Designing and Implementing Secure Cloud Access for Users and Endpoints (300-740) Free Practice Test

Question 1

Refer to the exhibit. An engineer must troubleshoot an issue with excessive SSH traffic leaving the internal network between the hours of 18:00 and 08:00. The engineer applies a policy to the Cisco ASA firewall to block outbound SSH during the indicated hours; however, the issue persists. What should be done to meet the requirement?

A. Change the time of rule 2.

B. Delete rule 4

C. Change the time of rule 5

D. Delete rule 3

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

Refer to the exhibit. An engineer must enable access to Salesforce using Cisco Umbrella and Cisco Cloudlock. These actions were performed:
* From Salesforce, add the Cloudlock IP address to the allow list
* From Cloudlock, authorize Salesforce
However, Salesforce access via Cloudlock is still unauthorized. What should be done to meet the requirements?

A. From the Salesforce admin page, grant network access to Cloudlock

B. From the Cloudlock dashboard, grant API access to Salesforce.

C. From the Cloudlock dashboard, grant network access to Salesforce.

D. From the Salesforce admin page, grant API access to Cloudlock.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Network security in the Cisco Security Reference Architecture is divided into which two areas?

A. Cloud-based and on-premises

B. Physical and virtual

C. Wired and wireless

D. Internal and external

Correct Answer: A

Question 4

DISA's role in cloud security architecture involves:

A. Managing cloud storage solutions

B. Ensuring cloud services are accessible worldwide

C. Providing entertainment services

D. Setting standards for defense-related IT and cybersecurity

Correct Answer: D

Question 5

Which of the following is true about multifactor authentication for devices?

A. It can include something you know, something you have, and something you are

B. It makes devices easier to hack

C. It decreases security by simplifying access

D. It only applies to mobile devices

Correct Answer: A

Question 6

An engineer is configuring multifactor authentication using Duo. The implementation must use Duo Authentication Proxy and the Active Directory as an identity source. The company uses Azure and a local Active Directory. Which configuration is needed to meet the requirement?

A. Configure the Identity Source as "Active Directory" on the Single Sign-On tab in the Duo Admin Panel, and configure the permit list to "Local database".

B. Configure the Identity Source as "SAML" on the Single Sign-On tab, and configure the authentication proxy with the "[cloud]" section.

C. Configure the Identity Source as "SAML" on the Single Sign-On tab in the Duo Admin Panel, and configure the forwarding proxy as "local" for the Identity Source.

D. Configure the Identity Source as "Active Directory" on the Single Sign-On tab, and configure the authentication proxy with the "[sso]" section.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

An administrator must deploy an endpoint posture policy for all users. The organization wants to have all endpoints checked against antimalware definitions and operating system updates and ensure that the correct Secure Client modules are installed properly. How must the administrator meet the requirements?

A. Create the required posture policy within Cisco ISE, configure redirection on the NAD, and ensure that the client provisioning policy is correct.

B. Configure the WLC to provide local posture services, and configure Cisco ISE to receive the compliance verification from the WLC to be used in an authorization policy.

C. Create an ASA Firewall posture policy, upload the Secure Client images to the NAD, and create a local client provisioning portal.

D. Identify the antimalware being used, create an endpoint script to ensure that it is updated, and send the update log to Cisco ISE for processing.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Verifying user access to applications and data can be effectively done using:

A. Guesswork based on user complaints

B. Firewall logs for monitoring access attempts

C. Random security audits once a year

D. Personal interviews with users about their access patterns

Correct Answer: B

Question 9

Refer to the exhibit. A security engineer must configure a posture policy in Cisco ISE to ensure that employee laptops have a critical patch for WannaCry installed before they can access the network. Which posture condition must the engineer configure?

A. Patch Management Condition

B. File Condition

C. Anti-Virus Condition

D. Anti-Malware Condition

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 10

The main benefit of Cisco Secure Network Analytics in diagnosing access issues is its ability to:

A. Limit data collection to avoid privacy concerns

B. Encourage a reactive rather than proactive security posture

C. Provide deep visibility into network traffic for anomaly detection and troubleshooting

D. Focus solely on past security incidents without real-time analysis

Correct Answer: C

Question 11

Refer to the exhibit. An engineer must configure SAML SSO in Cisco ISE to use Microsoft Azure AD as an identity provider. These configurations were performed:
* Configure a SAML IdP in ISE.
* Configure the Azure AD IdP settings.
Which two actions must the engineer take in Cisco ISE? (Choose two.)

A. Configure SAML groups in ISE.

B. Add a SAML IdP.

C. Configure the External Identity Sources settings.

D. Configure the Internal Identity Source Sequence setting.

E. Upload metadata from Azure AD to ISE.

Correct Answer: C,E

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 12

Cisco Umbrella provides visibility and assurance by:

A. Focusing exclusively on email security

B. Offering DNS-layer security to prevent access to malicious domains

C. Limiting its functionality to on-premises solutions

D. Reducing the scope of security monitoring to non-web traffic

Correct Answer: B

Question 13

Configuring user and device trust using SAML authentication for a mobile or web application helps to:

A. Ensure only authorized users and devices can access the application

B. Increase the number of user accounts required

C. Reduce application performance

D. Disable multifactor authentication

Correct Answer: A

Question 14

An administrator received an incident report indicating suspicious activity of a user using a corporate device.
The manager requested that the credentials of user [email protected] be reset and synced via the Active Directory. Removing the account should be avoided and used for further investigation on data leak. Which configuration must the administrator apply on the Duo Admin Panel?

A. Disable the account on the Users tab and reset the password from the Active Directory.

B. Quarantine the user from all the policies on the Policies tab, including associated devices.

C. Delete the user in the Users tab option and sync it with the domain controller.

D. Request the password change on the Device tab on managed devices.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Cisco Designing and Implementing Secure Cloud Access for Users and Endpoints (300-740) Free Practice Test