Network And Cloud Security practice questions

GRE (Generic Routing Encapsulation)

Why it fails: While GRE is supported, IKEv2/IPsec is the standard recommendation for security.

TLS 1.3

Why it fails: TLS is used for the explicit proxy, not tunnels.

SSH Tunneling

Why it fails: SSH is not a standard for SIG tunnel integration.

Roaming Client

Why it fails: The agent redirects traffic, but doesn't perform file analysis.

DNS-layer security

Why it fails: DNS-layer cannot perform file-level inspection.

Virtual Appliance

Why it fails: VA is for local DNS resolution.

An active subscription to a VPN provider

Why it fails: Umbrella is the provider.

Internal DNS server IP

Why it fails: Not a requirement for the tunnel itself.

Send an email alert to the user

Why it fails: Alerts go to admins.

Encrypt the traffic

Why it fails: Encryption is a transport layer, not a policy category action.

A dedicated VPN server

Why it fails: Not required for Umbrella.

Local Active Directory

Why it fails: Not a requirement for the client itself.

A physical router

Why it fails: Not needed on a laptop.

Deploy the Umbrella Virtual Appliance (VA) in a DMZ and configure it for direct Internet access.

Why it fails: A Virtual Appliance forwards DNS from network clients to Umbrella, but placing it in a DMZ with direct Internet access breaks the required internal-to-Umbrella resolution path and typically blocks client queries. It is tempting because VAs do provide agentless DNS inspection, and would be correct when deployed on the internal network with the specified egress rules.

Enable the 'DNS over HTTPS' feature in the browser settings for all end-user workstations.

Why it fails: Browser DNS over HTTPS encrypts queries to a public resolver, bypassing Umbrella's DNS-layer inspection entirely, so malicious domains are not filtered. DoH is tempting because it secures name resolution in transit, and would be correct when privacy from local network observers is the goal rather than centralised enforcement.

Configure a PAC file on each endpoint to route traffic to the Umbrella Roaming Client.

Why it fails: A PAC file directs HTTP and HTTPS proxy traffic; it does not route DNS queries, and the Roaming Client is itself a client-side agent, contradicting the agentless requirement. PAC files are tempting because they centralise web proxy routing, and would be correct when steering browser traffic through an explicit proxy.

Cisco Secure Endpoint

Why it fails: This is an EDR solution, not an identity mapping tool for Umbrella.

AnyConnect Management Tunnel

Why it fails: This provides connectivity, not identity mapping for network devices.

Umbrella Roaming Client

Why it fails: The roaming client provides identity without needing a VA, but the VA is the primary network-level component for this.

Deploy the Cisco Secure Endpoint agent to detect unauthorized VPN software.

Why it fails: While it can detect software, the question asks for a feature in Umbrella to mitigate the risk via policy.

Enable the 'Web Proxy' feature in the Global Settings.

Why it fails: This is a feature for enabling inspection, not blocking bypass tools.

Configure an SSL Inspection rule for all traffic.

Why it fails: SSL inspection allows for visibility, but does not inherently block VPN/proxy traffic unless paired with a policy.

Install a client-side agent on every endpoint behind the router.

Why it fails: Network-level tunnels negate the need for endpoint agents.

Enable the 'AnyConnect Tunnel' feature on the device.

Why it fails: AnyConnect is a client-based solution, not a network IPsec tunnel requirement.

Cloud firewall policy on the Secure Access egress that inspects traffic to the finance application

Why it fails: A cloud firewall policy inspects traffic flows but does not assess endpoint posture such as disk encryption or antivirus status. It cannot determine whether a contractor laptop meets security requirements before granting application access. This approach enforces network-layer controls, not device trust, and therefore does not satisfy the posture-check requirement.

SAML identity provider attribute mapping that includes a device-compliance claim in the assertion

Why it fails: SAML attribute mapping can convey IdP-known device claims, but it does not perform endpoint checks like disk encryption or antivirus state on the contractor laptop. Relying solely on IdP attributes would not validate the device's actual posture, leaving a gap in enforcement. The ZTNA posture check must be performed by an endpoint agent or equivalent mechanism.

Resource Connector deployed in the private network with posture profiles bound to the application

Why it fails: The Resource Connector establishes connectivity to private applications but does not enforce device posture on client endpoints. Posture evaluation occurs at the client and policy layer, not on the connector. Binding posture profiles to a connector would not validate contractor laptop state, so this approach fails to meet the requirement for endpoint posture enforcement without a VPN client.

Set up a firewall rule on the Secure Access Connector to deny traffic to the cloud app's IP range.

Why it fails: This is incorrect because Secure Access Connectors do not enforce application-level policies via firewall rules. They facilitate connectivity but do not provide the granular cloud app control or user notification. The correct approach is to use Global Policies in Secure Access to block and notify.

Enable the 'Block Unsanctioned Apps' setting in the Secure Access dashboard's Cloud App Discovery section.

Why it fails: This is incorrect because Cloud App Discovery is used for visibility and reporting, not enforcement. While it can identify unsanctioned apps, it does not block them or provide user notifications. Enforcement is done through policies, not discovery settings.

Configure a DNS policy in Umbrella to block the domain and redirect to a block page.

Why it fails: This is incorrect because the scenario is about Cisco Secure Access, not Umbrella DNS policies. While Umbrella can block domains, it does not provide the granular cloud application control and user notification within Secure Access. The administrator needs to use Secure Access policies to meet the specific requirement.

Install the Roaming Client on the router

Why it fails: The Umbrella Roaming Client is endpoint software for Windows or macOS, not installable on a router. Branch routers instead forward DNS to Umbrella's resolvers or tunnel traffic to a SIG IPsec tunnel. The Roaming Client would be correct when protecting individual roaming laptops.

Define an ACL to permit all traffic to Umbrella

Why it fails: An ACL permitting all traffic to Umbrella does not redirect traffic through the SIG; inspection requires policy-based routing or tunnel forwarding to Umbrella's anycast IPs. ACLs merely filter packets, so traffic would bypass inspection entirely. This option tempts when the goal is permitting specific Umbrella egress ranges through a restrictive firewall, not steering branch traffic.

Enable DNS-over-HTTPS on the router

Why it fails: Enabling DNS-over-HTTPS encrypts the router's own DNS queries, which prevents the Umbrella SIG from inspecting or filtering that resolution traffic. DoH is designed to protect DNS privacy from on-path observers, so it suits scenarios demanding confidential name resolution, not interception. The mandatory step is redirecting branch web traffic to the SIG.

Inside the browser settings directly

Why it fails: Browser settings store a proxy address, not a PAC file; Secure Access requires the PAC file to be reachable at an HTTP or HTTPS URL that browsers fetch. Hosting it locally in settings is tempting because manual proxy configuration lives there, but that scenario uses a static proxy, not automatic PAC retrieval.

On the Secure Access cloud gateway

Why it fails: The Secure Access cloud gateway proxies traffic; it does not serve PAC files, and browsers cannot retrieve configuration from it. Hosting there would be correct only if the gateway were also acting as an HTTP server for client configuration, which it is not.

In the local Windows Registry

Why it fails: The Windows Registry stores local machine settings, not a retrievable PAC file URL, and browsers cannot fetch automatic proxy configuration from it. It is relevant when pushing static proxy settings via Group Policy, not for PAC-based automatic configuration.

Secure Firewall Management Center

Why it fails: Secure Firewall Management Center centrally manages Firepower threat defence appliances; it neither installs on endpoints nor enforces Umbrella DNS policy off-VPN. It is tempting as a Cisco security console. It is correct for administering firewall devices, whereas roaming users require the Umbrella Roaming Client.

Umbrella Virtual Appliance

Why it fails: The Virtual Appliance is a DNS forwarder deployed on-premises to log internal DNS queries from network devices; it does not install on endpoints and cannot enforce policy for roaming users. It suits protecting on-network devices. Roaming enforcement needs the Umbrella Roaming Client on each endpoint.

AnyConnect Management VPN Tunnel

Why it fails: AnyConnect Management VPN Tunnel routes endpoint traffic through a headend, so DNS resolution depends on VPN connectivity and policy lapses when users disconnect. It suits managed remote-access VPN deployments. Consistent off-VPN enforcement instead requires the Umbrella Roaming Client installed locally on each endpoint.

Check the firewall NAT table

Why it fails: The firewall NAT table tracks address translation for connections traversing the firewall, not the SIG's cloud policy evaluation, so no rule attribution appears there. It is tempting because NAT faults cause connectivity loss, and would be correct when troubleshooting translation or routing failures on the local network path.

Run 'nslookup' on the destination

Why it fails: nslookup resolves the destination's IP address and confirms DNS reachability, but reveals nothing about which SIG web policy rule blocked the request. It is tempting because name resolution failures mimic blocks, and would be correct when diagnosing DNS or domain-resolution problems rather than policy enforcement.

Check the local endpoint hosts file

Why it fails: The hosts file maps hostnames locally and would only show a manual override, not the Secure Access SIG rule that denied the session. It is tempting because local overrides do cause unexplained blocks, and would be correct if the endpoint were resolving the SaaS domain to an incorrect address.

Review the Umbrella roaming client logs on the device

Why it fails: Umbrella roaming client logs record DNS-layer activity, not the Secure Access SIG's web policy decisions, so they cannot identify the blocking rule. It is tempting because Umbrella and Secure Access share Cisco branding, and would be correct for diagnosing DNS-tunnelling or roaming-client resolution faults.

Global Settings > Cloud Connectors

Why it fails: Cloud Connectors define private application discovery and connector registration, not policy evaluation logic. It is tempting because connectors relate to cloud traffic, but blocking applications by risk level belongs in the Global Policy ruleset, where application conditions and risk criteria are matched.

Connectors > Internet Gateway

Why it fails: Internet Gateway configures traffic forwarding and tunnel behaviour for internet-bound traffic, not application risk matching. It is tempting because all cloud application traffic traverses the gateway, but policy decisions blocking apps by risk level are defined in the Global Policy, not in connector or gateway settings.

Devices > Endpoint Profiles

Why it fails: Endpoint Profiles configure device posture and identity-based access conditions for endpoints, not cloud application risk categories. It is tempting because profiles influence access decisions, but they supply posture signals to policy rather than defining the application-blocking rule itself, which lives in Global Policy.

DNS resolution failure in the tunnel

Why it fails: An MTU mismatch causes large packets to be dropped after encapsulation, producing timeouts on big transfers while small requests succeed; DNS lookups are small and would still resolve. DNS failure inside the tunnel would break name resolution entirely, not selectively stall large payloads, so it is the wrong symptom match.

Incorrect IKEv2 Phase 2 proposal

Why it fails: A mismatched IKEv2 Phase 2 proposal prevents the IPsec security association from establishing, so the tunnel would not come up at all. Here the tunnel is already up, which rules that out. Phase 2 proposals are the correct focus when negotiating encryption and integrity algorithms during tunnel establishment.

Missing Proxy PAC file

Why it fails: A missing Proxy PAC file affects explicit proxy clients, not IPsec tunnel traffic, which is routed transparently by the Umbrella SIG. Timeouts from MTU mismatch stem from fragmentation and dropped oversized packets. PAC files are the right answer when configuring browser-based proxy autoconfiguration for roaming clients.

To bypass the ISP DNS settings

Why it fails: VAs forward internal client DNS queries to Umbrella for policy enforcement and identity mapping; they do not override ISP DNS settings. It is tempting because VAs do change where queries resolve, but the correct answer concerns resolving internal Active Directory names and attributing requests to users.

To cache web content locally

Why it fails: VAs forward DNS queries to Umbrella for policy and identity resolution; they do not cache web content, which is a proxy function. It is tempting because caching reduces latency, but the correct answer is forwarding internal DNS so Active Directory identities reach Umbrella.

To decrypt HTTPS traffic

Why it fails: Umbrella VA forwards DNS queries from on-premises endpoints to Umbrella's resolvers; it does not perform TLS interception, which is handled by the SIG proxy or the roaming client. Decryption is tempting because Umbrella's secure web gateway inspects HTTPS, but that function belongs to the cloud proxy, not the virtual appliance.

To sign digital certificates

Why it fails: An Integrations key authenticates third-party platforms and services to Umbrella's APIs, not certificate signing; certificate signing uses a CA's private key. It is tempting because keys and certificates are both cryptographic credentials, so the terminology overlaps, but the functions are distinct.

To encrypt DNS queries

Why it fails: An Integrations key authenticates the Umbrella roaming client or virtual appliance to the Umbrella API; it does not encrypt DNS queries, which are protected by DNSCrypt or DoH between client and resolver. Encryption is tempting because Integrations keys are secrets, but their purpose is API authentication, not transport security.

To identify roaming clients

Why it fails: An Integrations key authorises API calls to Umbrella, not client identity. Roaming clients are identified by their registered device identity or by a roaming computer's credentials, not by the Integrations key. The key is tempting because it is issued per organisation, but it authenticates API access, not endpoints.

Content Categories

Why it fails: Content Categories is the classification taxonomy itself; it groups destinations into predefined categories but does not let you author custom block or allow lists. It is tempting because categories drive policy, yet the Destination Lists feature is what holds the custom entries you define.

Identity Providers

Why it fails: Identity Providers map users to policies for roaming-client and AD-integrated identity, not destination categorisation or custom allow/block lists. It is tempting because it governs policy enforcement per user group, but that would be correct for identity-based rules, not domain-list management.

Policy Rules

Why it fails: Policy rules define the allow or block action for traffic, but the categorisation and custom destination lists themselves are configured under Destination Lists, which policy rules then reference. It is tempting because policy rules are where enforcement appears, yet they consume lists rather than create them.