SCAZT Network And Cloud Security Practice Question
You are troubleshooting a scenario where users are unable to access a specific internal cloud resource after migrating to Cisco Secure Access. The traffic is being blocked by a default policy. How should you modify the traffic flow to ensure internal traffic stays off the SIG?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Tunnel Exclusion in the Secure Access tunnel settings for the internal IP ranges.
Configuring a PAC file or using Tunnel Exclusions ensures that traffic destined for internal ranges bypasses the SIG tunnel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure a Tunnel Exclusion in the Secure Access tunnel settings for the internal IP ranges.
Why this is correct
Tunnel exclusions allow specific traffic to bypass the SIG, ensuring internal resources remain reachable.
- ✗
Disable the 'Inspect Traffic' setting globally in the Secure Access dashboard.
Why it's wrong here
This would weaken security for all traffic, not just internal traffic.
- ✗
Update the DNS policy to include internal domain suffixes as exceptions.
Why it's wrong here
DNS exceptions do not resolve the issue of proxied traffic being sent to the SIG.
- ✗
Assign the users to a separate Group Policy that has no web filtering enabled.
Why it's wrong here
This does not prevent traffic from being backhauled to the SIG.
About these practice questions
One of 316 original SCAZT practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Cisco exam blueprint
This SCAZT practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCAZT exam.