5.4 Cloud Security CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A branch office has no local DNS server and all client DNS queries go to the ISP's resolver. The security team wants to enforce Umbrella DNS policies for these clients without changing their DHCP settings. You deploy the Umbrella virtual appliance in the branch. What is the most efficient way to ensure client DNS traffic is forwarded to Umbrella for policy enforcement?

   • AConfigure the virtual appliance as the DNS server in DHCP and enable DNS proxy on the appliance.
   • BCreate a DNS policy in Umbrella that blocks the ISP's DNS server IP.
   • CInstall the Umbrella roaming client on every client machine.
   • DSet the ISP DNS as the upstream resolver in the virtual appliance's DNS proxy settings.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A DLP policy has been configured to block credit card numbers in web uploads. After implementation, you want to monitor any incidents where the policy triggered. Where should you look?

   • ADNS reporting, which shows blocked domains.
   • BUmbrella's DLP dashboard, which shows policy violations and alerts.
   • CThe virtual appliance's system logs.
   • DCASB dashboards, which show cloud app usage.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   You are deploying the Umbrella virtual appliance in a high-availability pair. The appliances are behind a load balancer that forwards DNS traffic to both. You notice that some DNS queries are not being enforced by Umbrella policies. What is the most likely cause and solution?

   • AThe DNS policies are not applied to the virtual appliance identities.
   • BThe load balancer is using UDP, but Umbrella requires TCP for DNS.
   • CThe virtual appliances are not configured with the same upstream DNS servers.
   • DThe load balancer is not configured for session persistence, causing queries to be split between appliances; configure sticky sessions.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A global company has multiple networks across different regions. They want to enforce a strict DNS policy that blocks all malware domains, but they also want to allow regional exceptions for certain legitimate domains that are mistakenly categorized as malware. What is the best approach?

   • ACreate a global policy that blocks malware and add per-network allowlist overrides for the legitimate domains.
   • BUse a single policy for all networks and disable the malware category.
   • CCreate separate policies for each network with the same malware block and different allowlists.
   • DConfigure the virtual appliance to bypass Umbrella for those domains.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   You are configuring Remote Browser Isolation for a large enterprise. The security team wants to isolate all web traffic from the 'Executives' group, but the IT team is concerned about the performance impact and wants to isolate only high-risk categories. The CEO insists on full isolation for executives. What is the best compromise?

   • AApply RBI to the Executives group for all categories, but set a performance threshold to automatically disable isolation during high load.
   • BApply RBI only to high-risk categories for the Executives group, and explain the trade-off to the CEO.
   • CApply RBI to the Executives group for all categories, and accept the performance impact.
   • DUse DNS policies to block all web traffic for Executives instead of RBI.
   Reveal Solution Discussion Select an answer first