Cloud Security Architecture practice questions

Apply a 'Transparent Proxy' setting on the local Cisco ASA firewall.

Why it fails: This is a hardware-based configuration, not a cloud-native Umbrella SIG setting.

Enable 'HTTPS Inspection' in the Cloud Security global settings and select 'Bypass All' for all categories.

Why it fails: This is a global setting and does not allow granular category-based bypass.

Set the 'Block' action for sensitive categories in the Destination Lists.

Why it fails: Blocking does not decrypt traffic; it drops the connection.

Umbrella Virtual Appliance

Why it fails: VAs are used for DNS layer security in internal networks, not posture assessment.

Cloud-delivered Firewall

Why it fails: The firewall controls traffic flow but does not assess endpoint posture.

Umbrella DNS Policies

Why it fails: DNS policies control resolution, not posture.

Umbrella SIG API

Why it fails: The API is used for configuration and log retrieval, not endpoint posture.

Cisco Secure Firewall Management Center

Why it fails: Secure Firewall Management Center manages firewall devices and intrusion policy; it provides no identity brokering or ZTNA application connector. It is tempting because FMC does enforce segmentation, but that is for on-premises firewall estates, not the Duo plus Secure Access ZTNA architecture.

Cisco ISE

Why it fails: ISE is typically for on-prem NAC, not cloud-native ZTNA.

Umbrella Virtual Appliance

Why it fails: Not a requirement for private application ZTNA.

Install the Duo Mobile app directly on the application server.

Why it fails: This is not a supported architecture for authentication.

Configure the application to trust the Duo cloud directly via OAuth2.

Why it fails: Legacy applications typically do not support OAuth2 natively.

Use the Duo Network Gateway to perform URL rewriting on the legacy headers.

Why it fails: Duo Network Gateway is for secure remote access, not legacy authentication bridging.

Local traffic is routed via MPLS only

Why it fails: MPLS is not a requirement for Umbrella tunnel failover.

Traffic is sent to the Umbrella VA

Why it fails: VAs are for internal DNS, not WAN traffic failover.

Traffic reverts to transparent proxy mode

Why it fails: Transparent proxy is not a failover mechanism for tunnel loss.

Traffic is dropped by default

Why it fails: SD-WAN policies can be configured for fail-open or secondary path steering.

Cisco Webex

Why it fails: Webex provides meetings, messaging and calling, not the secure web gateway, CASB, ZTNA or firewall components that constitute the SASE stack. It is tempting because Webex is a Cisco cloud service accessed over the internet, which suits collaboration requirements rather than SASE security enforcement.

Cisco Identity Services Engine (ISE)

Why it fails: ISE delivers on-premises network access control and identity policy for campus devices; SASE components are cloud-delivered, so ISE sits outside that stack. It is tempting because ISE enforces identity-based access, which suits zero-trust segmentation inside a physical network rather than cloud-edge security.

Cisco Meraki Go

Why it fails: Meraki Go is a small-business Wi-Fi and switching line, not a cloud-delivered SASE security component such as secure web gateway or CASB. It is tempting because Meraki provides cloud-managed networking, which suits branch connectivity deployments rather than the security stack SASE defines.

multi_select

Why it fails: The following questions are multi-select.

Move the application to the cloud immediately.

Why it fails: Moving the app does not inherently solve the authentication protocol issue.

Disable authentication for these apps.

Why it fails: This is a violation of Zero Trust.

Rewrite the application code to support SAML.

Why it fails: This is often expensive or impossible for proprietary apps.

Local DHCP server management

Why it fails: The proxy does not manage local networking services.

Hardware firewall replacement

Why it fails: The proxy is a cloud service, not a replacement for on-prem hardware firewalls.

Increased network overhead

Why it fails: ZTNA reduces overhead compared to full-tunnel VPNs.

Full access to the entire subnet

Why it fails: Full network access is a characteristic of legacy VPNs, not ZTNA.

Automatic physical hardware upgrades

Why it fails: ZTNA does not involve hardware upgrades.

Improved user experience by reducing latency

Why it fails: Correct, ZTNA avoids the backhauling/hair-pinning issue.

DNS query logs

Why it fails: Logs provide visibility, not prevention.

Local firewall rules

Why it fails: Local rules don't inspect content for DLP.

Automated DNS updates

Why it fails: This is a network management task.

Cisco Catalyst SD-WAN with application-aware routing and embedded security, plus IPsec tunnels from each contractor to the nearest branch.

Why it fails: Cisco Catalyst SD-WAN is designed for branch and WAN connectivity, not for unmanaged remote contractor endpoints. Requiring each contractor to terminate an IPsec tunnel to a branch is operationally heavy and does not provide centralized identity-based policy or device posture evaluation. While SD-WAN can carry encrypted traffic, it lacks the ZTNA policy engine and device trust signals needed for this Zero Trust use case.

Cisco Identity Services Engine (ISE) with posture assessment through the Cisco Secure Client agent, integrated with Cisco Secure Access for ZTNA enforcement.

Why it fails: Cisco ISE posture assessment traditionally depends on the Cisco Secure Client (formerly AnyConnect) agent to relay posture attributes. Since the scenario explicitly states that contractors use unmanaged laptops and no persistent agent can be installed, relying on Secure Client posture checks is not feasible here. This option therefore fails the unmanaged-device constraint even though ISE integration with Secure Access is a valid architecture pattern.

Cisco Umbrella SIG with DNS-layer security and a roaming client installed on each contractor laptop, plus firewall rules at the data center edge.

Why it fails: Umbrella SIG focuses on secure internet and SaaS access through DNS-layer and web security, not on brokering access to private data center applications with device posture. The roaming client also requires software installation, which conflicts with the unmanaged-device requirement. Firewall rules at the data center edge provide network-level filtering but no identity- or device-aware Zero Trust decision, so this design does not meet the stated goals.

Cisco Secure Access DNS-layer security policies

Why it fails: DNS-layer security policies in Cisco Secure Access can block malicious domains but do not assess device health or compliance. They operate at the DNS level and cannot verify antivirus or OS patch status. Thus, they cannot enforce device posture for access to patient records, making this option insufficient for the design.

Cisco Secure Firewall Threat Defense with Remote Access VPN

Why it fails: Cisco Secure Firewall Threat Defense with Remote Access VPN can provide secure connectivity but does not natively perform endpoint posture assessment for antivirus or patch level. While it can integrate with ISE for posture, the scenario requires a direct posture signal to Cisco Secure Access. This option adds complexity without directly meeting the requirement.

Cisco Umbrella Roaming Security module on endpoints

Why it fails: Cisco Umbrella Roaming Security provides DNS-layer security and protects users when off-network, but it does not perform device posture checks like antivirus presence or OS patch level. It cannot supply the compliance data required for conditional access to patient records. Therefore, it is not the appropriate component for posture enforcement.

Duo Authentication Proxy

Why it fails: Duo Authentication Proxy brokers on-premises authentication to Duo's cloud for MFA, so it never inspects SaaS API calls. Cloudlock's API engine analyses sanctioned-app activity via provider APIs and triggers remediation. Duo Authentication Proxy would be correct when integrating an existing RADIUS or AD login with Duo MFA.

AnyConnect SASE client

Why it fails: AnyConnect SASE client secures endpoint connectivity and DNS-layer enforcement on the device, not SaaS API telemetry. Cloudlock's API engine polls the SaaS provider's APIs to detect policy violations and remediate. AnyConnect would be correct when protecting roaming endpoints' web and DNS traffic directly.

Umbrella SIG proxy

Why it fails: The Umbrella SIG proxy inspects web and internet-bound traffic, not sanctioned SaaS API activity. Cloudlock's API engine queries the SaaS provider's APIs to analyse calls and trigger remediation. Umbrella SIG would be correct when enforcing web policy and threat inspection for branch or roaming users.

Physical switch port mirroring

Why it fails: Cisco Secure Workload consumes flow telemetry from the workload itself, not mirrored physical switch ports, so port mirroring adds no visibility in IaaS where traffic is virtualised. It is tempting because SPAN is the established method for monitoring traffic in traditional on-premises data centres.

Global firewall rule consolidation

Why it fails: Secure Workload enforces policy per workload and process through software agents, so consolidating rules on perimeter firewalls does not govern east-west traffic between instances. It is tempting because firewall rule consolidation reduces administrative overhead in traditional perimeter-centric network designs.

On-premise appliance chaining

Why it fails: Chaining on-premise appliances keeps inspection anchored in the data centre, exactly the hub-and-spoke pattern SASE eliminates by moving security to cloud points of presence. It is tempting because appliance chaining offers layered inspection, which suits static data-centre traffic rather than distributed users.

Strict MPLS segmentation

Why it fails: Strict MPLS segmentation preserves the private-circuit, perimeter-based model SASE supersedes; SASE applies identity- and context-driven policy over any transport, including internet links. It is tempting because segmentation remains a valid security control, but MPLS-centric design is the architecture being moved away from.

Identity-agnostic security

Why it fails: SASE ties every session to verified user and device identity, so identity-agnostic security contradicts its zero-trust foundation. It is tempting because SASE removes fixed network perimeters, which some read as ignoring identity; identity-agnostic models suit legacy castle-and-moat designs instead.

Centralized backhauling

Why it fails: Centralised backhauling is the hub-and-spoke behaviour SASE replaces, routing branch traffic through a data centre for inspection. It is tempting because inspection still occurs, but SASE performs it at distributed points of presence near the user, not by concentrating flows.

Configure DNS forwarding only.

Why it fails: DNS forwarding only redirects name resolution to Umbrella; it leaves the actual HTTP and HTTPS flows going directly to the internet, unsecured by the SIG. DNS-layer security suits basic filtering, but full SIG inspection requires tunnelling all branch traffic, not just DNS queries.

Use an AnyConnect agent on every endpoint in the branch.

Why it fails: AnyConnect on every endpoint secures roaming users, not branch LAN egress. It cannot redirect the branch's internet-bound traffic at the network edge, which requires tunnel routing from the branch router or SD-WAN device to Umbrella SIG. Agent-based deployment suits remote workers.

Deploy a local proxy server that intercepts all traffic.

Why it fails: A local proxy does not establish the IPsec tunnel or GRE path to Umbrella SIG that branch traffic requires. Proxies suit explicit forward-proxy web filtering, not transparent SASE egress. The branch edge router or SD-WAN appliance performs the tunnel-based redirection.

It switches the user's connection to a VPN tunnel.

Why it fails: Device Posture feeds compliance signals such as OS patch level, disk encryption and antivirus state into the access decision, granting, restricting or denying per-app access; it does not establish a VPN tunnel. VPN tunnelling is a separate connectivity mechanism, not a posture enforcement outcome.

It forces a mandatory password reset if the device is out of compliance.

Why it fails: Device Posture evaluates endpoint compliance attributes and adjusts access entitlements accordingly; forcing a password reset is an identity remediation action, not a posture-driven access decision. Password reset policies belong to identity lifecycle management, not to per-request trust evaluation.

It checks the user's IP address against a geo-blocking database.

Why it fails: Device Posture evaluates endpoint attributes such as OS patch level, disk encryption and antivirus state; IP geolocation is handled by separate location or geo-blocking controls. Geo-blocking is tempting because it also feeds access decisions, and would be correct when policy must restrict access by country or region rather than device compliance.

Cisco Firepower Threat Defense (FTD)

Why it fails: FTD is typically an on-premises or virtual appliance, not the primary cloud-native SASE component.

Cisco Meraki MX

Why it fails: A Meraki MX is a branch appliance; traffic from remote users on untrusted networks does not pass through it. Umbrella's cloud proxy enforces policy for roaming endpoints. Meraki MX would be correct when securing a fixed branch office's internet egress.

Cisco Identity Services Engine (ISE)

Why it fails: ISE handles network access control, profiling and 802.1X authentication, so it authorises who may join the network rather than inspecting web requests from untrusted networks. It is tempting because ISE enforces identity-based policy, which would be the right choice for controlling device admission to corporate wired or wireless networks.

It enables direct firewall inspection of internal traffic.

Why it fails: Cisco ISE supplies identity and posture context to Secure Access, which uses it for zero-trust policy decisions; it does not perform firewall inspection of internal traffic. Firewall inspection is handled by the SIG's FWaaS or on-premises firewalls, making this tempting when ISE's enforcement role is overstated.

It allows ISE to act as a cloud proxy server.

Why it fails: ISE is an identity and policy engine, not a forward or cloud proxy; Secure Access itself provides the cloud proxy function. The integration passes user, device and posture attributes so Secure Access can apply zero-trust rules, which is why ISE's authentication role can be misread as proxying.

It automates the deployment of AnyConnect agents.

Why it fails: AnyConnect deployment is handled by endpoint management or Cisco Secure Client provisioning, not by ISE-to-Secure Access integration. The integration's purpose is sharing identity and posture context for policy enforcement; automation of agent rollout is a separate administrative task, which is why the two are conflated.

Cisco Stealthwatch Cloud

Why it fails: Stealthwatch Cloud provides network traffic visibility and behavioural anomaly detection across cloud workloads; it does not broker user sessions or enforce per-application access decisions. It is tempting because Zero Trust depends on continuous monitoring, but replacing VPN requires a brokering service such as Cisco Secure Access, which authenticates identity and applies policy per session.

Cisco Meraki Client VPN

Why it fails: Meraki Client VPN is itself a traditional VPN, terminating remote clients onto the MX appliance with network-level access; it performs no per-application, identity-driven authorisation. It is tempting because Meraki is cloud-managed, but Zero Trust replacement demands a zero-trust network access broker, not another tunnel extending broad network reach.

Cisco Firepower VPN

Why it fails: Firepower VPN terminates IPsec or SSL tunnels on the firewall, granting network-level access once connected; it enforces no continuous per-application, identity-based authorisation. It is tempting because Firepower adds inspection and threat defence, but the requirement is replacing VPN with a zero-trust access broker that evaluates identity and device posture per session.