Troubleshooting practice questions

You are troubleshooting a workflow where an API call to Cisco Secure Email fails with a 401 error. What is the most likely cause?

Trap 1: Network timeout

This would result in a 5xx error or a connection error.

Trap 2: Payload syntax error

This would result in a 400 or 422 error.

Trap 3: Invalid API endpoint URL

This would typically result in a 404 or 400 error.

A
Network timeout
Why wrong: This would result in a 5xx error or a connection error.
B
Payload syntax error
Why wrong: This would result in a 400 or 422 error.
C
Invalid API endpoint URL
Why wrong: This would typically result in a 404 or 400 error.
D
Expired credentials
401 errors are specifically related to unauthorized/expired credentials.

Read the full DNS explanation →

Question 2mediummultiple choice

When troubleshooting DNS queries in Umbrella, which command is most useful on a local machine to see if it is using the Umbrella resolvers?

Trap 1: ping 8.8.8.8

This tests reachability to Google DNS.

Trap 2: ipconfig /flushdns

This clears the local cache.

Trap 3: tracert 208.67.222.222

This tests network path to the resolver.

A
ping 8.8.8.8
Why wrong: This tests reachability to Google DNS.
B
ipconfig /flushdns
Why wrong: This clears the local cache.
C
nslookup debug.opendns.com
This is the standard test for Umbrella DNS resolution.
D
tracert 208.67.222.222
Why wrong: This tests network path to the resolver.

Question 3hardmultiple choice

You are troubleshooting a connection issue where a remote user cannot access a private cloud application via the Cisco Secure Access ZTNA connector. Which step is most likely to resolve the issue?

Trap 1: Increase the timeout value on the client browser.

Browser timeouts do not solve backend routing issues.

Trap 2: Flush the DNS cache on the corporate firewall.

The ZTNA connector uses its own tunnel mechanism, not the corporate firewall's DNS.

Trap 3: Reboot the user's laptop.

Rebooting is unlikely to fix a connector-to-resource communication issue.

A
Increase the timeout value on the client browser.
Why wrong: Browser timeouts do not solve backend routing issues.
B
Flush the DNS cache on the corporate firewall.
Why wrong: The ZTNA connector uses its own tunnel mechanism, not the corporate firewall's DNS.
C
Check the health status of the ZTNA connector in the Secure Access dashboard.
The connector must have an 'Active' status to route traffic to the private application.
D
Reboot the user's laptop.
Why wrong: Rebooting is unlikely to fix a connector-to-resource communication issue.

Question 4mediummultiple choice

When designing a cloud security architecture, why is 'logging and observability' so critical?

Trap 1: To automatically block all incoming traffic.

Logging is passive; blocking is an active firewall task.

Trap 2: To reduce the cost of cloud storage.

Logging actually increases storage requirements.

Trap 3: To increase the speed of the internet connection.

Logging has no effect on connection speed.

A
To automatically block all incoming traffic.
Why wrong: Logging is passive; blocking is an active firewall task.
B
To reduce the cost of cloud storage.
Why wrong: Logging actually increases storage requirements.
C
To increase the speed of the internet connection.
Why wrong: Logging has no effect on connection speed.
D
To ensure compliance and enable efficient threat hunting.
Visibility is the foundation of security operations.

Question 5mediummultiple choice

You are troubleshooting a missing event in Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud). Which configuration should you verify to ensure the cloud gateway is successfully pushing traffic metadata?

Trap 1: Active Directory integration settings

AD integration is for identity mapping, not traffic ingestion.

Trap 2: The local firewall rules on the monitored instance

VPC flow logs capture traffic at the network interface level, ignoring local host-based firewalls.

Trap 3: SecureX API token synchronization

This affects dashboard visibility, not the ingestion of raw traffic metadata.

A
Active Directory integration settings
Why wrong: AD integration is for identity mapping, not traffic ingestion.
B
The local firewall rules on the monitored instance
Why wrong: VPC flow logs capture traffic at the network interface level, ignoring local host-based firewalls.
C
VPC Flow Logs enablement
Without enabling VPC flow logs, no traffic metadata can be sent to the analytics platform.
D
SecureX API token synchronization
Why wrong: This affects dashboard visibility, not the ingestion of raw traffic metadata.

Question 6hardmulti select

Which THREE items are necessary for troubleshooting a failed 'Umbrella AD Connector' sync?

Trap 1: The physical server motherboard model

Irrelevant.

Trap 2: The local printer driver version

Irrelevant.

A
Logs located on the server running the connector
Primary source for troubleshooting sync errors.
B
Connector service account permissions
Service account must have read access to AD.
C
The physical server motherboard model
Why wrong: Irrelevant.
D
Domain Controller accessibility
Connector must talk to the DC.
E
The local printer driver version
Why wrong: Irrelevant.

Question 7mediummultiple choice

Which Duo log would be most useful for troubleshooting a failure during the initial push notification delivery?

Trap 1: Directory Sync Log

This is for user/group management, not auth delivery.

Trap 2: Telephony Log

This is only for SMS/Voice, not Push notifications.

Trap 3: Administrative Actions Log

This only logs admin changes.

A
Directory Sync Log
Why wrong: This is for user/group management, not auth delivery.
B
Telephony Log
Why wrong: This is only for SMS/Voice, not Push notifications.
C
Administrative Actions Log
Why wrong: This only logs admin changes.
D
Authentication Log
This provides transaction-level detail, including MFA method success/failure.

Question 8mediummultiple choice

You are troubleshooting a lack of visibility in the SecureX 'Device Trajectory' view for a roaming laptop. The device is connected to the network via AnyConnect, but SecureX is not showing the internal IP history. Which configuration is required to ensure this data is visible?

Trap 1: Install the SecureX plugin on the local endpoint.

There is no local 'SecureX plugin' for endpoints; data is handled by the agent's connection to the cloud.

Trap 2: Enable 'Visibility' settings in the AnyConnect profile editor.

AnyConnect visibility is handled by the Secure Endpoint module, not the profile editor alone.

Trap 3: Configure the Cisco ISE to send RADIUS accounting packets to…

ISE provides network context, but it does not populate the specific 'Device Trajectory' view within SecureX.

A
Install the SecureX plugin on the local endpoint.
Why wrong: There is no local 'SecureX plugin' for endpoints; data is handled by the agent's connection to the cloud.
B
Enable 'Visibility' settings in the AnyConnect profile editor.
Why wrong: AnyConnect visibility is handled by the Secure Endpoint module, not the profile editor alone.
C
Configure the Cisco ISE to send RADIUS accounting packets to SecureX.
Why wrong: ISE provides network context, but it does not populate the specific 'Device Trajectory' view within SecureX.
D
Configure the Secure Endpoint connector to report to the SecureX cloud.
Secure Endpoint must be connected to SecureX to provide the telemetry required for device trajectory.

Question 9hardmultiple choice

When troubleshooting a Cisco Umbrella roaming client visibility issue, what does the 'Diagnostic Tool' verify?

Trap 1: The encryption strength of the local database

This is not a visibility/connectivity issue.

Trap 2: The local CPU usage of the machine

This is not part of the network-focused diagnostic tool.

Trap 3: Active Directory domain controller sync

The roaming client doesn't directly manage AD sync.

A
The encryption strength of the local database
Why wrong: This is not a visibility/connectivity issue.
B
Connectivity to the Umbrella service and policy sync status
This is the primary function of the diagnostic tool.
C
The local CPU usage of the machine
Why wrong: This is not part of the network-focused diagnostic tool.
D
Active Directory domain controller sync
Why wrong: The roaming client doesn't directly manage AD sync.

Read the full VPN explanation →

Question 10hardmultiple choice

You are troubleshooting an Umbrella SIG tunnel connection. The IPsec tunnel is up, but users report timeouts. What is the most likely cause if the tunnel MTU is not adjusted correctly?

Trap 1: DNS resolution failure in the tunnel

This would cause domain lookup errors, not general timeouts.

Trap 2: Incorrect IKEv2 Phase 2 proposal

This would prevent the tunnel from establishing entirely.

Trap 3: Missing Proxy PAC file

PAC files are for explicit proxy, not tunnel-based SIG.

A
MTU mismatch causing packet fragmentation
IPsec adds overhead; if the path MTU is not adjusted, large packets are dropped.
B
DNS resolution failure in the tunnel
Why wrong: This would cause domain lookup errors, not general timeouts.
C
Incorrect IKEv2 Phase 2 proposal
Why wrong: This would prevent the tunnel from establishing entirely.
D
Missing Proxy PAC file
Why wrong: PAC files are for explicit proxy, not tunnel-based SIG.

Question 11hardmultiple choice

You are troubleshooting a scenario where users are unable to access a specific internal cloud resource after migrating to Cisco Secure Access. The traffic is being blocked by a default policy. How should you modify the traffic flow to ensure internal traffic stays off the SIG?

Trap 1: Disable the 'Inspect Traffic' setting globally in the Secure Access…

This would weaken security for all traffic, not just internal traffic.

Trap 2: Update the DNS policy to include internal domain suffixes as…

DNS exceptions do not resolve the issue of proxied traffic being sent to the SIG.

Trap 3: Assign the users to a separate Group Policy that has no web…

This does not prevent traffic from being backhauled to the SIG.

A
Configure a Tunnel Exclusion in the Secure Access tunnel settings for the internal IP ranges.
Tunnel exclusions allow specific traffic to bypass the SIG, ensuring internal resources remain reachable.
B
Disable the 'Inspect Traffic' setting globally in the Secure Access dashboard.
Why wrong: This would weaken security for all traffic, not just internal traffic.
C
Update the DNS policy to include internal domain suffixes as exceptions.
Why wrong: DNS exceptions do not resolve the issue of proxied traffic being sent to the SIG.
D
Assign the users to a separate Group Policy that has no web filtering enabled.
Why wrong: This does not prevent traffic from being backhauled to the SIG.