5.4 Cloud Security CCIE-SECURITY Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A financial institution wants to implement DLP policies to prevent sensitive customer data from being transmitted via web applications. They have a requirement to allow certain data, such as account numbers, to be transmitted to a specific trusted application. The administrator needs to configure DLP to block sensitive data except for that application. What should the administrator do?

   • ACreate a separate DLP policy for each application.
   • BDisable DLP for the trusted application and enable it for all others.
   • CCreate a DLP policy that blocks sensitive data patterns and add an exception for the trusted application.
   • DUse a CASB policy to allow the trusted application and block all others.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   An administrator has deployed the Umbrella virtual appliance and configured DNS proxy forwarding. They notice that some internal domains are being incorrectly blocked by Umbrella's security categories. The administrator wants to allow these internal domains while still enforcing security policies for external domains. What should the administrator do?

   • ADisable DNS proxy forwarding for internal domains by configuring the VA to bypass Umbrella for those queries.
   • BAdd the internal domains to a global allow list in Umbrella's DNS policy.
   • CCreate a separate DNS policy for internal domains with a lower priority.
   • DChange the security category for internal domains to 'Uncategorized'.
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   An administrator has implemented a DLP policy to block credit card numbers in web traffic. They want to ensure that the policy is working and that incidents are being reported to the security team. They also want to receive real-time alerts when a DLP incident occurs. What should the administrator configure?

   • AUse the Umbrella API to poll for DLP incidents.
   • BEnable DLP alerts in Umbrella and configure notifications to be sent to the security team.
   • CReview the DLP dashboard daily to check for incidents.
   • DConfigure the VA to send syslog messages for DLP events.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A security team wants to block access to known malware domains and enforce security categories for all users in the marketing department. They have already deployed the Umbrella virtual appliance and configured DNS proxy forwarding. What is the next step to enforce the policy?

   • ACreate a DNS policy in Umbrella that blocks the malware domains and assigns it to the marketing department's identity.
   • BConfigure the VA to block the malware domains locally.
   • CCreate a firewall rule to block the malware domains.
   • DEnable the security categories in the VA's settings.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   After applying a new DNS policy to block a list of malicious domains, the administrator wants to verify that the policy is actually being enforced for a specific user. What should the administrator use to confirm that the user's DNS queries are being blocked?

   • ACheck the Umbrella reporting dashboard for DNS activity from that user's identity.
   • BAsk the user to try accessing the domain and report if it fails.
   • CUse the Umbrella API to test the domain resolution.
   • DReview the VA's local logs for DNS queries.
   Reveal Solution Discussion Select an answer first