Cisco UMBRELLA-SIG Practice Test

UMBRELLA-SIG practice test: what's covered

• DNS Security
• SWG
• Cloud Firewall
• CASB
• Data Loss Prevention
• Roaming Clients

Free UMBRELLA-SIG sample questions

1. A security engineer needs to block newly registered malicious domains before endpoints resolve them during a controlled production rollout. Which response is the BEST fit?

   • A. enable DNS security policies with security categories and destination lists for risky domains — with change evidence recorded
   • B. open every domain and rely only on endpoint antivirus after download — with change evidence recorded
   • C. disable recursive DNS and force all clients to use public resolvers — with change evidence recorded
   • D. use only static hosts file entries on each laptop — with change evidence recorded
   Show answer

   Correct: A. enable DNS security policies with security categories and destination lists for risky domains — with change evidence recorded is the best answer because DNS policy stops resolution of known-bad and risky categories before a connection is made. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes policy hit logs, blocked domain category, and identity mapping.

2. An administrator must block newly registered malicious domains before endpoints resolve them while investigating an urgent support case. Which action should be taken first?

   • A. enable DNS security policies with security categories and destination lists for risky domains — after confirming scope and ownership
   • B. open every domain and rely only on endpoint antivirus after download — after confirming scope and ownership
   • C. disable recursive DNS and force all clients to use public resolvers — after confirming scope and ownership
   • D. use only static hosts file entries on each laptop — after confirming scope and ownership
   Show answer

   Correct: A. enable DNS security policies with security categories and destination lists for risky domains — after confirming scope and ownership is the best answer because DNS policy stops resolution of known-bad and risky categories before a connection is made. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes policy hit logs, blocked domain category, and identity mapping.

3. A company plans to block newly registered malicious domains before endpoints resolve them during an audit-readiness review. Which design best meets the requirement?

   • A. enable DNS security policies with security categories and destination lists for risky domains — using the vendor-supported workflow
   • B. open every domain and rely only on endpoint antivirus after download — using the vendor-supported workflow
   • C. disable recursive DNS and force all clients to use public resolvers — using the vendor-supported workflow
   • D. use only static hosts file entries on each laptop — using the vendor-supported workflow
   Show answer

   Correct: A. enable DNS security policies with security categories and destination lists for risky domains — using the vendor-supported workflow is the best answer because DNS policy stops resolution of known-bad and risky categories before a connection is made. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes policy hit logs, blocked domain category, and identity mapping.

4. During troubleshooting, the team must block newly registered malicious domains before endpoints resolve them after a regional service change. Which next step is most defensible?

   • A. enable DNS security policies with security categories and destination lists for risky domains — with least privilege preserved
   • B. open every domain and rely only on endpoint antivirus after download — with least privilege preserved
   • C. disable recursive DNS and force all clients to use public resolvers — with least privilege preserved
   • D. use only static hosts file entries on each laptop — with least privilege preserved
   Show answer

   Correct: A. enable DNS security policies with security categories and destination lists for risky domains — with least privilege preserved is the best answer because DNS policy stops resolution of known-bad and risky categories before a connection is made. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes policy hit logs, blocked domain category, and identity mapping.

5. An administrator needs to block newly registered malicious domains before endpoints resolve them before approving a high-risk release. Which TWO actions provide the strongest implementation and verification? (Choose TWO)

   • A. enable DNS security policies with security categories and destination lists for risky domains — with monitoring and rollback defined
   • B. verify the result using policy hit logs, blocked domain category, and identity mapping — with monitoring and rollback defined
   • C. open every domain and rely only on endpoint antivirus after download — with monitoring and rollback defined
   • D. disable recursive DNS and force all clients to use public resolvers — with monitoring and rollback defined
   • E. use only static hosts file entries on each laptop — with monitoring and rollback defined
   Show answer

   Correct: A and B. enable DNS security policies with security categories and destination lists for risky domains — with monitoring and rollback defined and verify the result using policy hit logs, blocked domain category, and identity mapping — with monitoring and rollback defined are correct because DNS policy stops resolution of known-bad and risky categories before a connection is made. The other options are not appropriate: they weaken scope, skip a required control, or do not provide reliable evidence for this Cisco Umbrella SIG scenario.

Last updated: 2026-10-19

UMBRELLA-SIG practice test FAQ

Related practice tests

• CCIE Security Written 350-701 practice test
• CCNA 200-301 practice test
• Cisco 300-410 practice test
• CCNP ENCOR 350-401 practice test
• Cisco 100-160 practice test
• Cisco 200-201 practice test