CCNA Application And Data Security Questions

Selecting the remediation action determines what Cloudlock does once a policy matches — delete, notify or quarantine the offending item. Without an action, the workflow detects violations but never prevents data loss, so action selection is critical to the stem's remediation outcome.

Email notification satisfies the requirement by delivering policy-violation alerts directly to an administrator's inbox through Cisco Cloudlock's built-in notification engine. Cloudlock generates the alert when a policy rule matches monitored content, then dispatches it via SMTP to configured recipients, requiring no additional infrastructure or third-party integration.

User Behaviour Analytics baselines each user's normal activity and surfaces deviations from it, exactly matching the requirement to view users behaving outside their normal baseline. The dashboard aggregates these anomalies, distinguishing UBA from static policy or DLP-based Cloudlock features.

Cloudlock replaces quarantined content with a tombstone placeholder, so the user can still open and read that tombstone file to see the quarantine notice and metadata. This satisfies the scenario's requirement for an action available on a quarantined file.

The Threshold sets how many matching occurrences within the policy's scope must accumulate before Cisco Cloudlock raises an alert, preventing single benign events from generating noise. It defines the minimum count that triggers notification, directly matching the stated significance.

A CASB sits inline between cloud users and cloud applications, enforcing policies such as authentication, authorisation, data-loss prevention and threat protection on that traffic. This directly satisfies the stem's requirement for the primary role: mediating and controlling access, rather than merely monitoring or configuring the cloud service itself.

Cloudlock's API connector authenticates to Google Workspace through a service account; if its scopes are revoked or misassigned, the connector cannot enumerate users and files, triggering the Warning status. Verifying these permissions restores the API access the connector requires.

Umbrella's Activity Search dashboard records every Intelligent Proxy verdict, showing the exact identity, destination, and category that triggered the block. This directly satisfies the troubleshooting constraint by revealing why the upload was denied, rather than guessing at policy or inspecting endpoint logs.

Secure Access device posture checks verify endpoint compliance attributes before granting access, ensuring only managed devices reach Box. This satisfies the stem's requirement that sensitive data be accessible exclusively from managed devices, enforced at the identity-aware proxy rather than relying on user credentials alone.

An Incident in Cisco Cloudlock is generated when a policy violation is detected, alerting administrators so they can investigate and respond. It satisfies the stem's requirement by representing the notification mechanism for policy breaches, distinct from dashboards or reports that merely display data without triggering admin alerts.

Umbrella's Shadow IT report ranks discovered cloud applications by the volume of traffic generated, exposing which unsanctioned services consume the most bandwidth. Traffic volume is one of the three classification criteria the stem requests, alongside category and risk level.

Cisco Umbrella's CASB category enforces granular control over sanctioned and unsanctioned cloud applications, including blocking uploads or restricting actions. This governs application usage and controls data movement, satisfying the requirement to manage shadow IT and prevent data exfiltration.

Setting the exposure filter to 'Public' scopes the PII inspection engine to objects with public sharing, satisfying the stem's public-facing constraint. Cloudlock evaluates exposure metadata alongside content matches, so detection triggers only when sensitive data lands in a publicly accessible object rather than any internal record.

Quarantine moves the offending third-party application into a restricted state, blocking user access and preventing further data exposure. Cloudlock's OAuth policy supports this as a direct enforcement action against apps granted access to user data.

Scoping to specific folders or users confines inspection to the exact repositories where sensitive data resides, preventing unrelated content from diluting classification accuracy. Microsoft Purview DLP evaluates only in-scope locations, so precise scoping satisfies the stem's requirement for accurate sensitive-data classification rather than broad, noisy matching across the tenant.

Deleting the file removes the offending content from O365 entirely, eliminating exposure of the DLP-violating data. This satisfies the stem's remediation requirement because Cloudlock's response actions include deletion, applying directly to the file that breached policy.

Cisco Cloudlock supports a policy action that applies a Microsoft Information Protection sensitivity label to matching files. This action enriches the file with the chosen label, enabling downstream encryption and access controls without interrupting the user, which directly fulfills the requirement to label files that match the custom regular expression.

Selective SSL decryption allows inspection of traffic to the sanctioned cloud app category while bypassing decryption for financial services, preserving privacy. Cloudlock DLP policies can then analyze the decrypted uploads for sensitive data. This meets both the security need to detect data exfiltration and the privacy requirement for personal banking.

Cloudlock's DLP engine supports both predefined detectors (e.g., credit card numbers, PII) and custom regular expressions. It scans the content of files stored in connected cloud applications to identify sensitive data and enforce policies. This allows organizations to protect data based on content, not just metadata, meeting the requirement to understand inspection capabilities.

Suspending the account immediately revokes the user's sign-in and API access, halting any further data exfiltration from that identity. It is a direct, automated containment action available through Cloudlock response workflows, satisfying the requirement to stop exfiltration at once.

Cloudlock's User Behaviour Analytics engine baselines normal activity and flags anomalies, so bulk download volumes deviating from a user's established pattern trigger detection. This satisfies the stem's monitoring requirement by surfacing mass file download events as a behavioural risk indicator, distinct from static DLP policy matching.

Custom Regex patterns let you define your own matching expression, so Cloudlock can identify sensitive data that does not conform to any built-in detector's format. This satisfies the need to detect non-standard sensitive data formats that predefined patterns would miss.

Duo policies can evaluate the endpoint's operating system version as a condition, allowing administrators to deny or step-up access from outdated or unpatched platforms. This satisfies the requirement to restrict sensitive SaaS application access based on device posture.

Data Exposure policies in Cisco Cloudlock inspect content shared publicly or externally, matching the requirement to detect credit card numbers exposed in Salesforce. Other categories cover malware, privileged users or compliance, not public sharing of regulated data.

Security software active is a Duo device health indicator, confirming antivirus or endpoint protection is running and up to date via the Device Health agent. Requiring it in the policy denies access from unprotected endpoints, satisfying the device health condition in the stem.

Cloud Application definitions let App Discovery classify traffic to unsanctioned SaaS, exposing Shadow IT usage so it can be governed. This satisfies the requirement to identify and control applications users adopt without IT approval, rather than merely blocking domains.

A CASB inspects sessions inline or via API to detect malware, compromised accounts, and anomalous behaviour, then blocks or quarantines the activity. This satisfies the stem's application-security requirement by enforcing threat controls on cloud traffic in real time.

Helps prioritize the response.

Managed configuration applies identity-based policies to the SaaS application itself, enabling granular policy enforcement and visibility into user activity and data. This satisfies the stem's focus on the primary benefit of the Managed SaaS deployment model.

SSL inspection decrypts TLS sessions between users and SaaS providers, letting Umbrella examine payload contents rather than just SNI and certificate metadata. This deep packet inspection exposes application-level activity, satisfying the requirement to see SaaS content beyond encrypted headers.

Duo MFA adds a second authentication factor at the identity layer, satisfying the stem's requirement for secure user authentication. Umbrella's integration with Duo enforces push or passcode verification before SaaS access is granted, so compromised passwords alone cannot authenticate a user.

Cisco Cloudlock connects to SaaS platforms through their APIs, scanning stored objects and sharing settings to detect sensitive data, malicious apps and risky permissions. This API-based inspection of data at rest satisfies the stem's requirement for visibility and control over sanctioned and unsanctioned SaaS usage.

Secure Access Policy rules evaluate identity, device posture and geolocation at the application layer, letting you permit or block a named SaaS app per user location. This is the tool that enforces the geolocation-based restriction the scenario demands.

App Discovery assigns each discovered cloud application a risk score derived from Cisco's cloud security intelligence, letting administrators rank shadow IT by threat level. This satisfies the stem's requirement for information typically shown in that report.

Cisco Cloudlock needs OAuth 2.0 delegated permissions so it acts on behalf of an authorised administrator within Microsoft Entra ID, obtaining scoped tokens to enumerate and remediate content such as removing malicious file shares, without storing privileged credentials.

App Discovery analyses traffic logs to identify cloud applications in use, including unsanctioned ones, without requiring agents or proxies on endpoints. It satisfies the stem's requirement to detect an employee accessing a non-approved cloud app, reporting that activity through the Umbrella dashboard's discovered apps inventory.

API-based connectors in Cisco Cloudlock begin scanning as soon as the configuration is saved, satisfying the stem's "initial scan" timing. Unlike proxy or log-based connectors, which rely on traffic or ingested events, API connectors pull data directly, so no waiting period or scheduled trigger delays the first scan.

API-based integration lets a CASB reach directly into the SaaS tenant via published APIs, applying policy to data at rest and to activities that bypass the proxy entirely. This satisfies the stem's enforcement requirement for managed cloud apps, complementing inline mechanisms by governing sanctioned-app content and user actions out-of-band.

User Behaviour Analytics baselines each user's normal sign-in patterns and flags logins from unusual geographic locations, satisfying the requirement to detect anomalous access. Unlike content-based policies, which inspect data at rest or in transit, UBA evaluates identity and session context, making it the appropriate Cisco Cloudlock policy type for geographic anomaly detection.

Cisco Umbrella enforces DNS-layer and secure web gateway controls, performing URL filtering and malware scanning inline for SaaS-bound traffic. It satisfies the stem's requirement for a dedicated cloud security component, unlike identity brokers or CASB-only offerings, because inspection occurs at the DNS and web proxy layers before sessions reach the SaaS application.

Tenant Restrictions inspects the OAuth token's tenant identifier, blocking sign-ins to any Microsoft 365 tenant other than your corporate one. This satisfies the stem's constraint of permitting O365 access while confining users to the sanctioned tenant, unlike blanket category blocking.

Shadow IT precisely names unsanctioned cloud application use by employees, satisfying the stem's requirement for the term describing unauthorised cloud usage. It covers any application procured or used without IT approval, including SaaS tools, distinguishing it from sanctioned deployments governed through Microsoft Entra ID and organisational security policy.

Passport numbers are structured, country-specific identifiers that Cloudlock's DLP engine detects through predefined regex patterns and checksum validation, satisfying the stem's pattern-matching requirement. Unlike free-text fields, their predictable alphanumeric format enables reliable classification across cloud traffic, making them a commonly supported data type.

The Incidents dashboard under Platform surfaces policy violations with the offending user and file details, so the administrator can pinpoint exactly who shared the sensitive data. It satisfies the stem's need to identify specific users rather than just viewing aggregate activity.