice for auditing the action?
Updating the case provides a clear audit trail for investigators.
Why this answer
Adding a note or updating the associated Casebook incident is the standard way to provide an audit trail of automated actions.
A user on a corporate laptop is unable to reach a specific SaaS application that is blocked by the Cisco Secure Access SIG. How can you verify the specific rule causing this block?
This provides granular visibility into policy matches.
Why this answer
The Activity Search tool in the Secure Access dashboard allows administrators to query logs and see the exact policy and rule ID that triggered the block.
You have configured a DLP policy in Cisco Cloudlock that flags files shared with external users. You notice files shared with 'Anyone with the link' are not being flagged. What is the most likely configuration error?
If the policy scope does not include public or link-based sharing, it will ignore those files.
Why this answer
Cloudlock policies require the specific permission level (e.g., 'Public' or 'Anyone with link') to be explicitly selected in the 'Exposure' criteria of the policy engine.
Which Cisco product provides the primary telemetry source for endpoint-based threat response?
Secure Endpoint is the core tool for endpoint response.
Why this answer
Cisco Secure Endpoint (formerly AMP for Endpoints) is the primary source for endpoint telemetry and action execution.
You are implementing Cisco Secure Access and want to use PAC files for browsers. Where must the PAC file be hosted for automatic proxy configuration?
The browser fetches the script from a reachable location.
Why this answer
PAC files must be accessible via an HTTP/HTTPS URL, typically hosted on a web server or a managed service provided by the vendor.
When evaluating cloud security reference architectures, what is the primary purpose of a 'Cloud Access Security Broker' (CASB)?
This is the core function of a CASB.
Why this answer
A CASB sits between cloud service consumers and providers to enforce security policies, ensuring visibility, compliance, and threat protection.
You have detected a compromised account in Google Workspace via Cloudlock. Which automated response action can immediately prevent further data exfiltration from this user account?
Correct. Suspending the account immediately revokes access to the SaaS app.
Why this answer
The 'Disable User' or 'Suspend User' action is the standard response to isolate a compromised identity and prevent further access.
Which THREE of the following are primary benefits of integrating Cisco products into the SecureX dashboard?
Centralized visibility is a core benefit.
Why this answer
SecureX provides centralized visibility, faster investigation, and streamlined automation across the security stack.
Which THREE actions can be performed by the Cisco Cloudlock UBA engine?
Flags potential data exfiltration attempts.
Why this answer
UBA tracks user activity and can flag anomalies like impossible travel, mass file downloads, and unusual access times.
You are configuring an email notification step in a SOAR playbook. You want the email to include the results of a previous 'Search IP' activity. How do you reference the IP address in the email body?
This is the standard variable referencing syntax.
Why this answer
In SecureX orchestration, output variables from previous nodes are referenced using the syntax ${node_name.output_key}.
When setting up an automated response workflow in Cisco SecureX, which THREE of the following are valid trigger sources for initiating a playbook?
Webhooks are a standard ingress point for orchestration triggers.
Why this answer
Cisco SecureX Orchestration can be triggered by external webhooks, internal events from connected security modules (such as Secure Endpoint or Threat Response), and scheduled time-based triggers.
When integrating Cisco Secure Firewall Management Center (FMC) with SecureX, which protocol is primarily used for the exchange of threat intelligence and orchestration commands?
FMC exposes REST APIs for integration with orchestration platforms.
Why this answer
SecureX utilizes APIs, primarily RESTful, to communicate with FMC for threat intelligence and orchestration.
When designing a SOAR workflow, what is the best practice for handling errors in a network isolation script?
This ensures the workflow continues or fails gracefully.
Why this answer
Using an 'Error Handling' block or 'Try-Catch' logic allows the playbook to log the error and notify an administrator rather than crashing.
Which feature in Cisco SecureX allows for the visualization of threats across multiple security products, including cloud and on-premises tools?
Threat Response is the core visualization engine in SecureX.
Why this answer
The Threat Response feature in SecureX provides a unified view of threats, correlating data from various integrated tools.
Which THREE actions can be taken by an administrator if a user's mobile device is reported as stolen?
Ensures the user sets up a new, safe device.
Why this answer
Administrators can deactivate the device, force a re-enrollment, or block the user account entirely to prevent unauthorized access.
Which protocol and format are used for the payload when triggering an incoming webhook for a SecureX orchestration workflow?
JSON over HTTP POST is the standard for SecureX webhooks.
You are integrating a third-party SIEM with SecureX. If the SIEM does not have a native integration, how can you ingest its alerts into SecureX?
Webhooks act as the entry point for external data.
Why this answer
Custom webhooks allow external systems to push data into SecureX using an HTTP POST request to a defined webhook URL.
Which capability is provided by the Cisco Umbrella 'Reporting' tab?
Umbrella reporting is designed to show DNS activity, blocks, and threat categories.
Why this answer
The Reporting tab in Umbrella allows administrators to visualize DNS requests, blocked domains, and security categories.
You are deploying Duo Passwordless authentication. Which factor must be verified on the endpoint before a user can successfully authenticate?
WebAuthn platform authenticators such as Windows Hello or TouchID are mandatory for passwordless.
Why this answer
Duo Passwordless requires WebAuthn-compatible platforms (like macOS TouchID or Windows Hello) to store the cryptographic keys.
Which capability of the Cisco Umbrella SIG ensures that sensitive data, such as PII or credit card numbers, does not leave the organization via web traffic?
DLP inspects payloads to prevent unauthorized exfiltration.
Why this answer
Cisco Umbrella's Data Loss Prevention (DLP) capability inspects outgoing traffic for sensitive information based on pre-defined or custom data patterns.
Which TWO conditions must be met for a user to be effectively managed by the Umbrella Roaming Client?
Policies determine the agent's behavior.
Why this answer
The client must be installed on the device and the organization must be registered in the dashboard.
What is the primary benefit of using 'Parameters' within a SecureX orchestration workflow?
Parameters make the workflow flexible and reusable.
Why this answer
Parameters allow workflows to be dynamic, enabling you to pass inputs at runtime without changing the hardcoded logic.
Where do you manage the Umbrella Roaming Client deployment configuration?
Deployments is the centralized location for agents.
Why this answer
The Umbrella dashboard under 'Deployments' allows for the management and download of the Roaming Client installers.
When troubleshooting DNS queries in Umbrella, which command is most useful on a local machine to see if it is using the Umbrella resolvers?
This is the standard test for Umbrella DNS resolution.
Why this answer
Running 'nslookup debug.opendns.com' confirms if the query is being answered by the Umbrella infrastructure.
Which THREE features are provided by the Cisco Umbrella 'Deployments' menu?
VA management is handled here.
Why this answer
The Deployments menu allows you to manage roaming clients, virtual appliances, and network tunnels.
Which Cisco technology should be used to provide visibility and threat detection for traffic traversing between cloud workloads in a VPC?
Secure Workload provides granular visibility into inter-workload traffic.
Why this answer
Cisco Tetration (Secure Workload) provides micro-segmentation and deep observability of traffic between workloads to detect anomalies and threats.
Which THREE types of traffic are typically protected by a SIG?
Core functionality of Umbrella.
An administrator wants to audit all Duo administrative actions. Which log provides this information?
This logs all changes to policy, users, and applications by admins.
Why this answer
The 'Administrator Actions' log in the Duo Admin Panel specifically tracks changes made by administrators.
In Cisco Cloudlock, why would you use a 'Custom Regex' pattern in a DLP policy?
Standard templates don't cover unique internal data.
Why this answer
Custom Regex patterns allow you to define organization-specific sensitive data formats, such as employee ID numbers or unique project code formats, that aren't in standard templates.
A security engineer is worried about 'MFA fatigue' attacks. Which Duo configuration is the best defense?
This requires explicit input from the user.
Why this answer
Number matching requires the user to interact with the login screen, proving they are looking at the actual request.
When designing for high availability in a SASE architecture, which THREE strategies are recommended?
Redundant internet links prevent downtime if one ISP fails.
Why this answer
Using multiple ISP connections, anycast routing, and redundant cloud tunnels ensures high availability.
You are setting up cloud network segmentation. In the context of Secure Access, how are groups of resources isolated from each other?
Policies define the isolation logic between segments.
Why this answer
Security Policies and Access Rules are used to control traffic flows between segments in the cloud environment.
When configuring Cisco Duo for SaaS application access, which THREE conditions can be used in a 'Policy' to restrict access to a sensitive application?
Duo checks if the OS is updated to meet security requirements.
Why this answer
Duo allows for granular access control based on user location, device security posture, and authentication methods.
You are integrating Cisco Secure Access with an IdP. What protocol is used to facilitate this authentication?
SAML is the industry standard for cloud IdP integration.
Why this answer
SAML (Security Assertion Markup Language) is the standard protocol used by Cisco Secure Access for cloud-based identity federation.
Which THREE actions can be taken in an Umbrella policy based on content categories?
Prevents the user from visiting the site.
Why this answer
Categories can be blocked, allowed, or set to 'Warn', which prompts the user before continuing.
What is the purpose of 'Internal Networks' in the Umbrella dashboard?
Internal Networks allow per-location policy/reporting.
Why this answer
Internal Networks allow you to group your office egress IP addresses so that policy can be applied specifically to those locations.
What is the primary function of the 'Duo Network Gateway'?
It creates a secure tunnel for web-based apps.
Which interface in Cisco SecureX allows users to manually trigger an orchestration workflow?
This section provides the ability to execute workflows on demand.
Why this answer
The 'Workflows' tab or the 'Action' menu in the Casebook allows users to manually launch a workflow.
Which of the following describes the 'Duo Central' portal?
It provides a consistent experience for accessing cloud apps.
Why this answer
Duo Central is a user-facing dashboard that provides a single, secure gateway for users to access their applications.
Practice SCAZT by domain
Target a specific domain to shore up weak areas.