Courseiva

CCNA User And Device Security Questions

40 questions · User And Device Security topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQhard

An organization requires that users on iOS devices must have a passcode enabled to access cloud resources. Which Duo feature enforces this?

A.Active Directory GPO for iOS
B.Duo Mobile Application Policy
C.MDM solution integration
D.Duo Authentication Proxy RADIUS rule
AnswerB

Duo Mobile Application Policy enforces device-side requirements on managed iOS endpoints, including requiring a passcode before granting access. This directly satisfies the stem's constraint that iOS users must have a passcode enabled to reach cloud resources, since the policy is evaluated by Duo Mobile on the device itself.

Why this answer

Duo Mobile Application Policy allows administrators to define security requirements for the Duo Mobile app itself, including requiring a device passcode (screen lock) on iOS and Android before the app can be used to approve authentication requests. This directly enforces the passcode requirement for accessing cloud resources protected by Duo.

Exam trap

SCAZT often tests the confusion between MDM-enforced device passcodes and Duo's own Mobile Application Policy, which enforces passcode at the app level.

How to eliminate wrong answers

Option A is wrong because Active Directory Group Policy Objects (GPOs) apply to Windows domain-joined computers, not iOS devices; iOS devices are not managed via AD GPOs. Option C is wrong because an MDM solution integration can enforce passcodes on managed devices, but the question asks which Duo feature enforces it; Duo Mobile Application Policy is the native Duo capability, and MDM integration is a separate, complementary solution. Option D is wrong because Duo Authentication Proxy RADIUS rules control authentication routing and protocol handling, not endpoint device passcode enforcement.

Practice this question →
2
Multi-Selecthard

Which THREE items are included in a Duo Authentication Log entry?

Select 3 answers
A.The user's plain-text password
B.The result of the authentication (Success/Failure)
C.The user's browser history
D.The timestamp of the authentication attempt
E.The username of the authenticated user
AnswersB, D, E

Each Duo Authentication Log entry records the authentication outcome, showing whether the attempt succeeded or failed. This result field satisfies the stem's requirement, letting administrators filter failures and trace denied or rejected access attempts during investigations.

Why this answer

Option B is correct because every Duo Authentication Log entry records the authentication result, showing whether the attempt was a Success, Failure, or another outcome such as Denied or Fraud. Option D is correct because each log entry includes the timestamp (date and time) of the authentication attempt, which is essential for auditing and correlating events. Option E is correct because the log identifies the username of the authenticated user, allowing administrators to trace activity to a specific account.

Option A is not included because Duo never stores or logs the user's plain-text password; credentials are handled by the primary authentication source and Duo processes only the second factor. Option C is not included because browser history is unrelated to Duo's authentication logging and is never captured in these entries.

Exam trap

SCAZT often tests whether candidates assume sensitive data like passwords or browsing history is logged — the exam expects you to know Duo logs authentication metadata, not credentials or user activity.

Practice this question →
3
MCQmedium

A user's device is marked as 'Out-of-Date' in Duo. How does the system determine this status?

A.By analyzing the user's browser user-agent string
B.By querying the Active Directory server for the last patch date
C.By the Duo Device Health application reporting the OS version to the Duo Cloud
D.By checking the device's public IP address geolocation
AnswerC

The Duo Device Health application collects the endpoint's OS version and reports it to Duo's cloud service, which compares it against the minimum version defined in your device health policy. That comparison produces the 'Out-of-Date' status, satisfying the stem's requirement for how Duo determines the flag.

Why this answer

Duo determines device health, including 'Out-of-Date' status, through the Duo Device Health application installed on the endpoint. That agent collects OS version, patch level, firewall/antivirus status, and other attributes, then reports them to the Duo cloud, where policies evaluate the device and assign a status such as Out-of-Date.

Exam trap

SCAZT often tests how Duo gathers device posture, so the trap is assuming passive signals like user-agent strings or AD queries provide health data, when in fact an active endpoint agent (Device Health) is required.

How to eliminate wrong answers

Option A is wrong because a browser user-agent string only reveals browser/OS family, not patch level or health, and is easily spoofed — it is not the basis for Duo's health verdict. Option B is wrong because Duo does not query Active Directory for patch dates; AD does not track endpoint patch state. Option D is wrong because IP geolocation has nothing to do with device health or OS version.

Practice this question →
4
MCQmedium

A security engineer is configuring Duo Authentication for Microsoft 365. The organization requires that users must be prompted for MFA only when accessing cloud resources from outside the corporate network. Which configuration setting in the Duo Admin Panel achieves this?

A.Enable 'Duo Device Health' on the Microsoft 365 application object
B.Set the global MFA mode to 'Bypass' in the Duo Application settings
C.Apply a 'Remembered Device' setting of 30 days to the entire group
D.Configure a New Authentication Policy with 'Authorized Networks' set to the corporate office IP range
AnswerD

An authentication policy scoped with Authorized Networks containing the corporate IP range means Duo prompts for MFA only when the access originates outside that range, satisfying the requirement to challenge solely off-network cloud access. Users inside the office bypass the prompt.

Why this answer

To prompt for MFA only when accessing Microsoft 365 from outside the corporate network, you configure a New Authentication Policy in the Duo Admin Panel with 'Authorized Networks' set to the corporate office IP range. This policy bypasses MFA for requests originating from those trusted IPs while enforcing MFA for all others.

Exam trap

SCAZT often tests the difference between network-based policies (Authorized Networks) and device-based or global settings, causing candidates to choose Remembered Device or global bypass instead of a targeted authentication policy.

How to eliminate wrong answers

Option A is wrong because Duo Device Health checks endpoint posture (e.g., OS version, antivirus) and does not control network-based MFA bypass. Option B is wrong because setting the global MFA mode to 'Bypass' disables MFA entirely for all users, not just for internal access. Option C is wrong because 'Remembered Device' reduces MFA frequency for a set period but does not differentiate by network location.

Practice this question →
5
MCQmedium

When integrating Duo with an application that uses the OIDC protocol, where are the 'Client ID' and 'Client Secret' configured?

A.In the local workstation registry
B.In the Duo Admin Panel application settings
C.In the user's browser settings
D.In the Duo Authentication Proxy config file
AnswerB

Duo's OIDC integration requires the Client ID and Client Secret to be entered in the Duo Admin Panel's application settings, where Duo acts as the identity provider. That location satisfies the stem by storing the credentials Duo presents to the relying application.

Why this answer

For OIDC integrations, Duo acts as the identity provider and the Client ID and Client Secret are generated and stored in the Duo Admin Panel under the application's settings. These credentials are then copied into the relying application's configuration to establish the OIDC trust.

Exam trap

SCAZT often tests where OIDC credentials live versus where they are used; candidates who conflate the Authentication Proxy (used for RADIUS/LDAP) with OIDC integrations pick the proxy config file instead of the Duo Admin Panel.

How to eliminate wrong answers

Option A is wrong because the local workstation registry is not where OIDC client credentials are stored; registry entries may hold client configuration but not the authoritative Duo-issued secrets. Option C is wrong because browser settings have no role in storing OIDC client credentials. Option D is wrong because the Duo Authentication Proxy is used for RADIUS/LDAP-style integrations, not OIDC; OIDC client credentials live in the Duo Admin Panel application configuration.

Practice this question →
6
Multi-Selecthard

Which THREE settings are part of the 'Authentication Policy' in the Duo Admin Panel?

Select 3 answers
A.Hardware token assignment
B.MFA prompt behavior (e.g., auto-push)
C.Authorized networks
D.AD forest trust configuration
E.Remembered devices duration
AnswersB, C, E

MFA prompt behaviour, such as auto-push, is configured within the Authentication Policy, controlling whether Duo pushes automatically or requires the user to choose a method. It is one of the three settings the question asks for.

Why this answer

In the Duo Admin Panel, the Authentication Policy is a global policy that governs how users authenticate, and it explicitly includes the MFA prompt behavior setting (B), such as auto-push and whether users can choose among push, phone call, or passcode, which controls the second-factor experience. It also includes Authorized networks (C), which define IP ranges or CIDR blocks from which users can authenticate without MFA or with reduced requirements, directly shaping authentication enforcement. It further includes Remembered devices duration (E), which sets how long a device can be trusted to skip Duo MFA (for example, 1 to 30 days), a core element of the authentication policy.

Hardware token assignment (A) is managed under device/token management and user enrollment rather than the Authentication Policy, and AD forest trust configuration (D) belongs to Active Directory or directory integration settings, not the Authentication Policy.

Exam trap

SCAZT often tests whether candidates can distinguish Authentication Policy settings (prompt behavior, authorized networks, remembered devices) from user/device management tasks (hardware tokens) and directory configuration (AD trusts).

Practice this question →
7
MCQhard

An organization wants to use Duo for both Windows Logon and Cloud SSO. What is the difference in deployment?

A.Windows Logon requires an installed agent on the endpoint
B.Cloud SSO requires a local agent
C.Both use the same local agent
D.Both require a RADIUS server
AnswerA

Duo Windows Logon authenticates at the interactive desktop, requiring the Duo Authentication for Windows Logon agent installed on each endpoint to intercept the credential provider. Cloud SSO instead redirects users to Duo's hosted service via SAML or OIDC, needing no endpoint software.

Why this answer

Windows Logon with Duo requires the Duo Authentication for Windows Logon agent to be installed on each endpoint because it integrates with the Windows credential provider to intercept interactive logons. Cloud SSO, by contrast, is a cloud-based service that integrates with the identity provider (e.g., Azure AD, Okta) via SAML or OIDC and does not require a local agent on the endpoint.

Exam trap

SCAZT often tests the assumption that all Duo deployments require a local agent; candidates must remember that Cloud SSO is agentless and that Windows Logon specifically requires the endpoint agent.

How to eliminate wrong answers

Option B is wrong because Cloud SSO does not require a local agent; it is a cloud-hosted service that brokers authentication between the IdP and the application, so endpoints only need a browser. Option C is wrong because the two deployments use fundamentally different mechanisms—Windows Logon uses a local credential provider agent, while Cloud SSO uses cloud-based federation—so they do not share the same local agent. Option D is wrong because neither Windows Logon nor Cloud SSO requires a RADIUS server; RADIUS is used for Duo Network Gateway or VPN integrations, not for these two specific deployment types.

Practice this question →
8
MCQmedium

How does Duo protect an application that does not support modern authentication protocols?

A.By installing a local agent on the cloud application server
B.By using the Authentication Proxy to perform RADIUS/LDAP validation
C.By redirecting the user to a SAML 2.0 gateway
D.By forcing the user to use a VPN
AnswerB

The Authentication Proxy sits in front of legacy applications and translates their native RADIUS or LDAP authentication requests into Duo's modern protocol, applying MFA before forwarding credentials. This satisfies the stem's constraint of protecting an application that cannot itself speak modern authentication protocols.

Why this answer

For applications that lack modern authentication (no SAML, OIDC, or similar), Duo uses the Authentication Proxy. The proxy sits on-premises and speaks legacy protocols like RADIUS and LDAP to the application, while brokering the authentication to Duo's cloud for MFA. This lets Duo protect older or custom apps without modifying them.

Exam trap

SCAZT often tests integration methods for different app types, so the trap is assuming all apps can use SAML redirects or that an agent must be installed on the app server, when legacy apps actually require the RADIUS/LDAP Authentication Proxy.

How to eliminate wrong answers

Option A is wrong because Duo does not require installing an agent on the cloud application server; the Authentication Proxy is a separate component that fronts the app. Option C is wrong because redirecting to a SAML 2.0 gateway presupposes the app supports SAML, which is exactly what a legacy app does not. Option D is wrong because forcing a VPN does not add MFA to the application itself and is not how Duo integrates with legacy protocols.

Practice this question →
9
MCQeasy

What is the primary benefit of the Duo Universal Prompt compared to the traditional iframe-based prompt?

A.It is a hosted redirect that provides a more secure and consistent experience
B.It supports offline authentication only
C.It removes the need for mobile devices
D.It requires less bandwidth
AnswerA

The Universal Prompt redirects the browser to a Duo-hosted page rather than embedding an iframe, so credentials never pass through the relying application. This removes iframe clickjacking and third-party cookie weaknesses, giving a consistent, phishing-resistant experience across browsers and devices.

Why this answer

The Duo Universal Prompt is a hosted, redirect-based authentication experience that replaces the traditional iframe-based prompt. Because it is hosted by Duo rather than embedded in the customer's page, it provides a more secure and consistent experience across browsers and devices, and it is not subject to the restrictions and security risks of iframes (e.g., clickjacking, third-party cookie blocking). This design also simplifies integration and future feature rollouts.

Exam trap

SCAZT often tests the difference between the iframe-based Duo Prompt and the Universal Prompt, and candidates incorrectly assume the Universal Prompt is about offline access or bandwidth rather than security and redirect-based architecture.

How to eliminate wrong answers

Option B is wrong because the Universal Prompt does not support offline authentication only — Duo's offline authentication is a separate capability, and the Universal Prompt is an online redirect flow. Option C is wrong because the Universal Prompt does not remove the need for mobile devices; Duo Push to a smartphone remains a primary authentication method. Option D is wrong because reduced bandwidth is not the primary benefit; the key advantages are security, consistency, and compatibility, not bandwidth savings.

Practice this question →
10
MCQhard

A security auditor notices that Duo authentication logs show an 'Authentication Succeeded' status, but the user was denied access to the SaaS application. Which policy setting is the most likely cause?

A.Device health policy violation detected after MFA
B.Incorrect username provided during MFA
C.Duo Authentication Proxy is down
D.Expired Duo license
AnswerA

A device health policy violation detected after MFA explains the mismatch: Duo confirms the second factor succeeded, yet the SaaS application's conditional access evaluates device compliance separately and blocks the session. The constraint is that authentication and authorisation are distinct stages, so a post-MFA device check denies access despite the successful Duo log entry.

Why this answer

Duo's authentication flow can include device health checks (e.g., OS version, firewall status, screen lock) after primary authentication. If the device fails a health policy, Duo may return 'Authentication Succeeded' for the MFA portion but then deny access to the application based on the device health policy. Thus, the most likely cause is a device health policy violation detected after MFA.

Exam trap

The trap is assuming that 'Authentication Succeeded' means full access; candidates must remember that Duo can still deny access based on post-authentication policies like device health, which are evaluated after MFA.

How to eliminate wrong answers

Option B is wrong because an incorrect username would result in an authentication failure, not a success followed by denial; the log would show 'Authentication Failed' or 'User Unknown'. Option C is wrong because if the Duo Authentication Proxy were down, authentication would fail entirely, not succeed and then be denied by the SaaS application. Option D is wrong because an expired Duo license would prevent all authentications, typically showing license errors, not a successful authentication followed by access denial.

Practice this question →
11
MCQmedium

During a Duo enrollment phase, a user is required to install the Duo Mobile app. What is the main security purpose of the app in the MFA flow?

A.To track the user's location at all times
B.To facilitate encrypted push notifications and act as a secure token
C.To scan the user's local network for unauthorized devices
D.To act as a remote desktop client for cloud apps
AnswerB

Duo Mobile receives encrypted push notifications over TLS and generates time-based one-time passcodes locally, so authentication completes without SMS interception or network credential exposure. This satisfies the enrollment constraint by binding the second factor to a registered device rather than a transferable channel, enabling offline passcode generation when push delivery fails.

Why this answer

The Duo Mobile app serves as the second factor in MFA by receiving encrypted push notifications for authentication requests and generating time-based one-time passcodes (TOTP) as a secure token. It binds the user's identity to a specific device, so possession of the enrolled device is required to approve login attempts. This is the core security purpose of the app in the Duo MFA flow.

Exam trap

SCAZT often tests the specific role of Duo Mobile in MFA, so the trap is attributing unrelated endpoint security or remote access functions to the app instead of its authentication token and push notification role.

How to eliminate wrong answers

Option A is wrong because Duo Mobile does not continuously track user location; location-based policies are optional and use IP geolocation, not the app's GPS. Option C is wrong because scanning the local network for unauthorized devices is a NAC function (e.g., Cisco ISE), not a Duo Mobile capability. Option D is wrong because Duo Mobile is not a remote desktop client; it is an authentication factor app, and remote access is handled by separate VPN or RDP clients.

Practice this question →
12
MCQmedium

A security team is deploying Cisco Duo to protect a set of internal web applications accessed through a reverse proxy. They require that users authenticate with Duo before the proxy forwards any request, and they want to enforce this at the network edge without modifying each application. Which Duo deployment component should they implement?

A.Duo Device Health Application
B.Duo Single Sign-On (Duo SSO)
C.Duo Authentication Proxy
D.Duo Network Gateway (DNG)
AnswerD

Duo Network Gateway is a reverse proxy that sits in front of internal web applications and enforces Duo authentication before forwarding any request. It allows organizations to protect multiple web apps without modifying them, and it can be deployed at the network edge to provide a centralized enforcement point, matching the scenario requirements exactly.

Why this answer

Duo Network Gateway is the only component that functions as a reverse proxy to protect internal web applications with Duo MFA without modifying each application. It intercepts requests at the network edge, enforces authentication, and then forwards traffic, providing centralized control. The other options either require per-app integration or serve different purposes such as federation or device posture.

Exam trap

The trap here is assuming that Duo SSO or the Authentication Proxy can enforce MFA at the network edge for web apps, when only Duo Network Gateway provides that reverse-proxy capability.

Practice this question →
13
MCQmedium

You are deploying Duo Passwordless authentication. Which factor must be verified on the endpoint before a user can successfully authenticate?

A.The user must be connected to the corporate VPN
B.The endpoint must have a Cisco AnyConnect client installed
C.The endpoint must have the Duo Authentication Proxy installed
D.The endpoint must have an active WebAuthn-compliant platform authenticator
AnswerD

Duo Passwordless binds authentication to a WebAuthn-compliant platform authenticator, such as Windows Hello or Touch ID, which generates a device-bound cryptographic key pair. Without that active authenticator the endpoint cannot produce the signed assertion, so the stem's verification requirement fails.

Why this answer

Duo Passwordless authentication requires the endpoint to have an active WebAuthn-compliant platform authenticator (e.g., Windows Hello, Touch ID, or a security key) to verify the user's identity without a password. This hardware-backed authenticator is the core factor that enables passwordless login.

Exam trap

SCAZT often tests the confusion between Duo's traditional MFA (which can use push, SMS, etc.) and Duo Passwordless, which specifically requires a WebAuthn-compliant platform authenticator on the endpoint.

How to eliminate wrong answers

Option A is wrong because VPN connectivity is not required for Duo Passwordless; authentication can occur over any internet connection. Option B is wrong because Cisco AnyConnect is a VPN client, not a requirement for Duo Passwordless. Option C is wrong because the Duo Authentication Proxy is an on-premises component for integrating with RADIUS/LDAP, not an endpoint requirement for passwordless.

Practice this question →
14
MCQhard

An administrator wants to audit all Duo administrative actions. Which log provides this information?

A.Authentication Log
B.Telephony Log
C.Trust Monitor Log
D.Administrator Actions Log
AnswerD

The Administrator Actions Log records Duo administrative changes, including who performed each action and when. It directly satisfies the stem's audit requirement, unlike the Authentication Log, which captures end-user login events rather than admin activity.

Why this answer

The Administrator Actions Log in Duo records all administrative actions performed in the Duo Admin Panel, such as user creation, policy changes, and integration modifications. This log is specifically designed for auditing administrative activities. The other logs serve different purposes.

Exam trap

SCAZT often tests the specific purpose of each Duo log, and candidates may confuse the Administrator Actions Log with the Authentication Log, especially if they assume all logs contain admin actions.

How to eliminate wrong answers

Option A is wrong because the Authentication Log records user authentication attempts and outcomes, not administrative actions. Option B is wrong because the Telephony Log records telephony events like phone calls and SMS messages used for authentication, not admin actions. Option C is wrong because the Trust Monitor Log records risk-based authentication events and trust assessments, not administrative actions.

Practice this question →
15
MCQhard

A security engineer is worried about 'MFA fatigue' attacks. Which Duo configuration is the best defense?

A.Disabling Duo Push and requiring phone calls only
B.Increasing the MFA timeout to 60 seconds
C.Enabling Duo Push with Number Matching
D.Setting 'Remembered Devices' to 1 year
AnswerC

Number matching requires the user to enter a code displayed in the authenticating session, defeating blind push approvals that attackers exploit during MFA fatigue. The user must consciously verify the number, breaking the repeated-prompt attack pattern.

Why this answer

MFA fatigue (push bombing) attacks work by spamming a victim with Duo Push prompts until they approve one out of annoyance or confusion. Duo Push with Number Matching forces the user to enter a number displayed in the login browser into the Duo Mobile app, proving the user is actively looking at the legitimate authentication attempt and cannot blindly approve a random push.

Exam trap

SCAZT often tests whether candidates recognize that the fix for MFA fatigue is binding the approval to the session (number matching), not weakening or extending the MFA mechanism itself.

How to eliminate wrong answers

Option A is wrong because disabling Push and using phone calls only degrades security and usability — voice callbacks are vulnerable to social engineering and SIM-swap, and do not address fatigue. Option B is wrong because increasing the MFA timeout to 60 seconds actually gives the attacker a longer window to bombard the user and does nothing to verify intent. Option D is wrong because a 1-year 'Remembered Devices' setting dramatically weakens MFA by allowing long-term bypass from a compromised device, increasing risk rather than mitigating fatigue.

Practice this question →
16
MCQmedium

What is the primary function of the 'Duo Network Gateway'?

A.To act as a firewall for the cloud application
B.To sync local AD groups to the cloud
C.To perform load balancing for the Duo service
D.To provide secure access to on-premises apps without a VPN
AnswerD

Duo Network Gateway publishes internal web applications to remote users through a reverse-proxy architecture, authenticating each request before forwarding it. This satisfies the stem's requirement of reaching on-premises apps without a VPN, since no tunnel or client software is needed—access is brokered per session at the application layer rather than at the network layer.

Why this answer

The Duo Network Gateway (DNG) is a reverse-proxy appliance deployed on-premises that lets remote users reach internal web applications through Duo's cloud service without requiring a traditional VPN client. It authenticates users via Duo's MFA and then brokers the connection to the internal app, effectively replacing VPN for browser-based access. This is its defining purpose within the Duo Zero Trust portfolio.

Exam trap

SCAZT often tests whether candidates confuse the Duo Network Gateway with a firewall or VPN concentrator, when its actual role is a reverse proxy providing VPN-less access to on-premises web apps.

How to eliminate wrong answers

Option A is wrong because DNG is not a firewall — it does not perform stateful packet inspection, IPS, or perimeter filtering; that role belongs to Cisco Secure Firewall. Option B is wrong because AD group synchronization is handled by the Duo Authentication Proxy or Duo Directory Sync, not the Network Gateway. Option C is wrong because load balancing is a function of Duo's cloud infrastructure and is not a capability exposed by the DNG appliance.

Practice this question →
17
MCQeasy

Which of the following describes the 'Duo Central' portal?

A.A local server component for handling RADIUS
B.A security tool for scanning endpoints
C.A user-facing portal that provides a single point of access to apps
D.A tool for administrators to manage Duo policies
AnswerC

Duo Central is a user-facing portal presenting a single dashboard of assigned applications, giving users one access point after authenticating with Duo, which satisfies the requirement for simplified, consolidated application access rather than administrative configuration.

Why this answer

Duo Central is a user-facing portal that gives end users a single, unified launch point for all their assigned applications after they authenticate. It presents the apps a user is entitled to and can enforce Duo policies (like device health or MFA) at access time. It is essentially a personalized app dashboard for the end user, not an admin console.

Exam trap

SCAZT often tests the boundary between user-facing and admin-facing Duo components, so the trap is confusing Duo Central (end-user app portal) with the Admin Panel (policy management) or the Authentication Proxy (RADIUS/LDAP).

How to eliminate wrong answers

Option A is wrong because the local RADIUS-handling component is the Duo Authentication Proxy, not Duo Central. Option B is wrong because endpoint scanning is performed by the Duo Device Health application, not the Central portal. Option D is wrong because administrative policy management happens in the Duo Admin Panel, not in Duo Central, which is user-facing.

Practice this question →
18
Multi-Selectmedium

Which TWO things must be done to successfully protect a legacy VPN with Duo?

Select 2 answers
A.Join the VPN to the Active Directory domain
B.Configure the VPN to use the Authentication Proxy as its RADIUS server
C.Install the Duo agent on the VPN headend device
D.Define the VPN device as a RADIUS client in the Duo Admin Panel
E.Enable SAML on the VPN device
AnswersB, D

Duo's Authentication Proxy acts as the RADIUS intermediary, so the legacy VPN must point at it rather than any other server. This lets the proxy broker primary credentials and Duo MFA before returning an Access-Accept to the VPN.

Why this answer

To protect a legacy VPN with Duo, the VPN concentrator must be pointed at Duo's Authentication Proxy as its RADIUS server (option B), because the proxy is the component that brokers RADIUS requests between the VPN and Duo's cloud service, allowing Duo MFA to be inserted into the existing RADIUS authentication flow. Correspondingly, the VPN device must be registered as a RADIUS client in the Duo Admin Panel (option D) so that the Authentication Proxy recognizes the device, validates its shared secret, and permits it to send authentication requests. Options A and E are incorrect because joining the VPN to Active Directory or enabling SAML is not required for a RADIUS-based legacy VPN integration, and option C is wrong because Duo does not require installing an agent directly on the VPN headend device; the Authentication Proxy handles that role.

Exam trap

SCAZT often tests the specific components required for Duo integration with VPNs — candidates may think an agent is needed on the VPN or that SAML is used, but the correct approach is RADIUS via the Authentication Proxy.

Practice this question →
19
Multi-Selecthard

Which THREE factors can be evaluated by Duo Device Health during an access request?

Select 3 answers
A.Active Internet connection speed
B.OS version and patch level
C.User's current GPS location
D.Disk Encryption status
E.Antivirus status
AnswersB, D, E

Duo Device Health reads the endpoint's operating system build and applied patches, comparing them against the policy's minimum required version. This satisfies the access-request evaluation by confirming the device meets the organisation's patching baseline before granting access.

Why this answer

Duo Device Health evaluates endpoint posture attributes at access time, and OS version and patch level (B) is one of its supported checks, allowing policies to require a minimum OS build or patch state before granting access. Disk Encryption status (D) is also a native Device Health signal, so administrators can block or step-up authentication for devices whose drives are not encrypted (e.g., BitLocker, FileVault). Antivirus status (E) is likewise collected, letting policies verify that a recognized AV product is installed, running, and up to date.

The remaining options are not Device Health factors: active Internet connection speed (A) is a network performance metric, not a posture attribute Duo reports, and the user's current GPS location (C) is not gathered by Duo Device Health for access evaluation.

Exam trap

SCAZT often tests the scope of Duo Device Health — candidates incorrectly assume it evaluates network performance or location, when it is strictly focused on endpoint security posture.

Practice this question →
20
Multi-Selectmedium

Which TWO configuration parameters are required when setting up the Duo Authentication Proxy for an LDAP source?

Select 2 answers
A.The user's personal Duo device ID
B.The LDAP server hostname or IP address
C.The public DNS server address
D.The bind credentials (distinguished name and password)
E.The root password of the Active Directory domain
AnswersB, D

The proxy must know where to send bind and search requests, so the LDAP source's hostname or IP address is mandatory. Without this target, the Authentication Proxy cannot establish any connection to the directory server.

Why this answer

Option B is correct because the Duo Authentication Proxy must know where to send LDAP bind and search requests, so the [ldap_server_auto] or [ldap_server] section requires the host parameter specifying the LDAP server's hostname or IP address. Option D is correct because the proxy authenticates to the directory to perform binds and lookups, requiring the service account's bind_dn (distinguished name) and bind_pass (password) in the configuration. Option A is wrong because a user's personal Duo device ID is not part of the proxy's LDAP source configuration; device enrollment and identification are handled by Duo's cloud service, not the proxy's LDAP stanza.

Option C is wrong because a public DNS server address is not an LDAP source parameter; name resolution is handled by the host OS, not the Duo Authentication Proxy LDAP configuration. Option E is wrong because the Active Directory domain root password is never required or recommended; the proxy uses a least-privilege bind account, not domain administrator credentials.

Exam trap

SCAZT often tests whether candidates confuse per-user enrollment artifacts (like device IDs) with proxy-level configuration parameters, so the trap is selecting the user-specific option instead of the infrastructure-level host and bind credentials.

Practice this question →
21
MCQmedium

When configuring Duo Trust Monitor, what is the primary purpose of 'Baseline' behavior?

A.To identify normal authentication patterns for users
B.To enforce MFA for every authentication attempt
C.To synchronize identity sources from LDAP
D.To define the static list of allowed IP addresses
AnswerA

Baseline behaviour establishes each user's normal authentication patterns — typical locations, devices, times and access frequencies. Trust Monitor then flags deviations from this learned baseline as anomalous, enabling detection of compromised credentials or risky sign-ins.

Why this answer

Duo Trust Monitor's 'Baseline' behavior establishes what normal authentication looks like for each user by learning patterns such as typical locations, devices, times, and application access. This baseline is then used to detect anomalies that may indicate compromised credentials or risky behavior. It is not an enforcement mechanism, identity sync, or static allow list.

Exam trap

The trap is confusing Trust Monitor's behavioral baseline with Duo policy enforcement or directory sync — Baseline is about learning normal patterns, not enforcing MFA or syncing identities.

How to eliminate wrong answers

Option B is wrong because enforcing MFA for every authentication is a policy setting in Duo, not the purpose of Trust Monitor's Baseline behavior. Option C is wrong because synchronizing identity sources from LDAP is a directory integration function, unrelated to behavioral baselining. Option D is wrong because defining a static list of allowed IP addresses is a network access control, whereas Baseline is dynamic and behavioral, not a static allow list.

Practice this question →
22
MCQmedium

In the context of the Duo Authentication Proxy, what is the 'fail_mode' parameter used for?

A.To decide whether to permit local password caching
B.To set the timeout for LDAP queries
C.To define how to handle requests when the cloud service is unreachable
D.To enable logging for failed authentication attempts
AnswerC

The fail_mode parameter in the Duo Authentication Proxy configuration determines behaviour when the proxy cannot reach Duo's cloud service, allowing either fail-open or fail-closed authentication. This satisfies the requirement to define handling of requests during cloud unreachability.

Why this answer

The fail_mode parameter in the Duo Authentication Proxy determines how authentication requests are handled when the Duo cloud service cannot be reached — for example, whether to fail open (allow) or fail closed (deny) for the configured integration.

Exam trap

SCAZT often tests fail_mode versus offline access — candidates assume fail_mode controls caching or logging rather than outage behaviour.

How to eliminate wrong answers

Option A is wrong because local password caching is controlled by offline/fallback settings, not fail_mode. Option B is wrong because LDAP query timeouts are set via timeout parameters, not fail_mode. Option D is wrong because logging of failed attempts is governed by log settings, not fail_mode.

Practice this question →
23
MCQhard

A company wants to prevent users from using personal devices for work. Which Duo policy is most effective for this?

A.Browser version policy
B.Geographic location policy
C.MFA prompt frequency policy
D.Trusted Endpoints policy with certificate requirement
AnswerD

Trusted Endpoints with certificate-based device identity blocks access from any machine lacking a company-issued certificate, directly enforcing the no-personal-devices constraint. Unlike device health or OS checks, which personal laptops can often satisfy, certificate validation proves managed enrolment, so unmanaged personal devices are denied at authentication.

Why this answer

Duo's Trusted Endpoints policy with certificate requirement verifies that the device accessing protected applications possesses a valid device certificate issued by your organization's MDM or Duo's own certificate authority. Personal devices that are not enrolled and do not have the certificate are denied access, effectively blocking BYOD. This is the most direct and enforceable control for restricting access to corporate-managed devices.

Exam trap

SCAZT often tests the misconception that browser version or geographic policies can enforce device ownership, when only certificate-based Trusted Endpoints actually verifies managed devices.

How to eliminate wrong answers

Option A is wrong because a browser version policy only checks the browser's version and patch level; it does not distinguish corporate from personal devices, so a personal laptop with an up-to-date browser would still pass. Option B is wrong because a geographic location policy restricts access based on IP geolocation, which is unrelated to device ownership; a personal device in an allowed region would still be permitted. Option C is wrong because MFA prompt frequency controls how often users must re-authenticate, not which devices they can use; a personal device could still authenticate successfully.

Practice this question →
24
MCQhard

An organization uses Duo Access Gateway (DAG) to protect on-premises applications. They want to transition to Duo SSO. What is the primary difference in architecture?

A.Duo SSO eliminates the need for on-premises server infrastructure for the identity provider
B.Duo SSO supports only SAML 1.0 protocols
C.Duo SSO requires a dedicated hardware appliance
D.Duo SSO requires the installation of the Duo Authentication Proxy on a local server
AnswerA

Duo SSO is a cloud-hosted identity provider, so authentication is brokered by Duo's service rather than a local DAG server. This removes the on-premises DAG host and its maintenance, directly satisfying the transition's goal of eliminating local identity provider infrastructure while still protecting the same applications.

Why this answer

Duo Access Gateway (DAG) is an on-premises identity provider that must be installed on a local server to broker authentication for protected applications. Duo SSO is Duo's cloud-hosted identity provider, so migrating to it removes the need to maintain on-premises IdP server infrastructure — authentication is handled in Duo's cloud.

Exam trap

SCAZT often tests the architectural shift from on-premises IdP (DAG) to cloud IdP (Duo SSO), so candidates who assume Duo SSO still needs a local server or the Authentication Proxy pick the wrong answer.

How to eliminate wrong answers

Option B is wrong because Duo SSO supports modern federation protocols including SAML 2.0 and OpenID Connect, not 'SAML 1.0 only.' Option C is wrong because Duo SSO is a cloud service and requires no dedicated hardware appliance. Option D is wrong because the Duo Authentication Proxy is a separate component used for things like LDAP/AD or RADIUS integration and two-factor auth, not the defining architectural requirement of Duo SSO.

Practice this question →
25
MCQmedium

A user is attempting to access a cloud application protected by Duo SSO. The Duo prompt shows 'Access Denied: Your device is not running a supported browser'. Where is this restriction defined?

A.In the Active Directory GPO for the user
B.In the Duo Authentication Proxy configuration file
C.In the Duo Application configuration under 'Browser Restrictions'
D.In the local browser settings of the client machine
AnswerC

Browser Restrictions in the Duo Application configuration define which browsers are permitted for that protected application. When the user's browser is unsupported, Duo SSO returns 'Access Denied', so this setting is where the restriction originates.

Why this answer

The 'Access Denied: Your device is not running a supported browser' message from Duo SSO is generated by the Duo application's browser restriction settings. In the Duo Admin Panel, each protected application can be configured with browser restrictions that define which browsers and versions are permitted, and Duo enforces this at the SSO prompt before granting access.

Exam trap

SCAZT often tests where Duo SSO policy lives, tricking candidates into blaming AD GPOs or the Authentication Proxy when the browser restriction is actually a per-application setting in the Duo Admin Panel.

How to eliminate wrong answers

Option A is wrong because an Active Directory GPO controls Windows client settings and cannot inject a Duo SSO prompt message about browser support; the restriction is enforced by Duo, not AD. Option B is wrong because the Duo Authentication Proxy configuration file handles authentication proxying (LDAP, RADIUS, etc.) and does not define per-application browser restrictions. Option D is wrong because local browser settings on the client machine affect what the user can browse, but the Duo prompt's 'Access Denied' message is server-side policy from Duo, not a client-side browser configuration.

Practice this question →
26
MCQeasy

What is the purpose of the 'Enrollment Email' sent by Duo?

A.To notify the user of a security breach
B.To allow the user to register their authentication device
C.To provide instructions on how to use VPN
D.To reset the user's domain password
AnswerB

The enrollment email delivers a unique registration link that lets the user bind their authentication device, such as a smartphone running Duo Mobile, to their Duo account. Without completing enrolment, the user cannot receive push prompts or generate passcodes.

Why this answer

The Enrollment Email sent by Duo is used to invite users to enroll their authentication devices, such as smartphones or hardware tokens. It contains a link that guides the user through the device registration process. This is a core part of Duo's user enrollment workflow.

Exam trap

SCAZT often tests the purpose of Duo features, and candidates may confuse the Enrollment Email with password reset or security notification emails, but the key is that it's for device registration.

How to eliminate wrong answers

Option A is wrong because the Enrollment Email is not used to notify users of security breaches; that would be a security alert, not an enrollment email. Option C is wrong because providing VPN instructions is not the purpose of the enrollment email; VPN configuration is separate. Option D is wrong because resetting domain passwords is not related to Duo enrollment; Duo does not manage domain passwords.

Practice this question →
27
Multi-Selecthard

Which THREE of the following are components of the Duo 'Trusted Endpoints' solution?

Select 3 answers
A.An MDM/UEM solution for device management
B.Duo policy configured to require trusted endpoints
C.Local firewall on the endpoint
D.Device certificate on the endpoint
E.Active Directory domain controller
AnswersA, B, D

Trusted Endpoints relies on an MDM/UEM solution to inventory managed devices and issue certificates, providing the authoritative device identity Duo checks. Without this management platform, Duo cannot verify endpoint trust, so it is a required component of the solution.

Why this answer

Option A (an MDM/UEM solution for device management) is correct because Duo Trusted Endpoints relies on an MDM/UEM platform (such as Intune, Jamf, or Workspace ONE) to enroll, manage, and report the compliance/management state of devices that Duo then evaluates. Option B (a Duo policy configured to require trusted endpoints) is correct because the enforcement mechanism is a Duo policy setting that requires the accessing device to be a trusted endpoint before granting access to the protected application. Option D (a device certificate on the endpoint) is correct because Duo Trusted Endpoints uses a client certificate issued to the managed device as the cryptographic proof of trust that the Duo service validates during authentication.

Option C (local firewall on the endpoint) is not part of the solution, since host firewalls control network traffic and play no role in Duo's device trust verification. Option E (Active Directory domain controller) is not a component of Trusted Endpoints, as AD provides identity authentication and directory services rather than the device-trust management and certificate validation that the solution requires.

Exam trap

SCAZT often tests the confusion between general security components (firewall, domain controller) and the specific three pillars of Duo Trusted Endpoints: MDM, policy, and certificate.

Practice this question →
28
MCQeasy

Which Duo feature allows an administrator to visualize the percentage of users who have successfully registered their mobile devices?

A.Duo Authentication Log
B.Duo Dashboard
C.Duo Policy Editor
D.Duo Trust Monitor
AnswerB

The Duo Dashboard presents enrolment and authentication statistics, including the proportion of users who have completed device registration. Its reporting widgets visualise that percentage, directly satisfying the stem's requirement to see how many users successfully registered their mobile devices.

Why this answer

The Duo Dashboard provides administrators with visualizations and summary metrics, including the percentage of users who have successfully registered their mobile devices (enrollment status). It aggregates enrollment, authentication, and device health data into widgets and reports. The Authentication Log, Policy Editor, and Trust Monitor serve different purposes and do not provide this enrollment percentage visualization.

Exam trap

SCAZT often tests the specific function of each Duo feature, and candidates confuse the Dashboard (visual metrics/enrollment) with the Authentication Log (event details) or Trust Monitor (anomaly detection).

How to eliminate wrong answers

Option A is wrong because the Duo Authentication Log is a detailed, event-level record of individual authentication attempts, not a dashboard visualization of enrollment percentages. Option C is wrong because the Duo Policy Editor is used to define and apply authentication policies (e.g., requiring MFA for certain apps), not to visualize enrollment statistics. Option D is wrong because Duo Trust Monitor is a security analytics feature that detects anomalous authentication behavior, not an enrollment reporting tool.

Practice this question →
29
Multi-Selectmedium

Which TWO pieces of information are required in the Duo Admin Panel to configure a new SAML application integration?

Select 2 answers
A.The Assertion Consumer Service (ACS) URL
B.The local RADIUS shared secret
C.The application's Entity ID
D.The server's public IP address
E.The user's Active Directory password
AnswersA, C

The Assertion Consumer Service URL is the endpoint in the service provider where Duo posts the SAML assertion after authentication. Duo requires it to direct the signed response correctly, satisfying the requirement for information needed to configure the SAML application integration.

Why this answer

Option A, the Assertion Consumer Service (ACS) URL, is required because it is the endpoint on the service provider where Duo (acting as the SAML Identity Provider) sends the signed SAML assertion after authentication, so Duo must know where to POST the response. Option C, the application's Entity ID, is required because it uniquely identifies the SAML service provider (the relying party) and is used as the Audience value in the assertion, ensuring the response is only accepted by the intended application. Option B is incorrect because a RADIUS shared secret is used for RADIUS-based integrations (such as Duo Authentication Proxy or network devices), not for SAML application configuration.

Option D is incorrect because Duo does not need the server's public IP address to set up a SAML trust; SAML relies on metadata (ACS URL, Entity ID, certificates) rather than IP addressing. Option E is incorrect because user credentials such as an Active Directory password are never entered into the Duo Admin Panel for SAML app configuration; authentication is delegated and passwords are not stored or required there.

Exam trap

SCAZT often tests SAML configuration requirements, so the trap is confusing SAML parameters (ACS URL, Entity ID) with RADIUS or other authentication protocol parameters like shared secrets or IP addresses.

Practice this question →
30
Multi-Selecthard

A security team is deploying Cisco Identity Services Engine (ISE) for a large enterprise. They want to implement a robust posture policy that checks endpoint compliance before granting network access. Which two components are required to perform posture assessment in ISE? (Choose two.)

Select 2 answers
A.Cisco Umbrella Roaming Client
B.Cisco AnyConnect Secure Mobility Client with ISE Posture module
C.Cisco Adaptive Network Control (ANC)
D.Cisco Identity Services Engine (ISE) with Posture policy configured
E.Cisco TrustSec Security Group Tags (SGTs)
AnswersB, D

The Cisco AnyConnect Secure Mobility Client with the ISE Posture module is required on the endpoint to perform posture checks. It collects information about the endpoint's compliance, such as antivirus status, OS patches, and running processes, and sends it to ISE. Without this agent, ISE cannot assess the endpoint's posture. Thus, this is a required component for posture assessment.

Why this answer

Posture assessment in Cisco ISE requires two main components: a posture agent on the endpoint, such as the Cisco AnyConnect Secure Mobility Client with the ISE Posture module, and ISE with posture policies configured. The agent collects endpoint compliance data and sends it to ISE, which evaluates it against the policies. Based on the results, ISE can grant, deny, or restrict access.

Other features like SGTs, Umbrella, or ANC are not required for the assessment itself, though they may be used in conjunction with posture for enforcement or remediation.

Exam trap

The trap here is confusing posture assessment with enforcement mechanisms like SGTs or ANC, but assessment only requires the agent and ISE policies.

Practice this question →
31
MCQmedium

A user is prompted for MFA but their phone is dead. Which administrative feature allows for a temporary bypass?

A.Issue a temporary bypass code in the Duo Admin Panel
B.Disable the user's account in Active Directory
C.Enable the 'Remembered Device' setting
D.Reset the user's password
AnswerA

A temporary bypass code, generated in the Duo Admin Panel, grants one-time or time-limited access without the enrolled device, directly satisfying the dead-phone constraint. It is tied to the specific user and expires automatically, preserving MFA enforcement elsewhere.

Why this answer

The Duo Admin Panel allows administrators to generate a temporary bypass code for a specific user, which the user can enter in place of the normal MFA push or passcode. This is the designed administrative mechanism for scenarios like a lost or dead phone, and the code can be set with an expiration and usage limit.

Exam trap

SCAZT often tests the difference between user-level bypass codes (per-user, temporary, admin-issued) and policy-level bypass (network-based, applies to many users) — candidates conflate the two.

How to eliminate wrong answers

Option B is wrong because disabling the account in Active Directory blocks all access rather than granting a temporary bypass — it's the opposite of what's needed. Option C is wrong because 'Remembered Device' only skips MFA on devices the user previously authenticated from; it does nothing when the user has no working second factor. Option D is wrong because resetting the password only changes the first factor and does not bypass the MFA requirement.

Practice this question →
32
MCQeasy

Which of the following is a requirement for using the Duo 'Remembered Devices' feature?

A.The user must be on the corporate network
B.The user must have a registered hardware token
C.The endpoint must be joined to a domain
D.The user's browser must accept cookies from the Duo domain
AnswerD

Remembered Devices relies on a cookie placed by Duo in the user's browser to record that the device already passed authentication. If the browser blocks or discards cookies from the Duo domain, the device cannot be recognised, so cookie acceptance is the prerequisite for the feature to function.

Why this answer

Duo's 'Remembered Devices' feature works by placing a cookie in the user's browser after they complete authentication and choose to remember the device. On subsequent logins, Duo reads that cookie to recognize the device and skip the second factor (within the configured expiration). Therefore the browser must accept cookies from the Duo domain for the feature to function.

Exam trap

SCAZT often tests the mechanics of Duo features, so the trap is assuming Remembered Devices depends on network location, hardware tokens, or domain membership rather than the browser cookie that actually stores the device memory.

How to eliminate wrong answers

Option A is wrong because Remembered Devices works from any network location — it is not restricted to the corporate network; that is the point of remembering a device. Option B is wrong because a hardware token is one possible second factor, not a requirement for the remembered-device cookie mechanism. Option C is wrong because domain join is irrelevant to Duo's cookie-based device recognition; it applies to unmanaged and personal devices too.

Practice this question →
33
MCQmedium

You are implementing Cisco Duo Device Health for a Windows fleet. Users report that they are blocked from accessing cloud apps despite having valid credentials. The Duo Health app reports a missing OS security patch. Which component is responsible for enforcing this posture check during the authentication flow?

A.Microsoft Conditional Access Policy
B.Duo Access Policy
C.Duo Authentication Proxy
D.Duo Device Health Application
AnswerB

The Duo Access Policy defines the device health posture requirements, including the OS patch check, and enforces them during authentication. It is the policy layer that evaluates the Health app's report and blocks access when the constraint is unmet.

Why this answer

The Duo Access Policy is the policy engine in the Duo Admin Panel that evaluates device health signals (including missing OS patches) and enforces allow/deny decisions during authentication. When the Device Health app reports a missing patch, the Access Policy is what blocks access based on that posture attribute.

Exam trap

SCAZT often tests the sensor-versus-enforcer distinction: candidates see 'Device Health app reports missing patch' and pick the Device Health Application, missing that the Access Policy is what actually blocks access based on that report.

How to eliminate wrong answers

Option A is wrong because Microsoft Conditional Access is a Microsoft-side policy engine that can consume Duo signals but is not the Duo component enforcing the posture check in the Duo authentication flow. Option C is wrong because the Duo Authentication Proxy is an on-premises component that proxies authentication requests to Duo for protocols like RADIUS/LDAP; it does not evaluate device health policy. Option D is wrong because the Device Health Application collects and reports posture data — it is the sensor, not the enforcement point.

Practice this question →
34
MCQmedium

Which Duo log would be most useful for troubleshooting a failure during the initial push notification delivery?

A.Directory Sync Log
B.Telephony Log
C.Administrative Actions Log
D.Authentication Log
AnswerD

The Authentication Log records each authentication attempt, including the push notification sent to the user's device and its outcome. A failure during initial push delivery appears here, showing whether Duo reached the device, making it the right log for diagnosing that specific stage.

Why this answer

The Duo Authentication Log records the full authentication attempt lifecycle, including the initial push notification being sent to the user's device, the user's response (approve/deny/timeout), and the final authentication result. When troubleshooting a failure during initial push delivery, this log shows whether the push was dispatched, whether the device was reachable, and any error codes returned by Duo's push service. This makes it the primary log for diagnosing push-delivery failures.

Exam trap

SCAZT often tests whether candidates confuse the Authentication Log with the Telephony Log, incorrectly assuming phone-based logs cover push notifications when Telephony only covers call/SMS methods.

How to eliminate wrong answers

Option A is wrong because the Directory Sync Log pertains to user and group synchronization from Active Directory or LDAP into Duo, not to authentication push delivery. Option B is wrong because the Telephony Log covers phone call and SMS-based authentication events (Duo Phone callback and SMS passcodes), not smartphone push notifications. Option C is wrong because the Administrative Actions Log records changes made by Duo administrators (policy edits, user changes), not end-user authentication events.

Practice this question →
35
Multi-Selecthard

Which THREE factors influence the user experience when using Duo Passwordless?

Select 3 answers
A.The browser or platform's support for WebAuthn
B.The presence of a platform authenticator (e.g., Windows Hello)
C.The user's active directory password strength
D.The Duo Policy settings for the application
E.The user's network speed
AnswersA, B, D

Duo Passwordless uses WebAuthn to bind credentials to authenticators, so the browser or platform must support that standard. Without WebAuthn support, passwordless authentication cannot complete, making it a direct determinant of whether users can authenticate and how smoothly the experience works.

Why this answer

Duo Passwordless relies on WebAuthn/FIDO2 to authenticate users, so option A is correct because the browser or platform must support the WebAuthn API (e.g., Chrome, Edge, Safari, Firefox) for the passwordless flow to work at all. Option B is correct because a platform authenticator such as Windows Hello, Touch ID, or Android biometrics is what actually verifies the user locally and produces the WebAuthn assertion, directly shaping whether the experience is smooth or unavailable. Option D is correct because Duo Policy settings for the application determine which authentication methods are permitted and how the passwordless prompt behaves, so they directly affect what the user sees and can do.

Option C is not relevant because passwordless authentication does not use the Active Directory password, and option E is not relevant because network speed affects general latency but is not a defining factor in the Duo Passwordless user experience.

Exam trap

SCAZT often tests whether candidates confuse passwordless authentication with traditional MFA — the trap is selecting 'Active Directory password strength' as a factor when passwordless removes the password entirely.

Practice this question →
36
MCQmedium

What is the primary function of the Duo 'Telephony Credits'?

A.To unlock premium reporting features
B.To provide hardware tokens to employees
C.To cover the costs of SMS and voice call authentication
D.To pay for the monthly Duo license fee
AnswerC

Telephony Credits are consumed when Duo sends SMS passcodes or places voice call authentications, covering the carrier charges for those out-of-band methods. This satisfies the requirement to fund per-message telephony usage rather than licensing or directory services.

Why this answer

Duo Telephony Credits are a prepaid balance used to pay for out-of-band authentication methods that incur per-use carrier charges — specifically SMS passcodes and voice call callbacks. When a user authenticates via SMS or phone call, Duo deducts credits from the account's balance to cover the telecom cost. This is why Duo recommends migrating users to the Duo Mobile app (push notifications or TOTP), which consumes no telephony credits because it uses data/IP instead of the PSTN.

Exam trap

SCAZT often tests the misconception that Duo credits are a general-purpose billing currency for licenses or premium features, when in fact they are narrowly scoped to per-use SMS and voice call authentication costs.

How to eliminate wrong answers

Option A is wrong because reporting and administrative features in the Duo Admin Panel are included with the subscription tier (Essentials, Advantage, Premier) and are not gated behind a credit system — credits are strictly a telecom cost mechanism. Option B is wrong because hardware tokens (Duo D100, D101, HOTP tokens) are physical devices purchased separately as SKUs or bundled in specific editions; they are not funded from a telephony credit pool. Option D is wrong because the monthly Duo license fee is billed through the Duo subscription/invoice (per-user, per-edition pricing) and is completely separate from the telephony credit balance, which is a consumption-based add-on.

Practice this question →
37
MCQhard

A financial institution uses Duo to protect access to a critical trading platform. Security policy requires that users authenticate with a hardware token that generates one-time codes, and that the token be bound to the user's identity in Duo. Which Duo factor type should be configured to meet this requirement?

A.Duo Mobile passcode
B.Duo Push
C.Hardware token
D.SMS passcode
AnswerC

Duo supports hardware tokens that generate OTPs, such as those from third-party vendors. These tokens can be assigned to users in Duo, binding the token to the user's identity. When the user authenticates, they enter the OTP from the hardware token, meeting the requirement for a hardware-based factor that is bound to the user.

Why this answer

The requirement is for a hardware token that generates one-time codes and is bound to the user in Duo. Duo supports hardware tokens as a factor type, allowing administrators to assign a physical token to a user. The other options are software-based or rely on mobile devices, and do not provide a dedicated hardware token, so they do not meet the security policy.

Exam trap

The trap here is confusing Duo Mobile passcode with a hardware token; Duo Mobile passcode is software-based, while a hardware token is a separate physical device.

Practice this question →
38
MCQhard

A administrator wants to implement 'Strict' device health checks. What happens if a device reports an unknown OS version?

A.The user is redirected to a temporary guest portal
B.The user is prompted to upgrade the OS manually
C.The user is granted read-only access
D.The access attempt is blocked by the policy
AnswerD

Strict device health checks in Microsoft Entra ID conditional access treat an unrecognised OS version as non-compliant, so the policy evaluates the device as failing the health requirement and denies the sign-in attempt outright. This satisfies the stem's demand for strict enforcement, where unknown values cannot be granted access.

Why this answer

In Duo's device health/trusted endpoint policies, the 'Strict' enforcement mode means any device that fails to meet the defined health criteria — including an unrecognized or unknown OS version — is denied access entirely. Because Duo cannot evaluate the posture of an OS it does not recognize, the safe default under Strict is to block the connection rather than downgrade or redirect. This is the defining behavior that separates Strict from permissive or report-only modes.

Exam trap

The trap here is confusing Duo's device-health enforcement with NAC-style remediation flows (guest portals, read-only/quarantine VLANs) that belong to Cisco ISE, causing candidates to pick a redirect or limited-access answer instead of the simple block.

How to eliminate wrong answers

Option A is wrong because a guest portal redirect is a network-access-control (NAC) style remediation used by products like Cisco ISE, not the behavior of Duo's Strict device health policy. Option B is wrong because Duo does not prompt users to manually upgrade their OS — it only evaluates posture and enforces the configured allow/deny outcome. Option C is wrong because read-only access is not a Duo device-health enforcement state; Duo either permits or denies the authentication/access attempt.

Practice this question →
39
Multi-Selectmedium

Which TWO methods can be used to bypass Duo authentication in an emergency?

Select 2 answers
A.Rename the user's AD account
B.Reset the user's password to '12345'
C.Add the user to a group that has a 'Bypass' policy applied
D.Set the global MFA mode to 'Bypass' for all users
E.Issue a temporary bypass code to the user
AnswersC, E

Assigning the user to a group bound to a Duo bypass policy satisfies the emergency access requirement, because Duo evaluates group membership at authentication time and skips the second factor for that group. This grants temporary, auditable relief without disabling Duo tenant-wide or altering the user's Microsoft Entra ID credentials.

Why this answer

Option C is correct because Duo policies can be applied to groups, and a group assigned a policy with the "Bypass" setting allows its members to authenticate without completing Duo's second factor. Option E is correct because Duo administrators can generate a temporary bypass code for a specific user, which the user enters in place of the Duo passcode to skip the normal authentication flow for a limited time. Option A is incorrect because renaming an AD account does not affect Duo's authentication enforcement and would not bypass the second factor.

Option B is incorrect because resetting the password to '12345' only changes the primary credential and does not disable or bypass Duo MFA. Option D is incorrect because setting the global MFA mode to 'Bypass' for all users is not a supported Duo emergency bypass method and would disable MFA organization-wide rather than for a single user.

Exam trap

The trap is treating 'disable MFA globally' as an acceptable emergency bypass, when Duo's sanctioned methods are scoped group bypass policies and per-user temporary bypass codes — global bypass is a red flag answer.

Practice this question →
40
MCQmedium

A user is traveling and needs to access a cloud application. The user has no cellular service but has Wi-Fi. Which authentication method is best suited for this scenario?

A.Duo Mobile generated passcode (TOTP)
B.Duo Push
C.SMS Passcode
D.Duo Phone Callback
AnswerA

Duo Mobile generates time-based one-time passcodes locally on the device, so no push notification, SMS or cellular connectivity is required. With only Wi-Fi available, the user reads the current TOTP and enters it, satisfying the stem's constraint of authenticating without cellular service.

Why this answer

Duo Mobile generated passcode (TOTP) works offline because the passcode is generated locally by the Duo Mobile app using a shared secret and the current time, without requiring network connectivity. When the user has Wi-Fi but no cellular service, they can open Duo Mobile to generate a passcode and enter it into the login prompt, completing authentication.

Exam trap

SCAZT often tests the assumption that Duo Push or SMS always works, ignoring offline scenarios where only TOTP passcodes are viable.

How to eliminate wrong answers

Option B is wrong because Duo Push requires the Duo Mobile app to receive a push notification over an internet connection; while Wi-Fi could provide that, the scenario emphasizes no cellular service, and push may be unreliable if the Wi-Fi is captive or restricted. More importantly, Duo Push requires the device to be online at the moment of authentication, whereas TOTP works offline. Option C is wrong because SMS passcodes require cellular service to receive the text message; with no cellular service, the user cannot receive the SMS.

Option D is wrong because Duo Phone Callback requires the user to receive a phone call, which also needs cellular voice service.

Practice this question →

Ready to test yourself?

Try a timed practice session using only User And Device Security questions.

Start 20-question session
CCNA User And Device Security Questions | Courseiva