5.4 Cloud Security CCIE-SECURITY Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   An administrator has applied a DNS policy to block a specific malicious domain, but users are still able to access it. The VA is correctly configured and DNS proxy forwarding is working. The administrator has verified that the policy is active in Umbrella. What is the most likely cause of the issue?

   • AThe domain is in the allow list.
   • BThe VA is not forwarding DNS queries to Umbrella.
   • CUsers are using a VPN that bypasses the VA's DNS settings.
   • DThe policy is not assigned to the correct identity.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company wants to implement Remote Browser Isolation for all users, but they are concerned about the performance impact on web applications that require file downloads. The security team wants to ensure that file downloads are not blocked or degraded. What should the administrator configure in the RBI policy?

   • AUse a separate RBI policy for each web application.
   • BSet the RBI policy to block all file downloads.
   • CDisable RBI for all web applications that require file downloads.
   • DEnable file download controls in the RBI policy to allow safe downloads while still isolating the browsing session.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   An organization has implemented RBI for its executive team, but the executives are complaining that some websites are not working correctly because of isolation. The administrator wants to allow those specific websites to be accessed directly while still isolating high-risk categories. What is the best approach?

   • AAdd the problematic websites to an allow list in the RBI policy for the executive team.
   • BIncrease the isolation level to improve compatibility.
   • CDisable RBI for the executive team entirely.
   • DCreate a separate RBI policy for each problematic website.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company is using Umbrella's CASB to control access to cloud applications. They have discovered that employees are using a new unsanctioned file-sharing service that is not yet in Umbrella's application catalog. The security team wants to block this service immediately. What should the administrator do?

   • AWait for Umbrella to update its application catalog.
   • BEnable RBI for the service to isolate it.
   • CCreate a custom CASB policy that blocks the domain of the unsanctioned service.
   • DUse a DNS policy to block the domain.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard · select all that apply

   A company wants to implement CASB policies to enforce threat protection and data loss prevention for cloud applications. They have both sanctioned and unsanctioned applications. The security team wants to ensure that sensitive data is not exfiltrated via any cloud service. Which of the following actions should the administrator take? (Select all that apply.)

   • ACreate CASB policies that apply DLP controls to all cloud applications.
   • BEnable threat protection features in CASB policies for all cloud applications.
   • CBlock all unsanctioned cloud applications using CASB policies.
   • DUse DNS policies to block all cloud applications.
   • EConfigure RBI for all cloud applications to prevent data loss.
   Check answers Discussion Select an answer first