50 questions · User And Device Security · All types, answers revealed
Which TWO of the following are valid Duo authentication methods that do not require an internet-connected mobile device for the user?
Works offline.
Why this answer
Hardware tokens and SMS passcodes (if telephony is available) or bypass codes work without the Duo Mobile app.
An organization requires that users on iOS devices must have a passcode enabled to access cloud resources. Which Duo feature enforces this?
This policy allows enforcing device settings like screen locks for mobile access.
Why this answer
Duo Device Health (or mobile posture checks) can inspect for common mobile security settings, such as screen locks/passcodes.
Which THREE items are included in a Duo Authentication Log entry?
Essential for troubleshooting.
Why this answer
The logs contain the time, the username, and the result (success/failure) of the transaction.
A user's device is marked as 'Out-of-Date' in Duo. How does the system determine this status?
The Health application actively reports the version, which the policy evaluates.
Why this answer
The Duo Device Health application collects system information and compares the OS version against the policy defined in the Duo Admin Panel.
A security engineer is configuring Duo Authentication for Microsoft 365. The organization requires that users must be prompted for MFA only when accessing cloud resources from outside the corporate network. Which configuration setting in the Duo Admin Panel achieves this?
The Authorized Networks feature in Duo policies allows defining specific ranges where MFA can be bypassed.
Why this answer
Duo Network Policies allow for location-based access control, permitting bypass or mandatory MFA based on IP ranges.
Which TWO pieces of information are used by the Duo Authentication Proxy to identify which application is sending an auth request?
Matches the client to the configuration.
Why this answer
The proxy identifies incoming traffic by the shared secret and the IP address or port of the sending device.
When integrating Duo with an application that uses the OIDC protocol, where are the 'Client ID' and 'Client Secret' configured?
This is where the OIDC parameters are created.
Why this answer
The client ID and secret are generated within the Duo Admin Panel application configuration and provided to the OIDC-compliant application.
Which THREE settings are part of the 'Authentication Policy' in the Duo Admin Panel?
Controls user experience during MFA.
Why this answer
Authentication policies control the MFA prompt, remembered device settings, and location-based access.
An organization wants to restrict access to Salesforce to specific IP addresses. Where should this policy be configured?
Policies in the Duo Admin Panel are assigned to specific applications.
Why this answer
Policies are applied per application in the Duo Admin Panel to ensure granular control.
An organization wants to use Duo for both Windows Logon and Cloud SSO. What is the difference in deployment?
The Windows Logon agent is a mandatory local installation.
Why this answer
Windows Logon requires the Duo Authentication for Windows agent, whereas Cloud SSO uses the Duo cloud IDP.
How does Duo protect an application that does not support modern authentication protocols?
This is the classic way to protect legacy systems.
Why this answer
Duo uses the Authentication Proxy to wrap or intercept traffic (like RADIUS) and force an MFA prompt.
What is the primary benefit of the Duo Universal Prompt compared to the traditional iframe-based prompt?
The redirect ensures the user interacts with a secure, Duo-controlled domain.
Why this answer
The Universal Prompt is a modern, hosted redirect that improves security and provides a consistent interface across all applications.
A security auditor notices that Duo authentication logs show an 'Authentication Succeeded' status, but the user was denied access to the SaaS application. Which policy setting is the most likely cause?
Duo permits the MFA request to pass, then checks the health policy before passing the claim to the service provider.
Why this answer
If authentication succeeds but access is denied, the Duo policy likely includes a post-authentication check, such as device health or geo-blocking, that failed.
During a Duo enrollment phase, a user is required to install the Duo Mobile app. What is the main security purpose of the app in the MFA flow?
The app acts as a verified, trusted device for MFA.
Why this answer
The app provides a secure channel for Push notifications and generates TOTP codes, enabling cryptographically secure identity verification.
Which THREE actions can be taken by an administrator if a user's mobile device is reported as stolen?
Ensures the user sets up a new, safe device.
Why this answer
Administrators can deactivate the device, force a re-enrollment, or block the user account entirely to prevent unauthorized access.
You are deploying Duo Passwordless authentication. Which factor must be verified on the endpoint before a user can successfully authenticate?
WebAuthn platform authenticators such as Windows Hello or TouchID are mandatory for passwordless.
Why this answer
Duo Passwordless requires WebAuthn-compatible platforms (like macOS TouchID or Windows Hello) to store the cryptographic keys.
An administrator wants to audit all Duo administrative actions. Which log provides this information?
This logs all changes to policy, users, and applications by admins.
Why this answer
The 'Administrator Actions' log in the Duo Admin Panel specifically tracks changes made by administrators.
A security engineer is worried about 'MFA fatigue' attacks. Which Duo configuration is the best defense?
This requires explicit input from the user.
Why this answer
Number matching requires the user to interact with the login screen, proving they are looking at the actual request.
What is the primary function of the 'Duo Network Gateway'?
It creates a secure tunnel for web-based apps.
Why this answer
The Duo Network Gateway is a remote access solution that allows users to access private, on-premises applications without a VPN.
Which of the following describes the 'Duo Central' portal?
It provides a consistent experience for accessing cloud apps.
Why this answer
Duo Central is a user-facing dashboard that provides a single, secure gateway for users to access their applications.
Which TWO things must be done to successfully protect a legacy VPN with Duo?
VPN sends auth requests via RADIUS to the proxy.
Why this answer
You need to configure the VPN to point to the Duo Authentication Proxy for RADIUS, and define the proxy as a RADIUS client in the Duo Admin Panel.
Which THREE factors can be evaluated by Duo Device Health during an access request?
Standard check for managed devices.
Why this answer
Duo Device Health inspects disk encryption, OS updates, and antivirus status as part of its posture assessment.
Which TWO configuration parameters are required when setting up the Duo Authentication Proxy for an LDAP source?
Necessary for connectivity.
Why this answer
To connect to LDAP, the proxy needs the server address and the service account credentials to perform searches.
When configuring Duo Trust Monitor, what is the primary purpose of 'Baseline' behavior?
Trust Monitor learns user behavior patterns to flag anomalies.
Why this answer
Trust Monitor establishes a baseline of normal user activity to detect deviations that may indicate an account compromise.
In the context of the Duo Authentication Proxy, what is the 'fail_mode' parameter used for?
Safe mode allows access; closed mode denies it.
Why this answer
The 'fail_mode' (safe or closed) determines whether the proxy allows or denies access when it cannot communicate with the Duo cloud.
A company wants to prevent users from using personal devices for work. Which Duo policy is most effective for this?
Certificates act as a unique identifier for managed devices.
Why this answer
By enforcing 'Trusted Endpoints' and requiring a device certificate, only IT-provisioned and managed devices will be permitted.
An organization uses Duo Access Gateway (DAG) to protect on-premises applications. They want to transition to Duo SSO. What is the primary difference in architecture?
Duo SSO moves the IDP function to the cloud.
Why this answer
Duo SSO is a cloud-native IDP, whereas DAG acts as a local proxy requiring on-premises server infrastructure.
A user is attempting to access a cloud application protected by Duo SSO. The Duo prompt shows 'Access Denied: Your device is not running a supported browser'. Where is this restriction defined?
Duo policies allow administrators to restrict access based on browser versions and types.
Why this answer
Browser restrictions are defined within the Duo Policy applied to the specific application or user group.
What is the purpose of the 'Enrollment Email' sent by Duo?
This simplifies the onboarding process.
Why this answer
The enrollment email allows users to self-register their devices, reducing the burden on IT support teams.
Which THREE of the following are components of the Duo 'Trusted Endpoints' solution?
Provides the management state.
Why this answer
Trusted endpoints rely on device certificates, an management platform (like MDM), and the Duo policy to verify device identity.
Which Duo feature allows an administrator to visualize the percentage of users who have successfully registered their mobile devices?
The dashboard displays high-level enrollment statistics.
Why this answer
The Duo Admin Panel Dashboard provides analytics and reporting on enrollment progress.
Which Duo feature helps prevent phishing attacks by requiring the user to tap a button only after a verified authentication request?
The user must enter a number displayed on the login screen into the Duo Mobile app.
Why this answer
Duo Push with number matching ensures the user is actively responding to the specific login event, preventing 'MFA fatigue' and accidental approvals.
Which TWO pieces of information are required in the Duo Admin Panel to configure a new SAML application integration?
Required for SAML assertion delivery.
Why this answer
To link a SAML app, you need the Metadata file from the app or the manual entry of the Entity ID and Assertion Consumer Service (ACS) URL.
Which TWO of the following scenarios would lead to an 'Access Denied' message in the Duo Authentication Log?
Result is access denied.
Why this answer
An access denied message can be triggered by a policy failure (like geo-blocking) or a user explicitly canceling the push request.
A user is prompted for MFA but their phone is dead. Which administrative feature allows for a temporary bypass?
This allows the user to bypass the prompt for a limited time/count.
Why this answer
Administrators can issue a temporary 'bypass code' that is valid for a single use or a set duration.
Which mechanism does Duo use to integrate with non-SAML cloud applications?
The proxy allows legacy protocols to be protected by Duo MFA.
Why this answer
For applications that do not support SAML/OIDC, Duo uses the Authentication Proxy to bridge RADIUS or LDAP requests to the Duo cloud.
Which of the following is a requirement for using the Duo 'Remembered Devices' feature?
The session persistence relies on browser cookies.
Why this answer
Remembered Devices works by setting a cookie in the user's browser, which requires the browser to accept cookies from the Duo domain.
You are implementing Cisco Duo Device Health for a Windows fleet. Users report that they are blocked from accessing cloud apps despite having valid credentials. The Duo Health app reports a missing OS security patch. Which component is responsible for enforcing this posture check during the authentication flow?
Policies configured in the Duo Admin Panel enforce the specific requirement for OS security patches.
Why this answer
The Duo Central/Duo Access Gateway (DAG) or Duo SSO evaluate the health status passed by the Duo Device Health application before granting access.
Which Duo log would be most useful for troubleshooting a failure during the initial push notification delivery?
This provides transaction-level detail, including MFA method success/failure.
Why this answer
The Authentication Log provides a detailed breakdown of each step in the MFA process, including push delivery status.
You are investigating an authentication failure. The log shows 'Error: User not found in directory'. What does this imply?
The lookup fails because the user is missing in the synced directory object.
Why this answer
This error occurs when the Duo cloud service attempts to check a user's status against the synced directory, but the user does not exist or was not successfully synced.
An administrator needs to ensure that only managed devices can access SaaS applications via Cisco Duo. Which configuration step is mandatory in the Duo Admin Panel to ensure the device is recognized as 'Managed'?
This combination ensures the endpoint reports its health data and identity to the Duo cloud.
Why this answer
To identify a device as managed, the administrator must deploy the Duo Device Health application and ensure the device certificate is present.
Which THREE factors influence the user experience when using Duo Passwordless?
Essential for the protocol.
Why this answer
Duo Passwordless experience is shaped by the platform authenticator, the configured policy, and the application's support for WebAuthn.
Which THREE conditions must be met for a user to be able to use the 'Self-Service Portal' for device enrollment?
This is the policy trigger.
Why this answer
Self-service enrollment requires directory integration, an accessible URL, and an enabled policy.
What is the primary function of the Duo 'Telephony Credits'?
These methods consume telephony credits.
Why this answer
Telephony credits are used specifically for SMS and voice-call-based MFA, as these incur costs from telecommunication providers.
Which TWO of the following are benefits of using the Duo Authentication Proxy for on-premises AD integration?
The proxy encrypts all traffic to the cloud.
Why this answer
The proxy handles directory syncing and provides a secure, encrypted tunnel to the Duo cloud.
A administrator wants to implement 'Strict' device health checks. What happens if a device reports an unknown OS version?
Strict policies enforce a 'deny' if the device does not explicitly meet health requirements.
Why this answer
Under a 'Strict' policy, if the device health app cannot confirm a supported, patched OS, the access request is denied.
When syncing users from Active Directory to Duo, what is the role of the 'Duo Authentication Proxy'?
The proxy is used to sync directory objects to the cloud.
Why this answer
The proxy acts as the bridge that performs LDAP/AD queries and pushes user objects to the Duo cloud.
Which TWO methods can be used to bypass Duo authentication in an emergency?
Effective method for temporary emergency access.
Why this answer
Temporary bypass codes and a 'Bypass' policy setting for a specific user group are the standard emergency options.
Which THREE of the following are supported by the Duo Authentication Proxy?
Supported via specific agent/proxy workflows.
Why this answer
The proxy supports RADIUS, LDAP, and generic HTTP-based integrations for authentication.
A user is traveling and needs to access a cloud application. The user has no cellular service but has Wi-Fi. Which authentication method is best suited for this scenario?
TOTP codes work offline on the device.
Why this answer
Duo Mobile can generate TOTP (Time-based One-Time Password) codes offline, which can be entered into the prompt.
Ready to test yourself?
Try a timed practice session using only User And Device Security questions.