316 questions total · 5pages · All types, answers revealed
You need to ensure that an orchestration workflow only runs if a specific threat intelligence score exceeds a threshold. Which node type do you use?
Decision nodes allow for conditional branching based on data values.
Why this answer
A 'Decision' node with a numeric comparison operator is used to evaluate threat scores and determine the execution path.
You have a requirement to perform 'File Analysis' on downloads. Which Umbrella product component must be enabled?
SIG allows for file inspection and malware sandboxing.
Why this answer
File Analysis requires the Umbrella SIG (Secure Internet Gateway) with the Cisco Talos malware inspection engine enabled.
Cloudlock uses APIs to scan data stored in cloud apps.
Which TWO settings must be correctly configured to ensure that Cisco Secure Access provides effective decryption and inspection of HTTPS traffic?
Endpoints must trust the proxy certificate to avoid SSL warnings.
Why this answer
HTTPS inspection requires the deployment of a root CA to endpoints and the configuration of inspection rules in the policy.
In a Cisco Secure Access environment, you are applying an application-layer policy to restrict access to a specific SaaS application based on the user's geolocation. Which tool is used to define this access control rule?
Correct. Access policies in Cisco Secure Access define the 'Who, Where, What' for application access.
Why this answer
Cisco Secure Access uses Access Policies that integrate with Identity and Context-Aware settings to enforce location-based access to SaaS applications.
You are integrating Cisco Umbrella into Cisco SecureX. You have successfully configured the API key and registered the organization. However, no Umbrella events are populating the SecureX dashboard. Which configuration step is the most likely cause of this visibility gap?
Without enabling Log Management/Streaming for the specific integration, events will not flow to the SecureX cloud.
Why this answer
SecureX requires the 'Event Streaming' or 'Reporting' integration to be explicitly enabled within the Umbrella dashboard to push logs to the cloud-based event bus.
Which Duo feature helps prevent phishing attacks by requiring the user to tap a button only after a verified authentication request?
The user must enter a number displayed on the login screen into the Duo Mobile app.
Why this answer
Duo Push with number matching ensures the user is actively responding to the specific login event, preventing 'MFA fatigue' and accidental approvals.
Which TWO pieces of information are required in the Duo Admin Panel to configure a new SAML application integration?
Required for SAML assertion delivery.
Why this answer
To link a SAML app, you need the Metadata file from the app or the manual entry of the Entity ID and Assertion Consumer Service (ACS) URL.
Which THREE types of information are typically displayed in the Cisco Umbrella 'App Discovery' report?
Helps assess the security posture of the app.
Why this answer
The App Discovery report provides insights into application categories, risk levels, and usage statistics per app.
When integrating Cisco Cloudlock with O365, which authentication mechanism is required to allow the CASB to perform administrative actions, such as removing a malicious file share?
Correct. Cloudlock uses OAuth 2.0 to obtain tokens necessary for API operations on SaaS resources.
Why this answer
Cisco Cloudlock requires OAuth 2.0 scopes granted via an administrative consent process to perform actions on behalf of the application in the O365 tenant.
Which THREE components are critical to consider when designing a 'cloud security reference architecture'?
Identity is the new perimeter in cloud security.
Why this answer
A complete architecture must account for identity, workload protection, and internet edge security.
Which TWO of the following are primary benefits of Cisco Umbrella DNS-layer security?
Umbrella is a cloud-native SaaS solution.
Why this answer
DNS-layer security blocks threats before connection occurs and requires no additional hardware.
Which TWO of the following scenarios would lead to an 'Access Denied' message in the Duo Authentication Log?
Result is access denied.
Why this answer
An access denied message can be triggered by a policy failure (like geo-blocking) or a user explicitly canceling the push request.
You are investigating a security incident and need to correlate logs from Cisco Secure Endpoint and Cisco Umbrella. What is the key piece of information needed to link these two sets of logs in SecureX?
This is the 'glue' that allows correlation across platforms.
Why this answer
Both logs need a shared context such as an internal IP address or a user identity that is present in both data sources at the time of the event.
Which capability does the Cisco SecureX 'Response' feature provide to an incident responder when analyzing a file hash detected in the cloud?
This is the primary function of the Response capability within SecureX.
Why this answer
The 'Response' feature allows an analyst to pivot across integrated security products to search for the presence of an IOC, such as a file hash, across endpoints, email, and network traffic.
You notice an employee is accessing a cloud app that is not approved by IT. Which Umbrella feature allows you to see this activity?
Specifically designed to reveal shadow IT.
Why this answer
Shadow IT reporting within the App Discovery feature shows a list of applications accessed by users that have not been sanctioned by the IT department.
A user is prompted for MFA but their phone is dead. Which administrative feature allows for a temporary bypass?
This allows the user to bypass the prompt for a limited time/count.
Why this answer
Administrators can issue a temporary 'bypass code' that is valid for a single use or a set duration.
You are troubleshooting a scenario where users are unable to access a specific internal cloud resource after migrating to Cisco Secure Access. The traffic is being blocked by a default policy. How should you modify the traffic flow to ensure internal traffic stays off the SIG?
Tunnel exclusions allow specific traffic to bypass the SIG, ensuring internal resources remain reachable.
Why this answer
Configuring a PAC file or using Tunnel Exclusions ensures that traffic destined for internal ranges bypasses the SIG tunnel.
Which mechanism does Duo use to integrate with non-SAML cloud applications?
The proxy allows legacy protocols to be protected by Duo MFA.
Why this answer
For applications that do not support SAML/OIDC, Duo uses the Authentication Proxy to bridge RADIUS or LDAP requests to the Duo cloud.
When designing a SOAR playbook, which mechanism ensures that the playbook does not trigger multiple times for the same alert?
Checking if an incident is already in progress prevents duplicate runs.
Why this answer
Deduplication logic, often using a 'Case' status check or a stateful flag, prevents redundant executions.
You want to ensure that users are warned before visiting a newly registered domain. Which feature in Cisco Umbrella handles this?
Newly registered domains are a security category.
Why this answer
Newly registered domains are a security category in Umbrella that can be blocked or warned to prevent users from accessing potentially malicious sites.
Which TWO are common 'secure access design patterns' in a hybrid cloud?
This is the current best practice for user access.
Why this answer
Standard patterns include ZTNA for users and secure transit gateways for inter-cloud traffic.
Which of the following is a requirement for using the Duo 'Remembered Devices' feature?
The session persistence relies on browser cookies.
Why this answer
Remembered Devices works by setting a cookie in the user's browser, which requires the browser to accept cookies from the Duo domain.
You are implementing Cisco Duo Device Health for a Windows fleet. Users report that they are blocked from accessing cloud apps despite having valid credentials. The Duo Health app reports a missing OS security patch. Which component is responsible for enforcing this posture check during the authentication flow?
Policies configured in the Duo Admin Panel enforce the specific requirement for OS security patches.
Why this answer
The Duo Central/Duo Access Gateway (DAG) or Duo SSO evaluate the health status passed by the Duo Device Health application before granting access.
Which Duo log would be most useful for troubleshooting a failure during the initial push notification delivery?
This provides transaction-level detail, including MFA method success/failure.
Why this answer
The Authentication Log provides a detailed breakdown of each step in the MFA process, including push delivery status.
You are designing a secure access path for a BYOD device. What is the most effective approach to ensure the device does not compromise the network?
This combination validates the identity and the security state of the device before granting access.
Why this answer
ZTNA ensures that the device is checked for posture and the user is authenticated before allowing access, regardless of device ownership.
When monitoring compliance in Cisco Defense Orchestrator (CDO), which action should you perform to identify out-of-sync configurations across your Cisco ASA and Firepower Threat Defense devices?
This triggers a scan to compare the local device state with the intended policy managed in CDO.
Why this answer
CDO provides a 'Conflict Detection' and 'Out-of-Sync' state indicator that identifies differences between the device config and the CDO-managed policy.
What is the role of a 'Policy' in Cisco Umbrella?
Policies are the core logic of the Umbrella platform.
Why this answer
A policy defines the set of rules (security, content, application control) applied to specific identities (users, networks, roaming clients).
What are TWO primary ways to trigger an orchestration workflow in SecureX?
Users can run workflows on demand.
Why this answer
Workflows can be initiated manually via the UI or automatically via external events sent through webhooks.
Which THREE items are considered primary components of the Cisco Umbrella 'Identity' structure when creating security policies?
Endpoints with the roaming client are a primary identity type.
Why this answer
Umbrella policies are applied based on identities, which include networks, roaming computers, and Active Directory objects.
When designing a Zero Trust architecture using Cisco Secure Access, how does the 'Device Posture' check specifically influence the access decision for a managed laptop?
Device posture checks are granular and look for specific configurations like certificates or managed state.
Why this answer
Device posture checks in Cisco Secure Access verify the health and security configuration of the endpoint before granting access to protected applications.
Which method is the most secure way to authenticate users for Cisco Secure Access?
SAML is the recommended standard for enterprise identity.
Why this answer
Integrating with an IdP via SAML ensures multi-factor authentication and centralized lifecycle management.
In Cisco Defense Orchestrator, why would an object show a 'Read Only' status?
CDO keeps imported objects read-only until they are explicitly managed.
Why this answer
Objects are often read-only in CDO if they were imported from a device and have not been 'claimed' or converted into a CDO-managed object yet.
You are setting up a secure hybrid cloud environment. How do you implement 'Micro-segmentation' between virtual machines in the same subnet?
Micro-segmentation requires enforcement at the workload level, not the network perimeter.
Why this answer
Micro-segmentation is achieved using host-based firewalls or SDN controllers (like those provided by Cisco Secure Workload/Tetration) to enforce policy at the individual workload level.
If you configure an API-based connector for a new SaaS app in Cisco Cloudlock, when does the initial scan typically begin?
The scan initiates as soon as authorization is granted.
Why this answer
After the OAuth handshake and the 'Save' of the connector configuration, Cloudlock triggers an initial scan of the application's environment (e.g., all files in Google Drive).
Which TWO aspects of threat response are improved by using SecureX orchestration?
Automation is faster than manual response.
Why this answer
Orchestration reduces response time by automating manual steps and minimizes human error through consistent, programmatic actions.
Which THREE mechanisms are commonly used by a CASB to enforce access control to SaaS applications?
Correct. API allows granular policy enforcement.
Why this answer
CASB enforces access via API integration, forward proxy, and reverse proxy architectures.
What is the primary goal of the 'Cisco SASE' framework?
The convergence of SD-WAN and SIG is the core of the SASE architecture.
Why this answer
Cisco SASE combines networking and security capabilities into a single cloud-native service to provide secure, optimized access to users wherever they are.
When performing automated threat hunting, you need to query multiple cloud platforms. Which SecureX feature enables this unified query?
Federated search aggregates results from multiple sources.
Why this answer
SecureX Threat Response allows for federated searches across integrated threat intelligence and security product APIs.
You are investigating an authentication failure. The log shows 'Error: User not found in directory'. What does this imply?
The lookup fails because the user is missing in the synced directory object.
Why this answer
This error occurs when the Duo cloud service attempts to check a user's status against the synced directory, but the user does not exist or was not successfully synced.
You observe that Cisco Secure Cloud Analytics is not reporting any 'Watchlist' alerts. What is the most likely reason?
No matches equals no alerts; this is the most common operational reason.
Why this answer
Watchlists in Secure Cloud Analytics are specific user-defined triggers; if no traffic matches those specific criteria, no alerts will be generated.
Which Cisco Cloudlock policy type should be used to detect when a user logs in from an unusual geographic location?
UBA monitors login patterns and locations.
Why this answer
User Behavior Analytics (UBA) specifically includes checks for 'Impossible Travel' and unusual login locations.
During the design of a SOAR playbook for cloud incident response, you need to ensure that evidence collection is preserved in a compliant manner. Which action is recommended when integrating with Cisco Secure Endpoint for forensic data collection?
This is the official method to automate forensic data collection and store it centrally in the cloud.
Why this answer
Using the 'Get File' or 'Get Forensic Snapshot' features within the Secure Endpoint integration ensures that artifacts are captured and stored directly into the Secure Endpoint cloud for later analysis, maintaining chain of custody.
In Cisco Umbrella, which component is used to associate internal IP addresses with Active Directory user identities for granular policy reporting?
Virtual Appliances identify users by querying AD and reporting the IP-to-user mapping to Umbrella.
Why this answer
The Umbrella Virtual Appliance (VA) facilitates the mapping of internal IP addresses to AD users and groups.
Which TWO methods are used to verify compliance against security policies in Cisco Defense Orchestrator?
Reporting provides audit visibility.
Why this answer
CDO verifies compliance via the 'Check for Changes' functionality and by generating reports on policy status.
You are creating a custom report in SecureX for compliance auditing. You need to include data from both Cisco Secure Endpoint and Cisco Secure Firewall. What is the requirement to make this possible?
Data ingestion is required before reporting can occur.
Why this answer
Both products must have their respective integration modules enabled and active in the same SecureX organization for their data to be available for combined reporting.
An administrator needs to ensure that only managed devices can access SaaS applications via Cisco Duo. Which configuration step is mandatory in the Duo Admin Panel to ensure the device is recognized as 'Managed'?
This combination ensures the endpoint reports its health data and identity to the Duo cloud.
Why this answer
To identify a device as managed, the administrator must deploy the Duo Device Health application and ensure the device certificate is present.
In SecureX orchestration, which object type is used to store sensitive API keys used by workflows?
Credential objects are specifically designed for secrets management.
Why this answer
Credential objects provide a secure way to store secrets, ensuring they are encrypted and not visible in plaintext within the workflow designer.
In Secure Access, how are 'Traffic Forwarding' profiles used?
Forwarding profiles manage the tunnel/proxy steering.
Why this answer
Traffic Forwarding profiles define which traffic (web, non-web, specific ports) should be sent to the Secure Access cloud.
What is the function of an Umbrella 'Integrations' key?
API keys allow external tools to interact with Umbrella.
Why this answer
API keys are used to integrate Umbrella with other systems like SIEMs or threat intelligence platforms to automate policy updates.
A user is experiencing 'Access Denied' when trying to access a cloud resource. You are using the SecureX 'Pivot' menu to investigate. What are you looking for in the logs?
Finding the specific policy that triggered the block is the goal of the investigation.
Why this answer
The Pivot menu allows you to jump to related logs; you are specifically looking for the 'Action' field set to 'Deny' along with the corresponding policy ID.
Which THREE factors influence the user experience when using Duo Passwordless?
Essential for the protocol.
Why this answer
Duo Passwordless experience is shaped by the platform authenticator, the configured policy, and the application's support for WebAuthn.
Which THREE components are part of the Cisco SecureX suite?
A core module of SecureX.
Why this answer
SecureX includes threat response, orchestration, and dashboarding as its primary components.
You are implementing Cisco Secure Access and need to configure a Global Policy that restricts access to unsanctioned SaaS applications based on their risk score. Where should this policy be applied in the Secure Access dashboard?
The CASB section within Web Policies is the designated location for controlling SaaS app access via risk scoring.
Why this answer
Cloud Access Security Broker (CASB) settings within the Secure Access portal allow for application risk scoring and policy enforcement.
In the context of SASE, what is the primary role of the 'Global Anycast Network'?
This is the core benefit of anycast for SASE performance.
Why this answer
Anycast allows the enterprise to use a single IP address to reach the nearest Umbrella data center, improving performance and reliability.
Which THREE conditions must be met for a user to be able to use the 'Self-Service Portal' for device enrollment?
This is the policy trigger.
Why this answer
Self-service enrollment requires directory integration, an accessible URL, and an enabled policy.
Which report in Cisco Umbrella provides the most direct view of security threats identified in your environment?
This is the primary report for threat analysis.
Why this answer
The Security Activity report details all blocked threats, including malware, phishing, and command-and-control attempts.
What is the primary function of the Duo 'Telephony Credits'?
These methods consume telephony credits.
Why this answer
Telephony credits are used specifically for SMS and voice-call-based MFA, as these incur costs from telecommunication providers.
Which TWO of the following are benefits of using the Duo Authentication Proxy for on-premises AD integration?
The proxy encrypts all traffic to the cloud.
Why this answer
The proxy handles directory syncing and provides a secure, encrypted tunnel to the Duo cloud.
Which component in the Cisco SecureX suite allows you to build custom, automated security tasks?
Orchestration is the engine for building custom workflows.
Why this answer
SecureX Orchestration is the low-code/no-code engine used to create workflows and automate tasks.
You are setting up visibility for a hybrid-cloud environment using SecureX. Which THREE of the following represent valid data sources that can be integrated to provide comprehensive threat context? (Choose three.)
FMC provides network-level flow and threat detection telemetry.
Why this answer
SecureX integrates natively with Umbrella, Secure Endpoint (AMP), and Secure Firewall (Firepower) to aggregate telemetry.
You need to ensure that all web traffic from a branch office is inspected by the Umbrella SIG. Which configuration step is mandatory on your perimeter router?
PBR is used to divert specific traffic into the tunnel interface.
Why this answer
The router must be configured to route traffic destined for the internet through the tunnel interface pointing to the Umbrella data center.
When designing an automated threat response for cloud-native applications, why is it critical to include a 'Human-in-the-loop' (HITL) step in the orchestration workflow?
This provides a safety mechanism for critical actions like isolating production assets.
Why this answer
HITL is critical in automated workflows to prevent false positives from causing business disruption, especially when the remediation involves blocking critical services or isolating production servers.
A company wants to prevent users from bypassing security policies by using unauthorized VPNs or proxies. Which feature in Cisco Umbrella should be enabled to mitigate this risk?
Categorization allows for the blocking of known VPN and proxy services used to circumvent policies.
Why this answer
The 'Proxy and VPN' category in the Umbrella destination lists allows administrators to block access to services that can bypass security filters.
Which component of Cisco's secure cloud access architecture is responsible for performing URL filtering and malware scanning on traffic destined for SaaS applications?
Umbrella performs URL filtering and proxying of web traffic.
Why this answer
Cisco Umbrella acts as a secure web gateway (SWG) to inspect traffic flow and perform URL filtering and malware analysis.
A administrator wants to implement 'Strict' device health checks. What happens if a device reports an unknown OS version?
Strict policies enforce a 'deny' if the device does not explicitly meet health requirements.
Why this answer
Under a 'Strict' policy, if the device health app cannot confirm a supported, patched OS, the access request is denied.
A company is using Cisco Tetration (Secure Workload) for data center visibility. They need to generate a compliance report that shows communication flows between 'PCI-scoped' and 'Non-PCI-scoped' workloads. Which feature should be used to define this boundary?
Scopes allow for granular grouping and policy analysis within defined segments of the data center.
Why this answer
The 'Scopes' feature in Secure Workload allows for the hierarchical organization of assets and the definition of boundaries for policy analysis and reporting.
The router must know where to send the tunneled traffic.
Why this answer
Configuring an IPsec tunnel requires defining the tunnel details, the IKEv2 settings, and the specific traffic selectors or identity management.
When syncing users from Active Directory to Duo, what is the role of the 'Duo Authentication Proxy'?
The proxy is used to sync directory objects to the cloud.
Why this answer
The proxy acts as the bridge that performs LDAP/AD queries and pushes user objects to the Duo cloud.
Which THREE components are required to successfully deploy a webhook-based trigger for SecureX orchestration?
Required to verify the source of the webhook.
Why this answer
Webhooks require a defined endpoint, an authentication method (often an API key/token), and a payload format to function correctly.
Which TWO methods can be used to bypass Duo authentication in an emergency?
Effective method for temporary emergency access.
Why this answer
Temporary bypass codes and a 'Bypass' policy setting for a specific user group are the standard emergency options.
Which THREE of the following are supported by the Duo Authentication Proxy?
Supported via specific agent/proxy workflows.
Which Cisco Umbrella report provides the most granular visibility into the specific security categories triggered by user traffic?
Activity Search offers the most granular data regarding policy hits and category blocks.
Why this answer
The 'Activity Search' report allows administrators to filter by category, identity, and destination to identify specific security violations.
Which THREE factors should be considered when designing an IaaS security architecture using Cisco Secure Workload (formerly Tetration)?
Policies should be tied to workload identity rather than IP addresses.
Why this answer
Secure Workload focuses on visibility, micro-segmentation, and policy enforcement across hybrid clouds.
What are TWO benefits of integrating Cisco Secure Email with SecureX orchestration?
Can remove malicious emails from all user mailboxes.
Why this answer
Integration allows for automatic extraction of malicious indicators from emails and the ability to purge threats across the organization.
Practice SCAZT by domain
Target a specific domain to shore up weak areas.