5.4 Cloud Security CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A healthcare organization needs to prevent sensitive patient data (e.g., social security numbers) from being uploaded to web applications. They want to monitor and block such uploads. What should you configure in Umbrella?

   • ACreate a DLP policy that scans web traffic for patterns like SSNs and blocks uploads.
   • BEnable RBI for all web traffic to prevent data leakage.
   • CCreate a CASB policy that blocks all web applications.
   • DUse DNS policies to block known data exfiltration domains.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   You have deployed the Umbrella virtual appliance in a data center. You notice that some internal DNS queries for internal domains are being forwarded to Umbrella, causing resolution failures. What should you do to ensure internal domains are resolved locally while external queries go to Umbrella?

   • ADisable DNS proxy on the virtual appliance.
   • BConfigure conditional forwarding on the virtual appliance to send internal domains to the internal DNS server.
   • CCreate a DNS policy in Umbrella to allow internal domains.
   • DSet the internal DNS server as the upstream resolver for all queries.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   After applying a new DNS policy to block a specific malware domain, you want to verify that the policy is actually being enforced for a particular network. What is the quickest way to confirm this?

   • AUse the Umbrella API to query the policy status.
   • BAsk users to test the domain manually.
   • CCheck the Umbrella dashboard's reporting section for DNS queries from that network.
   • DReview the virtual appliance logs for DNS queries.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company wants to use Remote Browser Isolation for users who access the internet from unmanaged devices, but they are concerned about the user experience. They want to isolate only high-risk categories like 'Malware' and 'Phishing' and allow normal browsing for other categories. What should you configure?

   • AEnable RBI for all web traffic from unmanaged devices.
   • BCreate an RBI policy that applies to the unmanaged device group and set the isolation trigger to specific security categories.
   • CUse DNS policies to block all high-risk categories instead of RBI.
   • DCreate a CASB policy to control access to cloud apps.
   Reveal Solution Discussion Select an answer first
6. 40application · medium · select all that apply

   A company is implementing CASB policies for their cloud applications. They want to enforce threat protection and data loss prevention for both sanctioned and unsanctioned cloud services. Which of the following actions should they take? (Select all that apply.)

   • AEnable RBI for all cloud apps to prevent data leakage.
   • BMonitor cloud app usage through CASB dashboards to detect shadow IT.
   • CBlock all unsanctioned cloud apps entirely.
   • DUse DLP policies to scan data being uploaded to cloud apps for sensitive information.
   • EDefine CASB policies that include threat protection features like malware scanning for cloud app traffic.
   Check answers Discussion Select an answer first