5.4 Cloud Security CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A DLP policy is blocking uploads of files containing credit card numbers. However, you receive complaints that legitimate files with similar patterns are being blocked. You want to reduce false positives without weakening the policy. What should you do?

   • ADisable the DLP policy and rely on user training.
   • BIncrease the sensitivity level to catch more data.
   • CAdjust the DLP policy's confidence threshold or use custom regex patterns.
   • DBlock all uploads to reduce risk.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company wants to block access to known malware domains for all users in the 'Sales' network, but allow access to social media for the 'Marketing' network. Both networks are configured as identities in Umbrella. What should you do to enforce this requirement?

   • ACreate a single DNS policy that blocks malware domains and apply it to both networks.
   • BApply the malware block policy to the Sales network and rely on the default policy for Marketing.
   • CCreate two DNS policies: one blocking malware for Sales, and one allowing social media for Marketing.
   • DUse the same policy but change the identity to 'All Networks' and then override per network.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   You have multiple Umbrella virtual appliances deployed in different regions. You want to ensure that DNS policies are consistent across all regions, but you also need to allow local administrators to make temporary exceptions for local issues. What is the best way to manage this?

   • ACreate separate policies for each region and manage them independently.
   • BUse a single global policy and allow local admins to create temporary overrides that expire automatically.
   • CDisable local admin access to Umbrella to ensure consistency.
   • DUse the Umbrella API to synchronize policies across regions.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A financial firm wants to protect its employees from web-based threats when they browse the internet. They want to ensure that any website visited is rendered in a secure remote browser, but they also want to allow normal browsing for most users to avoid performance impact. What is the best way to achieve this?

   • AUse DNS policies to block all web traffic except for a few allowlisted sites.
   • BCreate an RBI policy that applies only to high-risk users or specific categories like 'Newly Registered Domains'.
   • CInstall a web proxy and configure it to use RBI for all traffic.
   • DEnable Remote Browser Isolation for all users globally.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An organization wants to discover which cloud applications employees are using and control access to them. They have a list of sanctioned apps like Office 365 and want to block unsanctioned file-sharing services. What should you configure in Umbrella?

   • AEnable RBI for all cloud apps.
   • BCreate a CASB policy that allows sanctioned apps and blocks unsanctioned ones.
   • CUse DNS policies to block all cloud app domains.
   • DConfigure DLP policies to scan cloud traffic.
   Reveal Solution Discussion Select an answer first