CCNA Cloud Security Architecture Questions

Cloudlock inspects content within sanctioned SaaS applications, applying DLP policies to files and posts in platforms such as Microsoft 365 and Google Workspace. This satisfies the requirement to detect and control sensitive data exposure directly inside the SaaS environment.

An IPsec tunnel from the branch edge to the nearest Umbrella data centre satisfies the stem's requirement for routing internet-bound branch traffic into the SIG. This is Umbrella's Tunnel-to-SIG model, which forwards all branch egress traffic to Umbrella for DNS-layer and secure web gateway inspection without requiring client agents on every endpoint.

The private resource connector establishes an outbound-only connection from the AWS VPC to Cisco Secure Access, allowing ZTNA enforcement without inbound firewall openings or public exposure. Identity and device posture policies are evaluated before access is granted, aligning with zero trust principles. This design directly addresses the need to protect private applications while leveraging existing ISE and Secure Access investments.

Least privilege restricts each identity to the minimum entitlements needed for its current task, removing standing access to unrelated resources. This satisfies the stem's requirement for limiting blast radius, since compromised or misused accounts cannot reach data beyond their explicit, task-scoped permissions.

Cisco ISE supplies user identity and device posture, which Cisco Secure Access consumes to apply context-aware policy across hybrid environments. This integration satisfies the stem's critical design pattern by enforcing identity and device-state-based access decisions.

Microsoft Entra ID-sourced user identity is evaluated against policy so Secure Access can permit or deny the connection based on who is requesting it. Identity is one of the three criteria determining whether a connection should be allowed.

Malware frequently resolves C2 domains before beaconing outbound, so DNS-layer security blocks those lookups at resolution time, before any connection is established. This satisfies the requirement to stop callbacks originating from already-infected endpoints, unlike IP or file inspection which act later.

Federating a central identity provider with Microsoft Entra ID and enforcing MFA gives one authoritative identity source, consistent authentication policy and strong credential assurance across cloud workloads. This satisfies the stem's requirement for a key IAM strategy component by unifying identity and verifying users.

OpenLDAP is a supported directory source that Cisco Duo can synchronise users from for authentication, satisfying the identity-source integration requirement. Duo's Directory Sync and Authentication Proxy both support LDAP-based directories, enabling user import and primary or secondary authentication.

GRE encapsulates the branch traffic inside IP packets and delivers it to the Umbrella SIG headend, providing a native tunnel type for branch-to-SIG connectivity. It satisfies the scenario's requirement for tunnelling branch office traffic to Cisco Umbrella SIG.

TLS inspection requires the SIG to present a certificate that endpoints trust. Distributing the Umbrella root certificate to managed endpoints through Group Policy or an MDM ensures browsers and applications accept the re-signed certificates, enabling malware and data-loss inspection of encrypted traffic. Without this trust anchor, decryption causes certificate warnings and broken sessions, so this is the critical design step for the scenario.

A ZTNA agent enforces per-application microtunnels, so only traffic destined for protected internal apps traverses the corporate path while general web browsing egresses directly. This satisfies the stem's Zero Trust constraint by applying identity- and context-based policy to each session, rather than blanket-routing all traffic through a VPN concentrator.

The Umbrella roaming module inside Cisco Secure Client intercepts DNS requests at the endpoint itself, so protection follows laptops and mobiles off-network. This satisfies the SASE requirement to secure roaming mobile endpoints regardless of location.

Centralised inspection through a transit gateway routes all hybrid traffic, including data-centre-to-cloud flows, through a single cloud firewall, satisfying the requirement that traffic between the public cloud and private data centre be inspected. Hub-and-spoke peering avoids per-VNet appliances, giving consistent policy enforcement and simplified management across the hybrid estate.

Direct-to-cloud connectivity removes the need to backhaul branch traffic through a central data centre, letting users reach SaaS and internet resources directly. This satisfies the SASE requirement for identity-aware, policy-driven access at the edge, with Microsoft Entra ID enforcing conditional access regardless of user location.

A CASB sits between users and cloud services, applying policy enforcement, data loss prevention, threat protection and activity visibility across sanctioned and unsanctioned SaaS. This satisfies the stem's requirement for governing shadow IT and cloud usage that sits outside traditional network perimeter controls.

Cloud-based DLP inspects web traffic against predefined patterns for PII and card numbers, blocking exfiltration before it leaves the organization. This directly satisfies the stem's constraint that sensitive data must not exit via web traffic, since enforcement happens in the cloud proxy rather than on-premises.

Cisco Secure Workload (Tetration) provides agent-based, flow-level visibility and behavioural threat detection for east-west traffic between cloud workloads inside a VPC, which security groups and perimeter tools cannot inspect. This directly satisfies the requirement for intra-VPC workload traffic monitoring.

Dual ISP connections give the branch physically diverse WAN paths, so a single carrier outage cannot sever the SASE fabric. This satisfies the high-availability requirement by removing the last-mile link as a single point of failure, letting traffic fail over to the secondary provider.

Selective TLS decryption is essential to balance security and performance. Excluding privacy-sensitive categories prevents legal and compliance issues, and reduces the volume of traffic that must be decrypted and inspected, lowering latency and resource consumption. This approach maintains strong security for general web traffic while respecting user privacy and optimizing performance.

SAML lets a central identity provider issue signed assertions that cloud apps trust, so users authenticate once and gain access without separate credentials per app. This directly satisfies the SSO requirement, eliminating duplicated passwords and shrinking the credential-sprawl attack surface that password reuse creates.

The Cloudlock CASB API engine connects out-of-band to the SaaS tenant's APIs, inspecting objects and activities for policy violations and triggering remediation such as blocking or quarantining. This satisfies the stem's requirement for the component analysing API calls.

Cisco Umbrella SIG is the cloud-delivered security enforcement layer, performing DNS-layer and full-proxy inspection plus policy enforcement for remote users on untrusted networks. It satisfies the stem's requirement for a primary enforcement point without backhauling traffic to headquarters.

Deploying multiple tunnels over diverse underlay paths ensures that if one path fails, traffic can fail over to the other. Active/active configuration allows load sharing and immediate failover, providing high availability and redundancy. This design is a recommended practice for branch connectivity to Cisco Secure Access.

Checking connector health in the Secure Access dashboard directly satisfies the stem's ZTNA connectivity constraint: a disconnected or unhealthy connector cannot broker the user's private application traffic. The dashboard reports tunnel status, last check-in and resource reachability, so it isolates whether the fault lies with the connector rather than the user's identity or policy.

Secure Client collects posture telemetry from the endpoint and queries OS security APIs, such as Windows Security Center, to confirm antivirus is installed, enabled and current. This satisfies the stem's requirement for verifying an active antivirus solution on the managed laptop.

TLS interception and re-encryption consume CPU cycles on the SASE edge, directly reducing throughput and adding latency per flow. This processing overhead is an inherent performance factor of any SASE deployment that inspects encrypted traffic.

Cisco Cloudlock is a cloud access security broker that monitors SaaS activity through APIs, covering Microsoft 365, Google Workspace and similar platforms. It delivers the cloud-to-cloud visibility the scenario requires, detecting risky user behaviour and data exposure without on-premises appliances.

Logging and observability provide the audit trail and telemetry needed to demonstrate regulatory compliance and to correlate events for proactive threat hunting. This satisfies the stem's question of why these capabilities are critical in cloud security architecture design.

Anycast advertises the same IP from every Umbrella data centre, so each user's traffic is drawn to the topologically nearest point of presence. This directly satisfies the lowest-latency constraint for users spread across regions, rather than backhauling them to a single central egress.

Disk encryption status verifies that data at rest on the endpoint is protected, so a lost or stolen device cannot expose local files. This satisfies the posture constraint of assessing the device's own protective state before granting access to corporate resources.

Most traffic is now TLS-encrypted, so firewalls and data-loss prevention engines cannot see payload contents. SSL/TLS inspection terminates and re-establishes the encrypted session, exposing plaintext to the security stack for threat and sensitive-data detection, which is the capability SASE requires.

IAM governs authentication, authorisation and privileged access across cloud services, forming the control plane that every other security layer depends on. It satisfies the reference architecture requirement by defining who can reach workloads and data, spanning identity providers such as Microsoft Entra ID, federation, and least-privilege enforcement.

ZTNA brokers each remote user's connection to specific internal applications after identity and device posture checks, rather than granting broad network access via VPN. This pattern satisfies hybrid cloud secure access by enforcing least-privilege, per-application authorisation across on-premises and cloud estates.

ZTNA evaluates device posture and user identity per session before granting access, so unmanaged BYOD devices lacking patches, encryption or antivirus are denied or given limited reach. This satisfies the stem's requirement that the device cannot compromise the network.

Device Posture evaluates endpoint state before granting access; requiring an MDM-enrolled certificate or specific registry key verifies the laptop is managed and compliant, so the trust decision reflects device health rather than user identity alone.

Cisco Secure Access DNS-layer security blocks malicious domains before a connection is established, and the intelligent proxy selectively inspects suspicious traffic. This cloud-delivered service requires no on-premises hardware, is quick to deploy, and provides essential protection against phishing and malware, aligning with the small business needs.

Host-based policies and distributed SDN firewalls enforce rules at each VM's virtual NIC, filtering east-west traffic within the same subnet. This satisfies micro-segmentation's core constraint: granular, workload-level isolation that subnet-level network security groups cannot achieve, since they only govern traffic crossing subnet boundaries.

Cisco SASE converges networking and security into one cloud-delivered service, directly satisfying the stem's requirement for a unified framework. Rather than stitching together separate appliances, it delivers SD-WAN, secure web gateway, cloud access security broker and zero-trust network access from a single cloud edge, eliminating the backhauling and policy fragmentation inherent in disjointed architectures.

Anycast advertises the same IP from many points of presence, so each user's traffic is drawn to the topologically nearest security node. This delivers high availability and optimal latency, satisfying SASE's requirement for consistent global performance.

Cisco Secure Workload enforces microsegmentation using identity-based policies derived from workload labels, tags, and process behaviour rather than IP addresses. This satisfies the stem's IaaS design requirement, since dynamic cloud workloads change addresses frequently, making static IP rules unmanageable.

User identity context supplies the who dimension of a flow, letting Cisco Secure Workload map traffic to authenticated users and build identity-aware micro-segmentation policies. This complements network and workload attributes, satisfying the requirement to analyse identity as one of the three enforcement inputs.

Identity-based segmentation enforces access policies using user and group attributes from Microsoft Entra ID, decoupling authorisation from IP subnets or VLAN placement. This satisfies the SASE requirement that policy follow the user across any network location, so remote and branch traffic receives identical enforcement regardless of topology.

Cisco Secure Access (ZTNA) enforces per-application access rather than broad network-level connectivity, satisfying the Zero Trust requirement to replace traditional VPN. It authenticates users and devices continuously, granting least-privilege access to specific resources without exposing the internal network, which directly addresses the hybrid cloud remote access constraint in the stem.

ZTNA policies grant access per application, not per network segment, so the policy must bind a verified user identity to the specific application requested. This satisfies the least-privilege constraint, since authorisation is evaluated on that identity-application pair rather than IP address or subnet.