5.4 Cloud Security CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company is deploying Cisco Umbrella to enforce DNS security for all remote users. They have installed the Umbrella virtual appliance (VA) in a DMZ and need to ensure that all internal DNS queries are forwarded to Umbrella for policy enforcement. The network team has configured the VA with a static IP and wants to minimize changes to existing DHCP settings. What should the administrator configure on the VA to achieve this?

   • AInstall the Umbrella roaming client on all endpoints to bypass the VA.
   • BConfigure the VA to act as a transparent DNS proxy by enabling IP forwarding and setting the upstream DNS to Umbrella.
   • CSet the VA as the DNS server in DHCP and enable DNS proxy forwarding to Umbrella.
   • DCreate a DNS policy in Umbrella that redirects all queries to the VA.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   After implementing a DLP policy to block social security numbers in web traffic, the security team wants to monitor incidents and ensure the policy is working. What should the administrator use to track DLP events?

   • ACheck the VA's system logs for DLP events.
   • BReview the DLP incidents in Umbrella's dashboard and alerts.
   • CUse the DNS reporting to see blocked domains.
   • DContact the users to see if they were blocked.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A multinational company is deploying Umbrella virtual appliances in multiple regional offices. Each office has its own DNS infrastructure and uses Active Directory. The security team wants to enforce consistent DNS security policies across all offices, but they also need to allow local DNS resolution for internal domains. They have limited bandwidth and want to minimize latency. What is the best approach?

   • ADeploy a VA in each office, configure DNS proxy forwarding to Umbrella, and use the same DNS policy for all offices.
   • BDeploy a single VA at the headquarters and route all DNS traffic from regional offices to it.
   • CConfigure the VAs to forward all DNS queries to Umbrella, including internal domains.
   • DUse the Umbrella roaming client on all endpoints instead of VAs.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   An administrator is troubleshooting an issue where some users are not being enforced by Umbrella's DNS policies. The VA is configured as the DNS server for the network, but some clients are still using their ISP's DNS servers. The administrator wants to ensure all DNS traffic is forwarded to Umbrella without breaking internal DNS resolution. What should the administrator do?

   • ACreate a DNS policy that blocks all DNS queries not originating from the VA.
   • BConfigure the VA to block outbound DNS traffic to other DNS servers and force all DNS queries to go through the VA.
   • CChange the DHCP settings to assign the VA as the only DNS server.
   • DDisable the VA and use the Umbrella roaming client on all endpoints.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company has multiple Umbrella DNS policies applied to different departments. The marketing department is currently allowed to access social media, but the security team wants to block social media for the finance department. The administrator needs to ensure that the finance department's policy takes precedence over any conflicting policies. What should the administrator do?

   • AApply the marketing policy to the finance department as well.
   • BCreate a new DNS policy for the finance department that blocks social media and ensure it has a higher priority than the marketing policy.
   • CModify the existing marketing policy to block social media for all users.
   • DDisable the marketing policy and create a new one for all departments.
   Reveal Solution Discussion Select an answer first