CCNA Application And Data Security Questions

Effective remediation requires an action (what to do) and a trigger condition (when to do it based on policy severity).

Cloudlock provides multiple notification channels, including email alerts and integration with webhooks/ticketing systems.

Cloudlock's UBA (User Behavior Analytics) module uses machine learning to establish a baseline and flag anomalies.

Quarantine moves the original file to a secure location and replaces it with a placeholder (tombstone) file; the user can typically only access the tombstone.

Thresholds allow you to define how many times a violation must occur (or how many instances of sensitive data are found) before an incident is triggered, reducing noise.

A CASB acts as a gatekeeper, sitting between users and cloud services to enforce security policies and monitor activity.

Connector warnings usually stem from insufficient API permissions (scopes) or expired credentials/tokens.

The Umbrella Activity Search is the primary tool to see why a specific request (domain/URL) was blocked by policy.

Duo's Device Health and Trusted Endpoint features specifically check for device management status before allowing access to applications.

Cisco Secure Access with device posture checks ensures that only devices meeting minimum security requirements can access defined SaaS applications.

An incident is an alert generated when a specific policy rule is triggered by a user or data action within a protected SaaS app.

Shadow IT identification is based on traffic volumes, application category, and risk scores assigned by Umbrella.

The CASB category in Umbrella allows admins to enforce policies specifically for cloud applications, such as blocking uploads to unsanctioned tenants.

Cisco Cloudlock allows scoping of policies to specific application objects and exposure levels. Selecting the 'Public' exposure flag ensures that only data accessible to unauthorized external users triggers the alert.

Cloudlock provides the ability to audit third-party app permissions and revoke them if the application is deemed risky.

DLP policies rely on content inspection patterns (regex/keywords) and scope (the folders/apps) to function correctly.

Cloudlock provides automated remediation actions including changing the permission level of the file or deleting the file entirely.

Cisco Cloudlock's Threat Intelligence engine correlates user login logs with known malicious IP reputation lists.

Cloudlock policies require the specific permission level (e.g., 'Public' or 'Anyone with link') to be explicitly selected in the 'Exposure' criteria of the policy engine.

The 'Disable User' or 'Suspend User' action is the standard response to isolate a compromised identity and prevent further access.

UBA tracks user activity and can flag anomalies like impossible travel, mass file downloads, and unusual access times.

Custom Regex patterns allow you to define organization-specific sensitive data formats, such as employee ID numbers or unique project code formats, that aren't in standard templates.

Duo allows for granular access control based on user location, device security posture, and authentication methods.

The Cisco Cloudlock Data Loss Prevention engine uses specific policy categories to identify PII/PCI data, and 'Data Exposure' is the correct category for monitoring sharing settings.

Cloudlock policies can trigger automated actions such as applying sensitivity labels or encryption policies in the underlying SaaS application upon detecting sensitive content.

Duo's policy engine can require that endpoints have disk encryption enabled, up-to-date operating systems, and activated security software.

Risk ratings are calculated based on an application's data privacy policies, compliance certifications, and security features.

App Discovery allows administrators to see which shadow IT applications are in use and decide whether to block or monitor them via policy.

CASB provides visibility, compliance, threat protection, and data security for cloud applications.

Cloudlock incidents provide detailed context including the user involved, the severity of the violation, and the specific file or resource affected.

Managed applications allow for granular visibility and enforcement policies to be applied specifically to those apps, as opposed to generic web traffic.

SSL inspection decrypts traffic, allowing the proxy to inspect the actual payload, which is essential for granular visibility and DLP enforcement within SaaS apps.

Umbrella can work with IdPs (like Duo or Azure AD) to enforce SAML-based authentication and ensure consistent security posture.

Cisco Cloudlock is an API-based CASB that monitors data at rest in SaaS applications by connecting directly to the cloud provider's APIs.

Cisco Secure Access uses Access Policies that integrate with Identity and Context-Aware settings to enforce location-based access to SaaS applications.

The App Discovery report provides insights into application categories, risk levels, and usage statistics per app.

Cisco Cloudlock requires OAuth 2.0 scopes granted via an administrative consent process to perform actions on behalf of the application in the O365 tenant.

Shadow IT reporting within the App Discovery feature shows a list of applications accessed by users that have not been sanctioned by the IT department.

After the OAuth handshake and the 'Save' of the connector configuration, Cloudlock triggers an initial scan of the application's environment (e.g., all files in Google Drive).

CASB enforces access via API integration, forward proxy, and reverse proxy architectures.

User Behavior Analytics (UBA) specifically includes checks for 'Impossible Travel' and unusual login locations.

Cisco Umbrella acts as a secure web gateway (SWG) to inspect traffic flow and perform URL filtering and malware analysis.

Tenant Restrictions (often via headers) allow you to ensure that users can only log in to your specific organization's tenant for SaaS applications.

Shadow IT refers to applications or software used within an organization without explicit IT department approval.

Cloudlock uses a wide variety of predefined regex and pattern matching templates for common sensitive data, including credit cards, social security numbers, and passport numbers.

The 'Security Audit' or 'Incidents' dashboard provides a breakdown of users involved in data exposure incidents in SaaS applications like Teams.