5.4 Cloud Security CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An organization uses Umbrella CASB to control access to cloud apps. They have a policy that blocks unsanctioned apps, but they notice that some users are still able to access a particular unsanctioned app. The app uses a non-standard port and IP address instead of a domain. What is the likely reason and what should you do?

   • AThe CASB policy has a low priority; move it to the top.
   • BCASB policies only work for domain-based traffic; you need to use a different security solution for IP-based traffic.
   • CThe app is using a proxy to bypass DNS; you need to enable TLS decryption.
   • DThe policy is not applied to the correct identity; check the identity mapping.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A DLP policy is set to block uploads containing social security numbers. However, you find that some users are bypassing the policy by encrypting the data before upload. What is the best way to address this?

   • AUse CASB to block the specific cloud app that allows encryption.
   • BBlock all uploads to web applications.
   • CIncrease the sensitivity of the DLP policy.
   • DEnable TLS decryption to inspect encrypted traffic.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   You have deployed the Umbrella virtual appliance and configured DNS proxy. You notice that some clients are not using the appliance for DNS because they have hardcoded DNS settings. You cannot change the clients' configuration. What is the most effective way to ensure their DNS traffic goes through the appliance?

   • AUse firewall rules to redirect all DNS traffic to the virtual appliance.
   • BDisable the virtual appliance's DNS proxy and rely on DHCP.
   • CInstall the Umbrella roaming client on those clients.
   • DCreate a DNS policy in Umbrella that blocks the hardcoded DNS servers.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company wants to use RBI for all users, but they have a legacy application that requires browser plugins and does not work in an isolated browser. They want to exclude this application from RBI while still protecting users. What is the best approach?

   • ACreate a separate RBI policy for the legacy application with different settings.
   • BAdd the application's domain to the RBI policy's allowlist so it is not isolated.
   • CDisable RBI for all users and rely on DNS policies.
   • DUse CASB to control access to the legacy application.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   You are implementing CASB policies to control access to cloud apps. You want to allow Office 365 but block Google Drive. However, you also want to ensure that sensitive data is not uploaded to Office 365. What is the best way to achieve this?

   • AEnable RBI for Office 365 to prevent data leakage.
   • BUse DNS policies to block Google Drive and rely on the default DLP for Office 365.
   • CCreate a single CASB policy that blocks Google Drive and also blocks sensitive data uploads to all apps.
   • DCreate a CASB policy that allows Office 365 and blocks Google Drive, and also create a DLP policy that scans Office 365 uploads.
   Reveal Solution Discussion Select an answer first