I85PREP
⌘ K
Cisco SCAZT 300-740 study materials
Cisco SCAZT 300-740 study resources

Cisco SCAZT 300-740 practice questions

One question at a time. Build your Cisco SCAZT 300-740 understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cisco secure-access and zero-trust policy foundations

Which document defines the seven tenets of Zero Trust Architecture and is widely cited as the foundational standard for ZTA design across U.S. federal and enterprise environments?

  1. NIST SP 800-53
  2. NIST SP 800-207 Correct answer.
  3. ISO/IEC 27001
  4. PCI DSS v4.0

Explanation

NIST Special Publication 800-207, 'Zero Trust Architecture' (Aug 2020), defines the seven tenets of ZTA: every resource is treated as a resource, all communication is secured regardless of network location, access is granted per session, access is determined by dynamic policy, the enterprise monitors integrity and security posture, all authentication and authorization is dynamic and strictly enforced, and the enterprise collects telemetry to improve security posture. NIST 800-53 is a control catalog, ISO 27001 is an ISMS framework, and PCI DSS targets cardholder data environments - none defines the ZTA tenets.

Question 2Cisco secure-access and zero-trust policy foundations

CISA's Zero Trust Maturity Model v2.0 organizes capabilities into five pillars supported by three cross-cutting capabilities. Which option lists the five pillars correctly?

  1. Identity, Devices, Networks, Applications and Workloads, Data Correct answer.
  2. Identity, Endpoints, Perimeter, Cloud, Operations
  3. Users, Devices, SASE, SOC, Compliance
  4. Identity, Edge, Fabric, Segmentation, Telemetry

Explanation

CISA Zero Trust Maturity Model v2.0 (April 2023) defines five pillars - Identity, Devices, Networks, Applications and Workloads, and Data - supported by three cross-cutting capabilities: Visibility and Analytics, Automation and Orchestration, and Governance. Each pillar is scored across four maturity stages: Traditional, Initial, Advanced, and Optimal. The other choices mix marketing terms with non-CISA pillar names.

Question 3Cisco secure-access and zero-trust policy foundations

Which of the following is the BEST example of the 'never trust, always verify' principle in a Zero Trust deployment?

  1. A user behind the corporate perimeter firewall is trusted to reach any internal resource.
  2. Each access request is evaluated against identity, device posture, and context every time, regardless of the user's network location. Correct answer.
  3. VPN access is granted for 30 days after one successful MFA prompt.
  4. All TLS sessions are terminated at the edge and re-encrypted to the backend.

Explanation

'Never trust, always verify' means each access decision is made per-session against current identity, device posture, application sensitivity, and contextual signals - independent of network location. Implicit trust granted by perimeter, long-lived sessions, or session re-encryption alone are NOT zero-trust controls; they are perimeter-based or transport-layer controls.

Question 4Cisco secure-access and zero-trust policy foundations

Among the standard IaaS, PaaS and SaaS models, with no extra managed services assumed, which typically leaves the customer responsible for the most of the application/guest-OS configuration stack?

  1. SaaS
  2. PaaS
  3. IaaS Correct answer.
  4. FaaS managed runtime

Explanation

Across the cloud consumption stack, IaaS gives the customer the most control - and therefore the most responsibility - because the customer manages the guest OS, middleware, runtime, applications, and data. PaaS abstracts the OS and runtime; SaaS abstracts everything except identity and data classification. FaaS (serverless) further reduces customer responsibility by managing the runtime as well.

Question 5Cloud, AI and specialized-environment security

Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility when consuming Amazon EC2?

  1. Patching the underlying hypervisor
  2. Physical security of the AWS data center
  3. Guest OS patching, application code, and security group configuration Correct answer.
  4. Replacing failed hardware in the host server

Explanation

In AWS's Shared Responsibility Model, AWS is responsible for security 'of' the cloud - physical facilities, hypervisor, hardware, and the global network. The customer is responsible for security 'in' the cloud, which for IaaS such as EC2 includes guest OS patching and hardening, application code, IAM configuration, encryption choices, and security group / NACL configuration. Hypervisor patching, physical security, and hardware replacement are always AWS responsibilities.

Question 6Cloud, AI and specialized-environment security

A security architect needs to map adversary techniques against cloud identity providers and SaaS environments. Which framework explicitly catalogs cloud-specific tactics, techniques, and procedures organized into a 'Cloud' matrix?

  1. NIST CSF 2.0
  2. MITRE ATT&CK Correct answer.
  3. ISO 27017
  4. OWASP Cloud Top 10

Explanation

MITRE ATT&CK maintains a dedicated 'Cloud' matrix covering AWS, Azure, GCP, Office 365, Google Workspace, SaaS, and IaaS sub-platforms. It catalogs adversary tactics (Initial Access, Persistence, Defense Evasion, etc.) and specific techniques such as 'Valid Accounts: Cloud Accounts' (T1078.004) and 'Modify Cloud Compute Infrastructure' (T1578). NIST CSF and ISO 27017 are control/governance frameworks; OWASP Cloud Top 10 is risk-oriented but not technique-mapped at MITRE's granularity.

Question 7Cloud, AI and specialized-environment security

Which AWS construct is the closest functional equivalent to an Azure Network Security Group (NSG) for stateful instance-level traffic filtering?

  1. AWS Route Table
  2. AWS Security Group Correct answer.
  3. AWS Network ACL
  4. AWS Transit Gateway

Explanation

An AWS Security Group is a stateful, instance-level virtual firewall that filters traffic to and from ENIs - directly analogous to an Azure NSG attached to a NIC or subnet. AWS Network ACLs are stateless subnet-level filters (closer to an extended ACL). Route tables direct traffic but do not filter it; Transit Gateway is a regional hub for inter-VPC and on-prem connectivity.

Question 8Cloud, AI and specialized-environment security

Which statement BEST describes how eBPF-based runtime security tools such as Cilium and Tetragon enforce policy on containerized workloads?

  1. They install a kernel module that intercepts every system call before delivery to the container runtime.
  2. They attach sandboxed bytecode programs to kernel hooks so syscall, network, and process events can be observed and enforced without changing kernel source or installing a module. Correct answer.
  3. They proxy all container traffic through a userspace agent for inspection.
  4. They rely on a hypervisor introspection API to read container memory.

Explanation

eBPF (extended Berkeley Packet Filter) lets administrators load verified, sandboxed bytecode into the Linux kernel and attach it to hooks such as kprobes, tracepoints, XDP, and LSM. Cilium uses eBPF for in-kernel network policy and observability; Tetragon attaches eBPF programs to security-relevant events for runtime enforcement and audit. No kernel module compilation, sidecar proxying, or hypervisor introspection is required.

Question 9Cloud, AI and specialized-environment security

A cloud security engineer is selecting a posture and compliance approach for a multi-account AWS organization. Which native or near-native combination BEST provides continuous configuration assessment and CIS benchmark scoring?

  1. AWS CloudTrail alone
  2. AWS Config + Security Hub with CIS AWS Foundations standard enabled Correct answer.
  3. Amazon GuardDuty alone
  4. AWS WAF rules in count mode

Explanation

AWS Config records resource configuration over time and evaluates rules against desired state; AWS Security Hub aggregates findings and supports the CIS AWS Foundations Benchmark, NIST 800-53, and PCI DSS standards. Together they provide continuous posture and compliance scoring. CloudTrail logs API activity but does not assess posture; GuardDuty focuses on threat detection; AWS WAF protects web applications and is not a posture tool.

Question 10Identity, access and cryptographic protection

Which Cisco product provides the multi-factor authentication, device trust, and risk-based access decisions called out in the SCAZT identity domain?

  1. Cisco Umbrella
  2. Cisco Duo Correct answer.
  3. Cisco ISE
  4. Cisco Secure Endpoint

Explanation

Cisco Duo is Cisco's identity security platform: it delivers multi-factor authentication, single sign-on, passwordless, Trusted Endpoints (device trust), and Risk-Based Authentication that adjusts MFA requirements based on contextual signals. Umbrella is a SIG/DNS layer, ISE focuses on on-prem network access control, and Secure Endpoint is an EDR product.

Question 11Identity, access and cryptographic protection

Which Duo authentication factor is considered phishing-resistant and aligned with NIST SP 800-63B AAL3 cryptographic authenticator requirements?

  1. Duo Push notification
  2. Duo SMS passcodes
  3. Duo Verified Push (number matching)
  4. Duo with WebAuthn / FIDO2 security keys Correct answer.

Explanation

WebAuthn / FIDO2 security keys (including platform authenticators like Windows Hello and Touch ID) are phishing-resistant because the credential is bound to the relying-party origin and a private key never leaves the authenticator. SMS is explicitly discouraged by NIST 800-63B; standard Duo Push and Verified Push add usability and friction respectively but remain phishable to AiTM under sophisticated attacks. WebAuthn satisfies AAL3 cryptographic authenticator requirements when paired with a hardware authenticator.

Question 12Identity, access and cryptographic protection

An administrator wants to ensure that only corporate-managed laptops can complete a Duo MFA flow for a SaaS application. Which Duo capability enforces this?

  1. Duo Network Gateway
  2. Duo Trusted Endpoints Correct answer.
  3. Duo Single Sign-On
  4. Duo Mobile

Explanation

Duo Trusted Endpoints distinguishes managed (trusted) devices from unmanaged ones using device certificates issued by an MDM, Active Directory domain trust, or Jamf Pro for macOS. A policy can then block or step up authentication for unmanaged endpoints. Duo SSO and Duo Mobile do not assess device management state; Duo Network Gateway is a clientless gateway for on-prem web/SSH apps.

Question 13Identity, access and cryptographic protection

When integrating Cisco Duo with Microsoft Entra ID (Azure AD) so that Duo provides MFA for federated apps, which protocol commonly carries the SAML assertion from Duo back to the relying-party application?

  1. RADIUS
  2. LDAP
  3. SAML 2.0 Correct answer.
  4. OAuth 1.0

Explanation

Duo SSO acts as a SAML 2.0 Identity Provider for relying-party applications: after primary authentication and Duo MFA, Duo issues a SAML 2.0 assertion to the application via HTTP-POST or HTTP-Redirect binding. RADIUS and LDAP are used by Duo's network device integrations, not for federated SaaS SSO. OAuth 1.0 is obsolete and not used here; modern API delegation uses OAuth 2.0 / OIDC.

Question 14Identity, access and cryptographic protection

Which protocol does Cisco Duo SSO use to automatically provision and deprovision user accounts in downstream SaaS applications based on changes in the upstream identity provider?

  1. LDAP
  2. SCIM 2.0 Correct answer.
  3. RADIUS CoA
  4. TACACS+

Explanation

SCIM 2.0 (System for Cross-domain Identity Management) is the open standard for automated user provisioning and deprovisioning. Duo SSO supports SCIM as both a source (to receive directory changes) and a target (to push lifecycle events to downstream apps). LDAP is a directory protocol but not a lifecycle automation standard; RADIUS CoA changes session state, not user lifecycle; TACACS+ is for device admin AAA.

Question 15Identity, access and cryptographic protection

A user logs in from an unfamiliar country and an unmanaged device. Duo Risk-Based Authentication evaluates the signals and determines high risk. Which Duo behavior is MOST consistent with a risk-based policy?

  1. Bypass MFA because the user is already authenticated to the IdP.
  2. Step up to a phishing-resistant factor (such as Verified Push or WebAuthn) and deny weaker factors. Correct answer.
  3. Send an SMS passcode and accept it.
  4. Auto-approve the session for 30 days.

Explanation

Duo Risk-Based Authentication uses signals like network reputation, location, device, and known attack patterns to dynamically adjust factor requirements. On elevated risk it steps up to phishing-resistant methods (Verified Push with number matching or WebAuthn) and can deny weaker factors. Bypassing MFA, accepting SMS, or auto-approving long-lived sessions all weaken security under elevated risk.

Question 16Identity, access and cryptographic protection

Which authentication mechanism is BEST suited to silently authenticate a corporate-issued laptop to Cisco Secure Access without user interaction?

  1. LDAP bind
  2. Username and password
  3. Client X.509 certificate issued by the corporate PKI Correct answer.
  4. Pre-shared key

Explanation

A client X.509 certificate issued by the corporate PKI (and provisioned via an MDM such as Intune or Jamf) lets the device prove its identity to Secure Access cryptographically and silently - no user prompt is needed. LDAP and password authentication require user input; PSKs do not bind to a unique device identity and are difficult to rotate. Certificate-based device authentication is also a NIST 800-207 recommended pattern.

Question 17Identity, access and cryptographic protection

An organization wants to perform endpoint posture checks (disk encryption, OS version, EDR running) BEFORE allowing access to a private application via Cisco Secure Access. Which capability addresses this requirement?

  1. Cisco Secure Access posture profile evaluated by the Cisco Secure Client posture module Correct answer.
  2. Umbrella DNS policy
  3. AWS GuardDuty findings
  4. Splunk universal forwarder telemetry

Explanation

Cisco Secure Access integrates endpoint posture evaluation through the Cisco Secure Client (formerly AnyConnect) posture module. Posture profiles can require disk encryption, minimum OS version, antivirus or EDR running, and certificate presence before granting access. Umbrella DNS, GuardDuty, and Splunk forwarders are not posture-enforcement points for application access.

Question 18Identity, access and cryptographic protection

Which statement about Cisco Duo's 'Verified Push' (number-matching) feature is correct?

  1. It is identical to standard Duo Push but with a louder ringtone.
  2. It mitigates MFA fatigue / push-bombing by requiring the user to type a number shown on the login screen into the Duo Mobile app. Correct answer.
  3. It removes the need for the user to authenticate at all.
  4. It uses SMS as a backup channel when the phone is offline.

Explanation

Verified Push displays a code on the login page that the user must enter into Duo Mobile to approve the request. This breaks the 'push-bombing' / MFA fatigue attack pattern in which an attacker triggers repeated pushes hoping a user accidentally accepts. Standard Push has no number match; SMS fallback and ringtone changes do not address fatigue attacks.

Question 19Identity, access and cryptographic protection

An administrator must integrate Okta as the upstream IdP for Cisco Secure Access. Which protocol is used between Okta and Secure Access for user authentication assertions?

  1. RADIUS
  2. SAML 2.0 Correct answer.
  3. TACACS+
  4. Kerberos

Explanation

Cisco Secure Access supports SAML 2.0 federation with upstream IdPs including Okta, Microsoft Entra ID, PingFederate, and Duo SSO. The IdP issues a SAML assertion to Secure Access after primary authentication. RADIUS is used for network authentication scenarios such as Secure Access VPN-as-a-Service with ISE; TACACS+ targets device administration; Kerberos is used inside Active Directory environments.

Question 20Identity, access and cryptographic protection

What is the role of an Identity Provider (IdP) in a SAML SSO flow with Cisco Secure Access acting as the Service Provider (SP)?

  1. The IdP authenticates the user and issues a signed SAML assertion that the SP consumes to establish a session. Correct answer.
  2. The IdP encrypts user passwords and forwards them to the SP.
  3. The IdP terminates the user's TLS connection.
  4. The IdP hosts the application data.

Explanation

In SAML SSO the Identity Provider authenticates the user, then issues a signed (and optionally encrypted) SAML assertion containing identity attributes. The Service Provider validates the assertion's signature against the IdP's metadata-published certificate and creates a local session. Passwords never leave the IdP; the IdP does not terminate TLS for the SP nor host application data.

Question 21Identity, access and cryptographic protection

Which Duo policy setting BEST limits authentication to specific countries to comply with a 'no access from sanctioned countries' requirement?

  1. Duo Authorized Networks
  2. Duo Trusted Endpoints
  3. Duo Anonymous Networks
  4. Duo Authentication Policy with Country-based Access Correct answer.

Explanation

Duo's Authentication Policy supports country-based access rules - allow, require additional factor, or deny - based on the source IP geolocation. Anonymous Networks policy specifically blocks Tor and known anonymizing proxies. Authorized Networks lets you bypass MFA from trusted CIDR ranges. Trusted Endpoints is a device-trust feature, not a geographic control.

Question 22Identity, access and cryptographic protection

Which statement about JIT (Just-In-Time) SAML provisioning is true?

  1. JIT provisioning creates or updates the user account in the SP at the moment of SAML login, using attributes from the SAML assertion. Correct answer.
  2. JIT provisioning batches user creates overnight via SCIM.
  3. JIT provisioning bypasses the IdP and reads from LDAP directly.
  4. JIT provisioning issues hardware tokens automatically.

Explanation

Just-In-Time (JIT) provisioning creates or updates a user record in the Service Provider at the moment of first successful SAML login, using identity attributes (email, group memberships) from the assertion. SCIM is a separate, schedule- or event-driven lifecycle protocol - distinct from JIT but often used together. JIT does not bypass the IdP or issue tokens.

Question 23Identity, access and cryptographic protection

Which Cisco Secure Client module enables Cisco Umbrella DNS-layer protection on a roaming endpoint?

  1. Umbrella Roaming Security module Correct answer.
  2. AMP Enabler module
  3. Network Visibility Module (NVM)
  4. ISE Posture module

Explanation

The Umbrella Roaming Security module within Cisco Secure Client (formerly AnyConnect) intercepts DNS on the endpoint and forwards queries to Umbrella resolvers, enforcing DNS-layer policy when the user is off-network. AMP Enabler deploys Cisco Secure Endpoint, NVM exports flow telemetry to a collector, and ISE Posture performs posture for ISE-based NAC.

Question 24Identity, access and cryptographic protection

Which is the MOST appropriate use of Duo Passwordless authentication?

  1. Replace the username field entirely.
  2. Authenticate users with a phishing-resistant factor (FIDO2 security key, platform authenticator, or Duo Mobile WebAuthn) without entering a password. Correct answer.
  3. Disable MFA entirely for executives.
  4. Use SMS as the only factor.

Explanation

Duo Passwordless lets users authenticate to applications using FIDO2/WebAuthn - a roaming security key, a platform authenticator (Windows Hello, Touch ID), or Duo Mobile's WebAuthn flow - without typing a password. The password is removed from the flow, eliminating phishing of the password and enabling stronger AAL2/AAL3 assurance. Username is still required to identify the account.

Question 25Identity, access and cryptographic protection

A SAML SP receives a SAML response. Which item MUST it validate to safely accept the assertion?

  1. The XML signature against the IdP's published signing certificate, the audience restriction, the NotBefore/NotOnOrAfter conditions, and the destination. Correct answer.
  2. Only that the assertion contains the user's email address.
  3. Only that the request originated from inside the corporate network.
  4. Only that the signature algorithm is set to 'none'.

Explanation

A SAML SP MUST validate the XML signature using the IdP's published signing certificate, enforce the audience restriction (the assertion is intended for this SP), validate the NotBefore / NotOnOrAfter time conditions, and verify the destination URL matches its ACS endpoint. Skipping any of these enables well-known attacks such as XML signature wrapping or assertion replay. 'alg: none' is a JWT concept and is not valid for SAML XML signatures.

Question 26Identity, access and cryptographic protection

An administrator wants Duo to evaluate device health from CrowdStrike, SentinelOne, or Microsoft Defender before granting access. Which Duo feature provides this integration via a vendor-supplied agent or API?

  1. Duo Device Health Application / Trusted Endpoints integrations Correct answer.
  2. Duo SMS
  3. Duo LDAP Sync
  4. Duo Network Gateway

Explanation

Duo Device Health Application reports OS, disk encryption, password protection, firewall status, and EDR presence; Trusted Endpoints integrates with management or EDR systems (Intune, Jamf, CrowdStrike, SentinelOne, Microsoft Defender for Endpoint) to confirm a device is enrolled and healthy. Together these enable health-based access policies. SMS, LDAP Sync, and Duo Network Gateway do not assess device health.

Question 27Identity, access and cryptographic protection

When configuring SCIM provisioning from an IdP into a SaaS app, which event would typically trigger a deprovisioning (delete or disable) action?

  1. A user is removed from the assigned application group in the IdP or marked inactive in the source HR system. Correct answer.
  2. The user changes their wallpaper.
  3. The user logs in from a new browser.
  4. The user resets their phone PIN.

Explanation

SCIM lifecycle events fire when the upstream IdP detects an authoritative change - typically removal from the application's assignment group, deletion from the directory, or a status flip from the HR system of record. The SCIM connector translates this into a PATCH or DELETE call against the downstream app to disable or remove the account. Cosmetic events on the endpoint do not trigger SCIM lifecycle events.

Question 28Identity, access and cryptographic protection

Which statement about the difference between authentication and authorization is correct in a Zero Trust context?

  1. Authentication confirms identity; authorization grants access to a specific resource based on dynamic policy. Correct answer.
  2. Authentication and authorization are the same step.
  3. Authorization happens once per device and never re-evaluates.
  4. Authentication grants access; authorization just logs it.

Explanation

Authentication establishes WHO the user (or device) is. Authorization decides WHAT that authenticated subject can access - and in zero trust this decision is made per resource, per session, against a dynamic policy that incorporates posture, risk, sensitivity, and context. Treating them as one step or making authorization static defeats the zero-trust model.

Question 29Identity, access and cryptographic protection

An IdP sends a SAML assertion containing a 'memberOf' attribute. The SP is Cisco Secure Access, and you want to write an access rule that only permits users in 'cn=engineers'. Which Secure Access object should map to the SAML attribute?

  1. IP-based group
  2. SAML attribute mapping into a Secure Access user group / identity attribute Correct answer.
  3. RADIUS shared secret
  4. Local user database

Explanation

Cisco Secure Access supports mapping SAML attributes (such as memberOf, groups, or custom attributes) into identity attributes / user groups that policy rules can reference. After the attribute mapping is in place, a rule can permit only the 'engineers' group. Using IP-based groups, RADIUS secrets, or the local user DB instead would fail to leverage the IdP's authoritative group membership.

Question 30Cisco secure-access and zero-trust policy foundations

Which protocol is the de-facto standard for encrypting data IN TRANSIT between a user's browser and a SaaS application?

  1. IPsec ESP
  2. TLS 1.3 Correct answer.
  3. GRE
  4. MPLS

Explanation

TLS 1.3 (and earlier 1.2 where 1.3 is unavailable) is the standard for browser-to-server encryption. IPsec ESP secures IP-layer traffic typically between gateways; GRE is unencrypted tunneling; MPLS is a label-switching transport with no native encryption. For end-to-end browser-to-app confidentiality, TLS 1.3 with AEAD ciphers and forward secrecy is the modern choice.

Question 31Cisco secure-access and zero-trust policy foundations

An organization needs encryption for data AT REST in an Amazon S3 bucket so that even AWS-side compromise of the storage layer cannot read data. Which option BEST meets the requirement?

  1. S3 default encryption with SSE-S3 (AES-256) only
  2. S3 with SSE-KMS using a customer-managed key, plus bucket key, with key access restricted by IAM Correct answer.
  3. S3 with no encryption but private ACLs
  4. Client-side encryption disabled, server logs only

Explanation

SSE-KMS with a customer-managed CMK provides envelope encryption with keys managed in AWS KMS, where access can be restricted per-IAM-principal and audited via CloudTrail. Adding a bucket key reduces KMS request cost without weakening protection. SSE-S3 uses AWS-managed keys with less granular control. For maximum independence from AWS, client-side encryption with a customer-controlled KMS is even stronger, but SSE-KMS with CMK is the most common SCAZT-aligned answer.

Question 32Cisco secure-access and zero-trust policy foundations

Which Cisco Secure Access capability inspects file uploads and downloads for sensitive content patterns (PII, PCI, source code) and can block matching transfers?

  1. DNS Security
  2. Data Loss Prevention (DLP) Correct answer.
  3. Cloud-Delivered Firewall (CDFW)
  4. Remote Browser Isolation (RBI)

Explanation

Data Loss Prevention (DLP) inside Cisco Secure Access inspects HTTP/HTTPS request bodies and file content for sensitive data patterns - built-in classifiers (PII, PCI, PHI), custom regex, dictionary matches, and Exact Data Match (EDM) - and enforces block, allow, or alert actions. DNS Security blocks malicious domains; CDFW does L3/L4/L7 firewalling; RBI isolates risky web sessions in a remote container.

Question 33Cisco secure-access and zero-trust policy foundations

Which DLP detection technique creates cryptographic fingerprints of structured data (such as a customer database table) so that exact field-level matches can be detected in transit?

  1. Pattern matching with regex only
  2. Dictionary matching
  3. Exact Data Match (EDM) Correct answer.
  4. Optical character recognition (OCR)

Explanation

Exact Data Match (EDM) ingests a structured dataset (e.g., an SSN+name+DOB table), creates one-way cryptographic fingerprints of each row, and matches those fingerprints against monitored traffic. This is the most precise DLP technique, with very low false positives versus regex/dictionary methods. OCR is used for text in images, not structured data fingerprinting.

Question 34Cisco secure-access and zero-trust policy foundations

Which Cisco product provides agent-based application segmentation (microsegmentation), application dependency mapping, and policy enforcement on workloads running in on-prem data centers and public cloud?

  1. Cisco Secure Workload (formerly Tetration) Correct answer.
  2. Cisco Umbrella
  3. Cisco DNA Center
  4. Cisco Meraki Systems Manager

Explanation

Cisco Secure Workload (formerly Tetration) deploys software agents on Linux, Windows, and AIX workloads to collect flow telemetry, automatically map application dependencies, and enforce microsegmentation policy via host firewall rules. It also supports vulnerability assessment and policy validation. Umbrella is a SIG/DNS service, DNA Center manages campus, and Meraki Systems Manager is MDM.

Question 35Cisco secure-access and zero-trust policy foundations

What is the MOST important security benefit of microsegmentation for data center workloads?

  1. It increases network throughput.
  2. It reduces lateral movement by enforcing least-privilege application-to-application policy at the workload level. Correct answer.
  3. It simplifies VLAN trunking.
  4. It removes the need for IAM.

Explanation

The defining security benefit of microsegmentation is reducing lateral movement - even if an attacker compromises one workload, host-level policy prevents pivoting to other workloads that the compromised host has no business need to reach. It is a least-privilege control at the east-west axis. Throughput, VLAN simplification, and IAM are unrelated benefits.

Question 36Cisco secure-access and zero-trust policy foundations

Which statement about Cisco AI Defense is correct in the SCAZT context?

  1. AI Defense protects AI applications and their interactions by discovering AI assets, validating models against safety/security risks, and runtime guardrails on prompts, responses, and data. Correct answer.
  2. AI Defense replaces all traditional firewalls.
  3. AI Defense only encrypts model weights at rest.
  4. AI Defense is a tunneling protocol like MASQUE.

Explanation

Cisco AI Defense is positioned to discover AI assets across the enterprise (shadow AI), validate models for safety/security/jailbreak vulnerabilities, and apply runtime guardrails to prompts and responses - preventing prompt injection, data exfiltration, and policy violations as users interact with GenAI services. It complements existing firewalls and SSE rather than replacing them.

Question 37Cisco secure-access and zero-trust policy foundations

Which Cisco Secure Access feature is positioned to give visibility and control over employee use of public AI services such as ChatGPT, Gemini, or Claude - including which apps are sanctioned and what data is being submitted?

  1. AI Access (within Secure Access) Correct answer.
  2. DNS Security only
  3. VPN-as-a-Service
  4. Catalyst SD-WAN AAR

Explanation

AI Access (part of the Cisco Secure Access platform) discovers GenAI usage, classifies AI applications, applies access policy (sanctioned vs unsanctioned), and inspects prompts/responses for sensitive data via DLP. DNS Security can block known bad domains but not provide app-level GenAI control; VPN-as-a-Service and SD-WAN AAR are connectivity functions.

Question 38Cisco secure-access and zero-trust policy foundations

What is the primary purpose of an AI guardrail in a runtime GenAI deployment?

  1. Reduce inference cost.
  2. Constrain prompts and responses against safety, privacy, and policy rules - for example blocking PII leakage, prompt injection, jailbreak attempts, and toxic outputs. Correct answer.
  3. Increase model accuracy on math problems.
  4. Compress model weights.

Explanation

Runtime AI guardrails inspect user prompts and model responses against policy: blocking PII or secrets in prompts, refusing prompt injection / jailbreak attempts, and filtering toxic or off-topic outputs. They are a control plane between users and the model. Cost, accuracy, and compression are model-engineering concerns, not security guardrails.

Question 39Cisco secure-access and zero-trust policy foundations

Which statement BEST describes the role of a Web Application Firewall (WAF) in defending against application-layer DDoS such as HTTP request floods or slow-POST attacks?

  1. A WAF inspects HTTP requests and applies rules and rate-limiting that drop or challenge malicious traffic patterns at L7. Correct answer.
  2. A WAF reroutes BGP prefixes to scrub centers.
  3. A WAF only filters DNS amplification at L3.
  4. A WAF replaces TLS termination.

Explanation

A WAF understands HTTP/HTTPS and can apply signature, behavior, and rate-limit rules at Layer 7 - defending against HTTP floods, slowloris, slow-POST, and credential-stuffing patterns. Volumetric L3/L4 floods are typically scrubbed upstream via BGP-redirected scrubbing centers; the WAF complements but does not replace those. WAFs do not 'reroute BGP' themselves.

Question 40Cisco secure-access and zero-trust policy foundations

An organization uses Cisco Secure Firewall (formerly Firepower / FTD) at the branch as part of an SD-WAN deployment. Which is a valid placement of policy enforcement?

  1. Apply IPS, URL filtering, and AVC policy at the branch FTD before traffic egresses to the Internet via direct internet access (DIA). Correct answer.
  2. Disable all branch inspection and only inspect at the data center.
  3. Inspect only east-west traffic; never inspect Internet-bound traffic.
  4. Inspect with FTD only when sessions exceed 1 Gbps.

Explanation

In a Cisco Secure Firewall + SD-WAN branch design, policy can be enforced at the branch FTD on DIA traffic - IPS, URL filtering, application visibility and control, and malware inspection - before the packet ever reaches the Internet. This 'defense at the edge' model is also commonly combined with SIG/SSE for additional cloud-delivered controls. Disabling branch inspection or limiting it to certain rates is not a recommended design.

Question 41Cisco secure-access and zero-trust policy foundations

Which Cisco Secure Workload capability automatically discovers what each application TALKS to (ports, processes, peers) so segmentation policy can be authored from observed behavior rather than guesswork?

  1. Application Dependency Mapping (ADM) Correct answer.
  2. Anomaly detection
  3. Vulnerability scanning
  4. License compliance

Explanation

Application Dependency Mapping (ADM) in Cisco Secure Workload analyzes flow telemetry and process-binary metadata to cluster workloads and surface inter-application dependencies. The output drives policy generation that reflects actual application behavior - far more accurate than authoring rules from network diagrams. The other answers are real Secure Workload capabilities, but ADM is the dependency-discovery feature.

Question 42Cisco secure-access and zero-trust policy foundations

Which lifecycle step is MOST important when introducing a new microsegmentation rule in Cisco Secure Workload to avoid breaking production?

  1. Push the rule directly to enforcement mode without testing.
  2. Run the policy in 'quick analysis' / monitor / shadow mode first to detect missed flows, then promote to enforcement. Correct answer.
  3. Apply the rule only after disabling all logging.
  4. Restart all workloads first.

Explanation

Cisco Secure Workload supports policy analysis (monitor / shadow mode) so a candidate policy is evaluated against ongoing flow telemetry and reports what WOULD have been blocked. Operators tune the policy until no legitimate flows are missed, then promote it to enforcement. Pushing untested policies, disabling logging, or restarting workloads are all unsafe shortcuts.

Question 43Cisco secure-access and zero-trust policy foundations

Which statement about IPsec versus TLS for tunneling is correct in a cloud-edge / SSE context?

  1. IPsec operates at L3 and is commonly used for site-to-site / branch-to-cloud tunnels (e.g., IKEv2 to Secure Access PoPs); TLS operates at L7 and protects application sessions or DTLS-based client tunnels. Correct answer.
  2. IPsec only works inside an MPLS L3VPN.
  3. TLS cannot be used to tunnel non-HTTP traffic.
  4. IPsec and TLS provide identical features at identical layers.

Explanation

IPsec (with IKEv2) is the typical choice for site-to-site or branch-to-cloud tunnels - including IPsec backhaul to Cisco Secure Access PoPs. TLS (and DTLS) operates at L4/L7 and is the basis of client VPNs (Cisco Secure Client TLS/DTLS) and SaaS encryption. They serve overlapping but distinct roles. The other choices are factually wrong.

Question 44Cisco secure-access and zero-trust policy foundations

Which IPS deployment mode passes a copy of traffic to the IPS engine without being able to drop the original packet, and is therefore detection-only?

  1. Inline
  2. TAP / IDS / passive monitor mode Correct answer.
  3. Routed
  4. Transparent

Explanation

TAP / IDS / passive monitor mode receives a mirrored copy of traffic - the IPS can detect and alert but cannot block the in-flight packet. Inline, routed, and transparent modes all place the IPS in the forwarding path so it can drop or reset offending sessions. Choose inline when the requirement is prevention, not just detection.

Question 45Cisco secure-access and zero-trust policy foundations

What is the MAIN benefit of inspecting TLS-encrypted traffic at a security gateway (SWG/CDFW)?

  1. Higher throughput per session.
  2. Visibility into payloads - URL paths, file downloads, embedded malware, DLP content - that would otherwise be opaque to inspection. Correct answer.
  3. Lower client CPU.
  4. Faster TLS handshakes.

Explanation

Without TLS inspection (decryption at the gateway with a private CA trusted by clients) the gateway sees only SNI and IP/port. Inspecting TLS lets the SWG/CDFW evaluate full URL paths, file content, and DLP patterns, and apply IPS/AV/sandboxing. Decryption typically reduces throughput slightly and increases CPU on the gateway - security-vs-performance is the trade-off.

Question 46Cisco secure-access and zero-trust policy foundations

Why might an administrator EXCLUDE a host from TLS decryption in Cisco Secure Access?

  1. To avoid breaking applications that perform certificate pinning (banking, healthcare portals) or to satisfy privacy / regulatory requirements. Correct answer.
  2. Because TLS is insecure.
  3. Because Cisco does not support TLS decryption.
  4. Because exclusion improves password complexity.

Explanation

Common reasons to exclude a destination from TLS decryption: the application performs certificate pinning (mobile banking apps, certain healthcare clients) and breaks when intercepted; or regulatory/privacy obligations forbid inspecting categories like 'health' or 'finance'. Cisco Secure Access supports decryption - exclusions are a deliberate trade-off, not a workaround.

Question 47Cisco secure-access and zero-trust policy foundations

Which statement about Cisco Secure Workload's vulnerability assessment is true?

  1. It correlates installed software packages on agent-protected workloads against known CVEs and surfaces affected hosts and severity. Correct answer.
  2. It replaces a SIEM.
  3. It only scans at the network layer.
  4. It is identical to GuardDuty.

Explanation

Secure Workload agents enumerate installed packages and binary versions and correlate them against vulnerability databases to identify which workloads are exposed to which CVEs, ranked by severity. Operators can then prioritize patching or compensating microsegmentation. SIEMs and AWS GuardDuty serve different roles.

Question 48Cisco secure-access and zero-trust policy foundations

Which BEST describes 'lateral movement prevention' as a microsegmentation goal?

  1. Blocking unnecessary east-west connections so a compromised host cannot pivot to other workloads. Correct answer.
  2. Preventing all north-south traffic.
  3. Disabling DNS resolution.
  4. Quarantining mobile clients.

Explanation

Lateral movement prevention is the explicit goal of east-west segmentation: even if an attacker compromises one workload, host-level policy denies connections to peers that have no legitimate business need (e.g., a web tier should not initiate SSH to a HR database). North-south, DNS, and mobile concerns are different problems.

Question 49Cisco secure-access and zero-trust policy foundations

Which Secure Access policy decision point combines identity, device posture, application sensitivity, and risk context to permit or deny each session?

  1. Static ACL on a router
  2. The Secure Access policy engine evaluating attribute-based access control (ABAC) per request Correct answer.
  3. An endpoint hosts file
  4. A Layer-2 MAC filter

Explanation

The Cisco Secure Access policy engine evaluates each session against an ABAC policy combining user identity (IdP), group membership, device posture, application classification, sensitivity, time, and risk signals - then permits or denies. Static ACLs, hosts files, and L2 MAC filters cannot evaluate these attributes per-session.

Question 50Cisco secure-access and zero-trust policy foundations

When deploying a Web Application Firewall in front of an internet-facing app, which logging strategy is MOST useful for investigating attacks AFTER they happen?

  1. Log only blocked requests.
  2. Log full request metadata (URL, method, source IP, headers, rule that matched, action) for both blocked and allowed traffic where applicable, and forward to a SIEM. Correct answer.
  3. Disable logging to save disk.
  4. Log only TLS handshake errors.

Explanation

Comprehensive WAF logging - blocked AND notable allowed events with rule context and request metadata - feeds SIEM/XDR investigations and post-incident analysis. Logging only blocks misses reconnaissance patterns; disabling logging defeats forensic needs; TLS-only logs miss application-layer attacks.