Select Two (Multi-Select) Questions

User's home address

Why it fails: App Discovery reports on cloud applications and their traffic characteristics, not the personal residential details of users, which Umbrella never collects. It is tempting because identity fields such as internal username or AD group do appear, but the user's home address is unrelated to any DNS or proxy telemetry.

Application's source code

Why it fails: App Discovery aggregates observed traffic metadata such as application name, category and request volume; it never inspects or displays an application's source code. It is tempting because the report identifies which apps are in use, but source code is the vendor's intellectual property and is invisible to DNS-layer monitoring.

MAC Address of the Printer

Why it fails: Umbrella identities are network, roaming computer, mobile device, DNS account and AD user/group objects; a printer's MAC address is not one. It is tempting because MAC addresses genuinely identify local devices on a network, but Umbrella resolves identities from source IP, roaming clients or directory users instead.

Public Cloud Instance ID

Why it fails: Umbrella identities derive from network subnets, roaming clients, mobile devices, DNS accounts and directory users or groups; a public cloud instance ID is none of these. It is tempting because cloud workloads genuinely need policy coverage, but that is achieved by registering their source networks or roaming clients instead.

The user's home internet speed

Why it fails: Home internet speed measures bandwidth, not endpoint security state. Device posture evaluates OS patch level, disk encryption, firewall status and EDR health, so this factor belongs to connectivity planning rather than Zero Trust. It would be relevant when sizing VPN throughput or QoS for remote workers, not when granting conditional access.

The user's favorite website

Why it fails: A favourite website is user preference data, not a signal describing the security state of an endpoint. It is tempting because posture evaluation does draw on client-side attributes, but the correct factors would be device characteristics such as patch level, encryption status or management enrolment.

Local host firewall rules.

Why it fails: A CASB enforces access control through mechanisms such as SAML authentication, OAuth token scoping and API-based policy enforcement in the cloud, not host-level firewall rules. Local firewall rules govern a single device's traffic and cannot control SaaS application access centrally.

Direct switch-to-server connection.

Why it fails: A CASB enforces access control through forward or reverse proxy interception, API-based inspection and agent-based redirection; a direct switch-to-server connection bypasses the CASB entirely, so no policy is applied. It is tempting because direct server paths suit latency-sensitive or trusted internal traffic where no inline inspection is required.

The color of the server rack

Why it fails: Rack colour is physical inventory metadata, not telemetry Secure Workload ingests; micro-segmentation policy is built from flow, process and vulnerability data. It is tempting because asset inventory attributes do feed policy labelling, and would be relevant where segmentation scoped by physical location or asset tags.

User's home address

Why it fails: Tetration analyses flow telemetry, process behaviour and workload labels; a user's home address is not a workload attribute and cannot inform segmentation policy. It is tempting because identity data does feature in some zero-trust models, but here the enforcement plane consumes network and process metadata, not personal location details.

Rebooting all security appliances

Why it fails: Rebooting appliances restarts processes; it neither reads nor compares running configuration against policy, so no compliance verdict is produced. Rebooting is for clearing hung sessions or applying firmware. Cisco Defense Orchestrator verifies compliance by comparing device configurations against policy baselines and reporting drift.

Executing a manual traceroute from every endpoint

Why it fails: Traceroute maps network paths between hosts; it inspects no configuration and compares nothing against policy, so it cannot attest compliance. Traceroute is for diagnosing routing or reachability faults. Cisco Defense Orchestrator instead evaluates device configurations against defined policy baselines and reports any deviation.

Manually re-configuring the entire firewall

Why it fails: Manually reconfiguring a firewall changes device state rather than evaluating it against policy, so it cannot produce a compliance result and risks introducing further drift. Manual reconfiguration is remediation after a violation is found. Compliance verification compares configurations to policy baselines and flags deviations for review.

Cisco IOS-XE CLI

Why it fails: Cisco IOS-XE CLI is a device operating system interface, not a SecureX component; SecureX comprises cloud-delivered services such as threat response, orchestration and device insights. It is tempting because IOS-XE underpins many Cisco security appliances, so it appears security-related, yet it belongs to the underlying platform rather than the SecureX suite itself.

Cisco Webex Meetings

Why it fails: Webex Meetings is a collaboration product, not a SecureX security component; SecureX integrates threat intelligence, orchestration and endpoint visibility. It is tempting because Cisco brands both, but SecureX comprises modules such as Threat Response, Orbital and Talos intelligence.

Full administrative privileges

Why it fails: Playbooks execute under scoped service accounts or managed identities; granting full administrative privileges violates least privilege and expands blast radius if the automation is compromised. It is tempting because broad rights appear to guarantee every action succeeds, yet least-privilege roles are what SOAR integrations are designed to use.

Manual intervention steps

Why it fails: Manual intervention steps break the automated, consistent execution SOAR playbooks exist to provide, adding delay and human error during time-critical incidents. It is tempting because analysts may want approval gates for destructive actions, but those belong to defined escalation paths, not core playbook execution.

Frequent database reindexing

Why it fails: Database reindexing is a storage maintenance operation with no bearing on playbook logic, trigger reliability or action sequencing during incident response. It is tempting because reindexing can improve query speed in data-heavy systems, which matters for analytics workloads rather than automated security orchestration.

Real-time video monitoring

Why it fails: Real-time video monitoring is a physical surveillance capability with no bearing on email security orchestration. It is tempting because 'real-time' suggests immediate response, but SecureX orchestration acts on threat intelligence and email events, not video feeds.

Manual email routing

Why it fails: Manual email routing is a human, hands-on process, so it adds no automation and cannot be a benefit of orchestration integration. It is tempting because routing decisions still exist in mail flow, but SecureX orchestration targets automated, API-driven workflows rather than operator intervention.

Hardware load balancing

Why it fails: Hardware load balancing is an on-premises appliance function, unrelated to cloud-delivered orchestration between Secure Email and SecureX. It is tempting because load balancing improves resilience, but the integration's value lies in automated threat response workflows, not distributing traffic across physical devices.

Rename the user's AD account

Why it fails: Renaming an AD account does not bypass Duo; the renamed account still maps to the same Duo user and prompts for MFA. It is tempting as an administrative rename to break a stale directory link, and would be correct for resolving account-naming or synchronisation issues, not for emergency authentication bypass.

Reset the user's password to '12345'

Why it fails: Resetting a password to '12345' does not bypass Duo; it only changes the first authentication factor and still triggers the Duo prompt. It is tempting as a quick account-recovery step, and would be correct for restoring a locked-out user's primary credential, not for emergency MFA bypass.

Set the global MFA mode to 'Bypass' for all users

Why it fails: Setting global MFA mode to Bypass disables Duo for every user, not just the emergency case, so it is not a targeted bypass method. It is tempting because it does remove the Duo prompt, and would be correct for a planned, org-wide Duo outage window rather than per-user emergency access.

Analyzing the local browser history files

Why it fails: Browser history records visited URLs and timestamps on the endpoint, giving no flow-level metadata for the cloud analytics engine to correlate. Reading history suits endpoint forensic or user-behaviour investigations, whereas encrypted-traffic visibility here comes from network telemetry such as NetFlow and TLS handshake observation.

Installing a root CA on all mobile devices

Why it fails: Secure Cloud Analytics derives encrypted-traffic insight from metadata such as flow records, packet sizes and TLS handshake fields, not from endpoint trust stores. Installing a root CA on mobile devices enables TLS interception by a proxy, which is a separate decryption architecture and does not feed this platform's telemetry.

Full payload decryption at the cloud edge

Why it fails: Secure Cloud Analytics infers threat and application context from encrypted-flow metadata without decrypting payloads; full decryption at the cloud edge breaks end-to-end TLS and is not how the product operates. Decryption is the right approach when an inline proxy must inspect content, not when passive metadata analytics is required.

Physical switch port mirroring

Why it fails: Cisco Secure Workload consumes flow telemetry from the workload itself, not mirrored physical switch ports, so port mirroring adds no visibility in IaaS where traffic is virtualised. It is tempting because SPAN is the established method for monitoring traffic in traditional on-premises data centres.

Global firewall rule consolidation

Why it fails: Secure Workload enforces policy per workload and process through software agents, so consolidating rules on perimeter firewalls does not govern east-west traffic between instances. It is tempting because firewall rule consolidation reduces administrative overhead in traditional perimeter-centric network designs.

The internal DHCP server IP

Why it fails: Umbrella identifies a network by its public egress IP and internal subnet range, since DNS queries arrive from the NATed public address. The internal DHCP server address is irrelevant to that mapping. DHCP server details would be relevant when configuring a local connector or virtual appliance for identity discovery.

The local VLAN ID

Why it fails: Umbrella Network Identities are defined by the public egress IP address and the internal subnet (CIDR), which map DNS requests to a site. VLAN IDs are layer-2 constructs invisible to Umbrella's cloud resolvers. VLAN tagging would matter for on-premises appliances that see tagged frames directly.

The ISP account number

Why it fails: Umbrella Network Identities require the public egress IP and internal subnet; the ISP account number plays no part in mapping DNS requests to a site. ISP billing details would be useful for circuit inventory or support escalation, not for defining a network identity in the Umbrella dashboard.

Connecting all apps to the local LAN only

Why it fails: Restricting apps to the local LAN gives no path to cloud workloads, so it cannot be a hybrid access pattern at all. It is tempting as a lockdown instinct, but secure hybrid designs instead use private connectivity such as VPN or dedicated links with identity-based controls, not LAN-only reachability.

Open access for all traffic

Why it fails: Permitting all traffic removes every segmentation and least-privilege control, which is the opposite of a secure access pattern. It is tempting as a troubleshooting shortcut, but secure hybrid designs instead broker specific flows through identity-aware proxies or private endpoints, granting only the required protocols and destinations.

Public internet bypass for all traffic

Why it fails: Routing all traffic over the public internet bypasses private connectivity, exposing workloads and removing the controlled path a secure pattern requires. It is tempting because internet links are quick to stand up, but hybrid designs instead use VPN or dedicated interconnects with encryption and policy enforcement.

Change the resolution of the computer monitor

Why it fails: Monitor resolution affects only local display rendering and has no bearing on whether a SecureX integration module maintains its API connection. It is tempting because display problems can make dashboards appear broken, but the Offline indicator reflects the module's authentication and reachability to the integrated product, not the analyst's screen settings.

Reinstall the local web browser

Why it fails: SecureX integration module status reflects cloud-side connectivity, API credentials and configuration, not the analyst's browser installation. It is tempting because a browser is used to view SecureX, but reinstalling it changes nothing about the module's registration or authentication with the integrated product, so the Offline state persists.

Check the local power cable of the SecureX server

Why it fails: SecureX is a cloud-delivered platform, so no local SecureX server power cable exists to check; module Offline status stems from API credential, connectivity or configuration faults. It is tempting because power faults do take on-premises appliances offline, but that scenario does not apply to a cloud service's integration modules.

Manage user passwords

Why it fails: A Casebook orchestrates investigation and response actions such as enriching observables, isolating endpoints or blocking domains; it holds no directory credentials or identity-management workflow to reset passwords. It is tempting because identity tasks appear during incident triage, where a separate identity platform would handle them.

Modify firewall firmware

Why it fails: A Casebook triggers response actions against endpoints, observables and integrated security controls; flashing device firmware is a device-management operation outside its scope. It is tempting because firewall changes often accompany containment, which a firewall management console would handle directly.

Delete all historical logs

Why it fails: Casebooks coordinate investigative and response steps against observables and threat data; they provide no retention or log-store administration function to purge historical records. It is tempting because clearing noisy data feels like containment, which a dedicated logging platform would perform instead.

SNMP monitoring

Why it fails: SNMP monitoring polls device metrics and traps; it carries no user identity or authentication exchange, so it cannot secure sign-in between Umbrella and a SaaS application. It is tempting because SNMP is a familiar Cisco management protocol, and it would be the right choice for collecting appliance health statistics instead.

Local LDAP database

Why it fails: A local LDAP database stores directory entries on-premises and is not reachable by a cloud SaaS provider for federated sign-in; Umbrella integrates through SAML or OIDC against a cloud identity provider. LDAP suits internal application authentication within the corporate network, not SaaS federation.

WPA2-Enterprise

Why it fails: WPA2-Enterprise authenticates devices to wireless networks via 802.1X and RADIUS; it plays no part in SaaS authentication, which occurs over HTTPS through SAML or OIDC. It is the right choice for securing Wi-Fi access, not for federating identities into a cloud application.

Internal VoIP phone calls

Why it fails: A SIG secures traffic egressing to the internet and SaaS, inspecting web, SaaS and cloud-bound flows. Internal VoIP calls traverse the LAN or WAN and are handled by voice gateways and QoS, not a SIG. VoIP inspection would be the correct answer if the question asked about internal voice security.

Local printer traffic

Why it fails: A SIG protects internet-bound and SaaS traffic, applying web filtering, CASB and DLP controls at the cloud edge. Local printer traffic stays within the LAN and never traverses the SIG, so it is secured by network access control or print server hardening instead.

Run all playbooks in 'Production' mode without testing in a staging environment.

Why it fails: Running playbooks untested in production risks unintended disruption and removes the ability to validate logic against real telemetry, undermining operational continuity. It is tempting to save time, but staging validation with representative data is what confirms the playbook behaves correctly before production execution.

Share administrative credentials with all team members in plaintext.

Why it fails: Sharing administrative credentials in plaintext destroys accountability and enables lateral movement, so it cannot maintain security or operational continuity. It is tempting as a way to ensure responders can act during an outage, but privileged access management with individual accounts and just-in-time elevation is the correct mechanism.

Internal hard drive serial number

Why it fails: Activity Search surfaces identity, domain and identity-type fields; hardware serial numbers are not collected from endpoints. It is tempting because asset identification supports investigations, and it would be the correct choice when inventorying managed devices through an endpoint agent or asset management platform.

User's password

Why it fails: Activity Search reports identities, destinations and verdicts, never credentials; passwords are not logged or displayed. It is tempting because correlating a user with their traffic is the report's purpose, and it would be the correct choice when auditing authentication events in a directory or identity provider.