Free Designing and Implementing Secure Cloud Access for Users and Endpoints Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Designing and Implementing Secure Cloud Access for Users and Endpoints practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Under NIST SP 800-207, how should an enterprise treat a resource request originating inside its network perimeter?

   1. A. Grant access based on the requesting device's network location.
   2. B. Apply authentication and authorization controls to the request.
   3. C. Reuse authorization for any resource after the initial login.
   4. D. Trust an enterprise-owned device without checking its posture.

   Answer: B

   Explanation: NIST states, "Network location alone does not imply trust." Internal placement therefore does not replace authentication, authorization, or posture evaluation.

   Reference: Zero Trust Architecture — NIST SP 800-207 — Section 2.1, tenet 2, page 6

2. 2What is Cisco Identity Intelligence's principal role in an environment using several vendors' identity providers?

   1. A. Replace every identity provider with a single credential store.
   2. B. Combine authentication and access insights across identity sources.
   3. C. Assess cross-provider identity risk from one provider's initial login alone.
   4. D. Assign the same access permissions to identities in every provider.

   Answer: B

   Explanation: Cisco describes bringing together "authentication and access insights". Identity Intelligence correlates identity context and risk across vendors; this does not require replacing providers or equalizing permissions.

   Reference: Duo Identity Security with Cisco Identity Intelligence — Overview — Cisco Identity Intelligence

3. 3Which security property of TLS prevents a passive observer from reading application data while it crosses an untrusted network?

   1. A. Authentication of the communicating endpoint
   2. B. Integrity checking of received application records
   3. C. Confidentiality through negotiated encryption
   4. D. Replay detection for previously exchanged records

   Answer: C

   Explanation: NIST explains, "A confidentiality service provides assurance that data is kept secret, preventing eavesdropping." Integrity, authentication, and replay protection address different threats to the connection.

   Reference: NIST SP 800-52 Revision 2 — Guidelines for TLS Implementations — Section 2.1, TLS Subprotocols, page 4

4. 4After internal domains and local DNS servers are configured, how do Secure Access Virtual Appliances normally forward public and internal DNS queries?

   1. A. Forward every query to local DNS, bypassing Secure Access resolvers.
   2. B. Forward every query to public DNS, including configured internal names.
   3. C. Forward public queries to Secure Access and local queries to internal DNS.
   4. D. Answer public queries from a persistent VA record cache and send internal queries locally.

   Answer: C

   Explanation: Cisco describes VAs as "conditional DNS forwarders". They send public DNS queries to Secure Access and configured local queries to local DNS; they do not cache DNS records.

   Reference: Get Started with Virtual Appliances — How Secure Access Virtual Appliances Work

5. 5Agents cannot be installed on legacy workloads, but their east-west traffic crosses Cisco Secure Firewall. Which telemetry integration can provide Secure Workload with stateful flow visibility?

   1. A. Read aggregate SNMP interface counters without individual connection records.
   2. B. Stream Secure Firewall NSEL events through the Secure Workload Ingest Connector.
   3. C. Import only firewall AAA authentication logs without traffic-flow records.
   4. D. Collect firewall configuration snapshots without observed connection telemetry.

   Answer: B

   Explanation: Cisco uses "NetFlow Secure Event Logging (NSEL)" through the Ingest Connector for stateful flow visibility. Aggregate interface counts, authentication-only logs, and configuration snapshots lack the required individual flow observations.

   Reference: Cisco Secure Workload and Secure Firewall White Paper — Visibility of agentless workloads

6. 6In CISA's Zero Trust Maturity Model v2.0, which capability supports integration across the five pillars?

   1. A. Identity
   2. B. Devices
   3. C. Data
   4. D. Governance

   Answer: D

   Explanation: The model names the cross-cutting capabilities as "Visibility and Analytics, Automation and Orchestration, and Governance." Identity, Devices, and Data are pillars; Governance supports integration across them.

   Reference: CISA Zero Trust Maturity Model Version 2.0 — Section 5, page 6

7. 7Duo users are not synchronized from Active Directory or Microsoft Entra ID. What data enables Identity Intelligence to associate a Duo user with that person's identity in another integrated platform?

   1. A. A matching display name without an email address
   2. B. An identical local password in both identity stores
   3. C. An email address in Duo matching the other platform
   4. D. The IP address used during the person's last login

   Answer: C

   Explanation: Duo specifies, "The email address used in Duo must match an email address in another integrated platform". This requirement applies when the directory identifiers from AD or Entra synchronization are unavailable.

   Reference: Duo Identity Security with Cisco Identity Intelligence — Requirements — Duo User Data Requirement

8. 8Which cryptographic construction does TLS 1.3 use to protect application-record confidentiality and integrity?

   1. A. Authenticated encryption with associated data (AEAD)
   2. B. Separate CBC encryption and an independent HMAC record mode
   3. C. RSA encryption of every application record using the certificate key
   4. D. An unkeyed hash appended to unencrypted application data

   Answer: A

   Explanation: NIST states, "In TLS 1.3, only AEAD symmetric algorithms are used for confidentiality and integrity." Earlier separate encryption/MAC constructions, public-key bulk encryption, and unkeyed hashes do not describe TLS 1.3 record protection.

   Reference: NIST SP 800-52 Revision 2 — Guidelines for TLS Implementations — Section 2.4, Integrity, page 6

9. 9What is the minimum number of Secure Access Virtual Appliances required in a Site to support DNS redundancy and updates without downtime?

   1. A. One
   2. B. Two
   3. C. Three
   4. D. Four

   Answer: B

   Explanation: Cisco requires "at least two Virtual Appliances for a Site." The question asks the minimum, so three or four could satisfy the deployment requirement but are not the minimum.

   Reference: Get Started with Virtual Appliances — Number of Secure Access Sites

10. 10A security team needs Secure Workload to identify vulnerable installed packages and container images on supported application hosts. Which collection method supplies that runtime visibility?

    1. A. DNS query logs showing names contacted by the application hosts
    2. B. NetFlow records showing source and destination ports and addresses
    3. C. Secure Workload agents collecting host runtime software information
    4. D. Firewall policy exports showing configured network access rules

    Answer: C

    Explanation: Cisco's vulnerability use case specifies "Utilizing an agent" for runtime visibility into vulnerable packages and images. DNS, flow metadata, and configured firewall rules do not enumerate installed host software.

    Reference: Cisco Secure Workload and Secure Firewall White Paper — Cisco Secure Workload — Solution overview, Vulnerability Detection and Protection