Cisco 300-740 Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT) Exam Practice Test

Based on the Cisco Tetration segmentation policy and the requirement to allow only web server communication (HTTP/HTTPS):

Rule 1 allows HTTP (port 80) — required

Rule 2 allows HTTPS (port 443) — required

Rule 3 allows SSH — not needed for web communication

Rule 4 allows UDP port 68 (DHCP) — not relevant to application-layer web server traffic

Therefore, Rules 3 and 4 are unnecessary and should be deleted for policy optimization, which aligns with zero-trust and least-privilege access design as outlined in SCAZT Section 4 (Application and Data Security, Pages 86–90).

To preserve the user for investigation while immediately revoking access, the correct approach is to disable the user in the Duo Admin Panel. This action blocks authentication without deleting logs or user data. Simultaneously, resetting the password from Active Directory ensures any potentially compromised credentials are revoked.

According to SCAZT (Section 2: User and Device Security, Pages 40–44), disabling user accounts in Duo offers secure containment during security incidents while maintaining data for forensic review.

From the firewall access rules provided, Rule 1 allows traffic from 20.1.1.10 (GCP VM) to 20.1.1.1 using HTTPS. However, this destination is not the actual mail server—the mail server resides at 192.168.200.10 (inside network). Therefore:

A: Rule 1 must be updated to reflect the correct destination: 192.168.200.10. Without this change, traffic is not permitted to the mail server.

D: NAT (Network Address Translation) is needed to translate the external address (e.g., 20.1.1.10) to access internal addresses (like 192.168.200.10). As per SCAZT and Cisco firewall policies, NAT enables proper packet delivery from public to private zones.

Rule 2, which denies all other traffic, is correctly placed after the specific allow rule. Therefore, moving it (Option B) would not help, and Options C and E are unrelated to resolving the immediate firewall access and routing issue.

The Remote Desktop Protocol (RDP) uses TCP port 3389. Cisco Umbrella includes a cloud-delivered firewall that can be used to block outbound traffic by port. In this case, since the RDP communication needs to be prevented regardless of application name resolution, the best approach is to use a Firewall policy in Umbrella to block port 3389 traffic across the tunnel.

Web Application Firewalls (WAFs) use rate-based rules as one of the primary mechanisms to detect and mitigate Distributed Denial of Service (DDoS) attacks. According to the SCAZT Study Guide, Section 3 (Network and Cloud Security, Pages 74–77), rate-based rules dynamically detect unusual spikes in traffic and can throttle or block connections exceeding predefined thresholds. This form of protection is more adaptive and intelligent than standard ACLs or static filtering, enabling protection against zero-day and volumetric attacks that may not follow known patterns.

According to the SCAZT guide, the “Always-on” deployment mode for Cisco Secure DDoS (including integration with Secure Web Application Firewall solutions) provides continuous protection for both volumetric and application-layer attacks. This deployment model ensures that all traffic flows through the scrubbing and WAF infrastructure without requiring traffic redirection only during attack events. It provides real-time mitigation and immediate detection, which is essential to address both volumetric attacks (e.g., SYN floods) and Layer 7 (application-layer) attacks such as HTTP floods and injection-based threats.

While “Hybrid” and “On-demand” modes are useful for specific use cases, only “Always-on” offers continuous and comprehensive protection required for environments that demand consistent uptime and threat prevention.

Policy-Based Routing (PBR) enables routing decisions based on criteria such as source IP, destination IP, or application. To send SaaS traffic (e.g., Office 365, Salesforce) directly to the internet rather than over a site-to-site VPN, PBR must be configured at each site firewall. According to SCAZT Section 1 (Cloud Security Architecture, Pages 18–20), this approach enables secure local internet breakout—commonly used in direct internet access (DIA) architectures.

The screenshot from Cisco Secure Cloud Analytics shows a Role Violation alert. According to the “Supporting Observations” pane, the device with IP 10.201.0.15 is assigned the role of Domain Controller but has demonstrated traffic behavior matching an FTP client, connecting to ports 20, 21, 115, 152, 989, and 990. This discrepancy triggered the alert.

Cisco SCAZT documentation emphasizes that devices acting outside their expected network roles (e.g., a domain controller acting as an FTP client) indicate potential compromise or misuse. Role-based anomaly detection is part of Visibility and Assurance mechanisms where baseline behaviors are continuously monitored and flagged when changes occur outside expected policy or operational norms.

The Cisco SAFE architecture uses the concept of Secure Domains as foundational blocks. These domains represent areas of the network (e.g., Branch, Data Center, Cloud, Edge) that require specific security controls. Each domain aligns with controls across visibility, segmentation, threat protection, and identity services.

The SCAZT documentation emphasizes that when Cisco Secure XDR identifies a high-risk threat (e.g., risk score 8 out of 10 for malware distribution, as shown in the exhibit), the first priority is to prevent lateral movement and data exfiltration. The recommended first response action is to isolate the affected endpoint from the network.

Cisco Secure Endpoint and XDR allow you to trigger an "isolate" response directly from the dashboard, cutting off all non-management communication from the compromised device. This preserves the environment and enables forensic analysis before removing malware or taking destructive actions like rebuilding the system.

When integrating Cisco Cloudlock with SaaS platforms like Salesforce, two core authorizations are required: network access and API authorization. In the scenario, Cloudlock has been authorized in Salesforce, and its IP has been allow-listed. However, if access is still denied, the most likely cause is that Salesforce has not been configured to accept traffic from Cloudlock’s IP range — a process handled from the Salesforce admin panel.

To resolve the issue, network access must be explicitly granted to Cloudlock from within Salesforce. This ensures that Salesforce accepts requests initiated by Cloudlock for monitoring and enforcement.

The anyconnect keep-installer none command is used to remove the Cisco Secure Client (formerly AnyConnect) from an endpoint once the VPN session ends. This is useful in temporary or kiosk-based access environments. The default behavior retains the client.

This capability is covered in SCAZT Section 2: User and Device Security (Pages 40–44), which outlines VPN session lifecycle management and Secure Client policies.

In IKEv1 policy configuration for Cisco ASA, two key commands are required to define the encryption and hashing algorithms:

A: encryption aes-256 defines the encryption method for the IKE SA.

E: hash sha-256 ensures SHA-256 is used as the integrity mechanism during IKE phase 1.

According to Cisco documentation and SCAZT (Section 1: Cloud Security Architecture, Pages 19–22), these two components are essential to negotiating a secure VPN tunnel. The provided config uses group 1 (modp768), which is weak by today’s standards and could also lead to negotiation failure. However, from the available options, encryption and hash are the two required for tunnel success.

When integrating Duo Authentication Proxy with Active Directory for multifactor authentication (MFA), you must:

Configure the Identity Source in the Duo Admin Panel as Active Directory (not SAML), since it’s using the Authentication Proxy.

Configure the authentication proxy settings in the [sso] section to communicate with both AD and the Duo cloud.

This setup allows Active Directory to be the primary identity store while Duo provides the second authentication factor.

The screenshot from Cisco ISE shows a configuration of a “File Condition” posture check that verifies the existence and version of the “Srv.sys” file in the System32 directory. This is a known method to validate if a Windows device has received a critical security patch (in this case, one related to protection against the WannaCry vulnerability, MS17-010). Cisco ISE does not rely solely on a patch management system for this type of validation but can use specific file version and path checks. Therefore, the correct posture condition is File Condition.

When configuring Cisco Umbrella to block all traffic except to domains explicitly allowed (e.g., cisco.com), the “Allow-Only Mode” must be enabled. This setting overrides default behavior and ensures that only entries listed in the allow list are accessible—everything else is automatically blocked. According to SCAZT Section 1 (Cloud Security Architecture, Pages 16–19), enabling Allow-Only Mode is crucial for strict outbound DNS filtering.

Without this setting, the system allows access to all domains not explicitly blocked, which is why the engineer was able to access non-cisco.com domains despite defining an allow list.

Multifactor Authentication (MFA) is one of the most effective mitigations against brute-force attacks. Even if an attacker guesses or steals a user’s password, they would still need a second authentication factor (e.g., push notification, hardware token, biometric verification) to complete login.

SCAZT Section 2: User and Device Security (Pages 40–43) emphasizes the importance of MFA in protecting identities from password spraying, credential stuffing, and brute-force attacks.