CCNA Network And Cloud Security Questions

Destination Lists let administrators group domains and IPs into custom lists, then apply block or allow actions to those lists within policies. This satisfies the categorisation requirement by overriding default category verdicts with organisation-specific exceptions, giving granular control beyond standard content categories.

Activity Search records the identity that initiated each request, satisfying the requirement to surface the requesting user. Umbrella logs this as the identity field, populated from directory or roaming client authentication, letting administrators trace DNS and web activity back to a specific user or device during investigations.

The VA forwards internal client DNS queries to Umbrella alongside the client's AD user identity, enabling per-user policy and reporting for on-premises devices. This satisfies the identity-based reporting requirement in a local Active Directory environment.

Access rules governing cross-segment traffic enforce least-privilege east-west control, ensuring only explicitly permitted flows traverse segment boundaries. This directly satisfies the segmentation requirement by preventing lateral movement between workloads, rather than merely isolating them at the perimeter. Without such rules, segments remain logically separated but effectively reachable, defeating the strategy's containment objective.

Selective TLS decryption allows inspection of chosen SaaS traffic while bypassing categories such as banking and healthcare to preserve privacy. Adding pinned applications to a decryption exemption list prevents certificate errors and broken functionality. Together, these features meet the inspection, privacy, and application compatibility requirements without globally disabling decryption.

Application Control identifies and blocks or allows traffic by cloud application, using Umbrella's application signatures and categories. This satisfies the requirement to restrict specific apps such as Dropbox independently of broad domain or content filtering.

Umbrella's selective proxy intercepts only the traffic it is configured to inspect, so a 'Proxy' explanation confirms the request was redirected to that proxy and blocked there, rather than by DNS resolution or a firewall rule. This satisfies the stem's requirement to identify the enforcement point that generated the Domain Blocked event.

An unadjusted tunnel MTU lets large packets exceed the path limit, so they are dropped rather than fragmented, producing timeouts despite the IPsec tunnel showing up. Lowering the tunnel MTU prevents this black-holing, satisfying the scenario's requirement that oversized traffic traverse the tunnel successfully.

Global Policy Access Rules define the ordered rule logic that evaluates traffic and applies block or allow actions based on destination risk. Configuring cloud application risk conditions here satisfies the requirement to block apps by risk level.

Legacy applications with hardcoded proxy IP addresses or ports cannot automatically discover the new SIG egress points, so their traffic fails once the explicit proxy is retired. This satisfies the stem's focus on the primary migration challenge.

The Umbrella dashboard is the central management plane where administrators configure global DNS security policies, blocklists and allowed domains, then view activity and threat reports. This satisfies the stem by covering both policy configuration and reporting for DNS security.

An IP-based Network Identity registers the branch's static public IP as a known identity in Umbrella, so DNS requests from that address inherit the assigned policy without any on-site virtual appliance. This satisfies the no-local-appliance constraint.

Installing the Umbrella Root CA certificate lets the endpoint trust certificates the proxy re-signs, eliminating the mismatch. Umbrella performs SSL inspection by intercepting TLS and presenting its own certificate; without the root CA in the local trust store, validation fails. This satisfies the requirement for a permanent fix rather than a bypass.

Connector logs on the host server record the actual LDAP bind, directory query and authentication failures occurring during sync, which is precisely the diagnostic evidence the scenario requires. Without them, you cannot identify whether the fault lies in credentials, network reachability or directory permissions.

Zero Trust Network Access enforces per-application, identity-based access rather than broad network-level connectivity, directly satisfying the suite's requirement for least-privilege remote access. Cisco Secure Access integrates ZTNA with Microsoft Entra ID for continuous verification, so remote users reach only authorised private applications without full VPN tunnel exposure.

Anycast advertises the same resolver IP from every point of presence, so each DNS query routes to the nearest data centre automatically. This satisfies the low-latency requirement by removing backhaul to a single origin, unlike unicast designs where distance dictates response time.

A friendly name labels the network identity so administrators can distinguish sites within the Umbrella dashboard. It satisfies the identification requirement alongside the public IP address, which provides the actual identity anchor. Without a recognisable label, multiple network identities sharing similar addresses become unmanageable during policy assignment and troubleshooting.

Umbrella's Proxy and Filter Avoidance category covers personal VPNs and anonymisers, so blocking it in the Web Policy prevents users tunnelling around the SIG. This satisfies the stem's requirement to stop VPN-based bypass using Cisco products.

Activity Search in the Secure Access dashboard logs every request with its matched policy rule, so filtering by user and destination domain reveals the exact blocking rule. This directly satisfies the stem's requirement to identify the specific rule, unlike traffic captures or endpoint logs that show the block without naming the enforcing policy.

Browsers retrieve PAC files over HTTP or HTTPS when configured for automatic proxy discovery, so the file must be published on a reachable web server. Cisco Secure Access does not host PAC files itself; it relies on an external HTTP/HTTPS endpoint.

Policies defined in the Umbrella dashboard are pushed to the roaming client, so without an organisation policy configured there, the client has no ruleset to enforce and the user cannot be managed. The dashboard policy is the prerequisite that makes management effective.

Roaming Client deployment configuration, including profiles and installer packages, is administered from Dashboard > Deployments. That section controls which endpoints receive the client and how policies are applied, rather than per-identity settings under Policies or Reporting.

Running `nslookup debug.opendns.com` queries Umbrella's diagnostic hostname, which returns resolver identity and policy details only when the client's DNS traffic actually reaches Umbrella's resolvers. This directly satisfies the stem's requirement to verify local resolver usage, unlike generic lookups that succeed regardless of which resolver answers.

DNS queries are a traffic type protected by a SIG, which inspects them at the cloud edge to block malicious domains before connection. This satisfies the stem's requirement, alongside web and SaaS traffic, for typically protected categories.

Access Rules and Policies define which users and devices may reach specific resource groups, enforcing isolation through identity-aware authorisation rather than network constructs. In Microsoft Entra ID, Conditional Access policies evaluate signals such as user, device compliance and location before granting access, satisfying the segmentation requirement by logically separating resources per policy scope.

SAML 2.0 is the federated authentication protocol used to integrate Cisco Secure Access with an external identity provider, exchanging signed assertions to authenticate users. The IdP authenticates and asserts identity; Secure Access consumes the assertion for policy enforcement and access decisions.

Internal Networks define on-premises subnets and public egress IP addresses, letting Umbrella recognise traffic originating from your offices rather than remote users. This satisfies the stem's requirement by mapping those specific locations to identities and policies, so requests from those sites are attributed correctly instead of being treated as roaming or unknown.

The Umbrella Roaming Client installs on the endpoint and forwards DNS queries to Umbrella regardless of network location, so policy is enforced when the user is off-VPN. This satisfies the consistent-enforcement constraint by removing dependence on corporate network or VPN tunnel presence.

The Umbrella AD Connector synchronises on-premises Active Directory users and groups to the Umbrella dashboard, letting policies and reports resolve internal IP addresses to named users. Without it, user-level reporting is unavailable, satisfying the stem's requirement.

The Umbrella DNS module intercepts DNS queries from the endpoint and resolves them through Umbrella's cloud security platform, enforcing domain-level protections. This satisfies the requirement to secure name resolution within the Secure Access AnyConnect stack.

An IPsec tunnel preserves the existing firewall's port-based policy by encapsulating all traffic to the Cisco SIG headend, so inspection and filtering continue at the SIG without redefining on-premises rules. This satisfies the requirement to forward traffic while maintaining security policy consistency.

Umbrella's Log Management API exposes event data programmatically, letting a SIEM poll and ingest logs directly without intermediary storage. This satisfies the requirement to export logs for SIEM analysis by providing a native, real-time pull mechanism rather than relying on file or bucket delivery.

Deploying the Umbrella Root CA satisfies the requirement for SSL decryption by enabling Umbrella to act as a trusted man-in-the-middle. The root certificate must be installed on endpoints so they trust the re-signed certificates Umbrella generates, allowing inspection of encrypted traffic without browser warnings.

Selective Proxy inspects the destination domain against Umbrella's category database, proxying only requests matching configured categories while sending all other traffic direct. This satisfies the stem's requirement to differentiate routing per destination, since categorisation is the sole decision axis rather than port, protocol or user identity.

The Umbrella Virtual Appliance sits on-premises and maps internal IP addresses to Active Directory identities, so reports show real usernames rather than anonymous addresses. This satisfies the requirement to identify internal clients in Umbrella reporting.

Installing the Cisco Secure Access Root Certificate on client devices establishes the trust anchor needed for the service to intercept, decrypt and inspect TLS sessions. Without it, clients reject the re-signed certificates and HTTPS traffic bypasses inspection entirely.

A cloud-native architecture delivers DNS-layer filtering through globally distributed points of presence, removing on-premises appliance capacity limits and simplifying policy enforcement for roaming users. This satisfies the stem's benefit requirement by providing scalable, low-latency resolution without local infrastructure.

A Tunnel Exclusion removes the specified internal IP ranges from the tunnel's interesting traffic, so that traffic routes natively via the local network instead of being sent to the SIG and blocked by default policy.

Security Settings contains the Newly Seen Domains option, which applies a block or warn action to domains Umbrella has not previously observed. Enabling the warn action there delivers the required user warning before visiting newly registered domains.

Policies in Cisco Umbrella define the security and filtering rules applied to identities, specifying which domains, categories, or destinations are blocked or allowed. This satisfies the stem's requirement by mapping rule sets to users, groups, or networks, enabling granular enforcement of acceptable-use and threat-blocking controls across the organisation.

Roaming Computer is a primary Identity component because the Cisco Umbrella roaming client installs on endpoints, letting policy follow the user's device wherever it connects. This satisfies the stem's requirement for identity-based policy enforcement, since the roaming computer itself becomes the identity object that security rules target.

SAML 2.0 federation delegates authentication to an external identity provider, so credentials never reach Cisco Secure Access and MFA, conditional access and directory policy remain centrally enforced, satisfying the stem's requirement for the most secure authentication method.

Traffic Forwarding profiles specify the routing method — such as IPsec tunnels, PAC files, or AnyConnect — that endpoints and network devices use to reach the Secure Access cloud gateway, determining how traffic is steered for inspection.

An Integrations key authenticates API calls between Umbrella and third-party or management platforms, enabling automated policy changes and log retrieval without manual console work. This satisfies the requirement to automate API-based policy and log management programmatically.

CASB controls within the Web Policy govern sanctioned and unsanctioned SaaS application traffic, including risk-score-based blocking. Placing the rule under Policy > Access Policies > Web Policy > CASB enforces the restriction globally against unsanctioned apps, matching the stated requirement.

Security Activity aggregates threat detections from Umbrella's DNS, web and firewall layers, listing each blocked or allowed request with its classification and identity. This directly satisfies the stem's requirement for the most direct view of identified threats, unlike traffic or top-domain reports, which show usage rather than verdicts.

Policy-based routing forces branch-originated web traffic into the Umbrella SIG tunnel by matching source subnets and redirecting next-hop, rather than following the default route. This satisfies the stem's mandatory requirement that all web traffic be inspected, since standard destination-based routing would bypass the tunnel entirely.

Activity Search Report exposes the individual security categories triggered by each request, satisfying the stem's demand for granular, per-category visibility. Unlike aggregate summaries, it logs destination, identity and category verdict per event, letting you trace exactly which policy category a user's traffic hit.

This is correct because DNS logs in Cisco Umbrella record all DNS queries made by internal hosts, including the domain name requested and the source IP address. By examining DNS logs, the analyst can see which host attempted to resolve the malicious domain, aiding in identifying the infected device.

A cloud-delivered SIG applies policy in the cloud, so roaming and remote users receive identical web and DNS enforcement wherever they connect, directly satisfying the stem's off-network protection constraint that an on-premises firewall cannot meet.

SSL inspection requires Umbrella to re-sign traffic with its own certificate, so clients must trust the Umbrella Root CA. If that certificate is missing from the client's trust store, every intercepted TLS connection fails validation, producing the 'SSL Inspection Error' in your logs.

The policy engine evaluates the time of the request as a contextual condition, allowing administrators to apply different rules during and outside business hours. This satisfies granular policy control, alongside identity and destination, when resolving each DNS query.