Cisco 300-740: Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT) v2.0

Last checked November 10, 2026 against the official Cisco exam page.

1. Question 1Policies

   A company stores customer records in cloud object storage. Its security standard requires that the data stay unreadable if the underlying storage media is physically stolen. Which control meets this requirement?

   1. AHTTPS redirects that send all browser requests to the storage endpoint over port 443
   2. BEncryption of stored objects with keys managed through a key management service
   3. CTLS encryption that protects records while they travel between client applications and the storage service
   4. DAn IP allow list that restricts which source addresses can connect to the storage service
   Show answer and explanationHide answer

   Correct answer: B

   Encryption at rest protects stored data, so keys managed by a key management service keep the objects unreadable even if the media leaves the provider's control. TLS protects data in transit, while HTTPS redirects and IP allow lists control transport and access but do not encrypt stored data.

2. Question 2Access

   A user clicks a link in an email that points to a domain registered only days ago and linked to phishing. The organization wants the connection stopped before any page content is loaded. Which control provides the earliest protection?

   1. ADNS-layer security that refuses to resolve domains known to be malicious
   2. BFull packet capture of the user's browsing sessions retained for later investigation
   3. CTwo-factor authentication on the user's email account to prevent credential theft
   4. DEndpoint antivirus that scans the web page content after the browser has loaded it
   Show answer and explanationHide answer

   Correct answer: A

   DNS-layer security blocks the name lookup before any connection to the malicious host is made, which stops the page before it loads. Antivirus scanning happens after content arrives, packet capture only records traffic, and MFA protects the email account rather than blocking the destination.

3. Question 3Identity

   A company configures single sign-on to a SaaS application using SAML. When the application receives an authentication assertion, what does it use to confirm the assertion really came from the trusted identity provider?

   1. AThe user's password, which the application stores in hashed form and compares against the value entered during each login attempt
   2. BA static API key that the application generated for each user when the account was first created during onboarding
   3. CThe identity provider's digital signature on the assertion, checked against the trusted certificate
   4. DThe client's source IP address, which the application records at login and checks during each later request
   Show answer and explanationHide answer

   Correct answer: C

   SAML assertions are signed by the identity provider, and the service provider validates that signature with the IdP certificate exchanged during trust setup. In SAML SSO the password is not sent to the SaaS application, and static keys or IP address checks are not how SAML establishes trust.

4. Question 4Concepts

   Which statement best reflects the core principle of zero trust as described in NIST SP 800-207?

   1. AUsers on the corporate network are granted broad access because the perimeter has already been secured against outside threats.
   2. BTrust is never implied by network location, so each access request is evaluated before access is granted.
   3. CAccess rights are established once at login and stay valid for the whole working day unless the password changes.
   4. DDevices listed on the managed asset inventory are trusted automatically, because their configuration was checked when they were added.
   Show answer and explanationHide answer

   Correct answer: B

   NIST SP 800-207 assumes no implicit trust based on location or ownership, and each request is authenticated and authorized against policy. The perimeter model and one-time login model describe the legacy approach zero trust replaces, and inventory membership alone does not establish trust.

5. Question 5Operations

   A breach in a cloud application tier spread to database servers that share the same subnet. Which control best limits east-west movement between these workloads?

   1. AA single flat subnet for all workloads, which simplifies routing and firewall rules
   2. BDisabled flow logging on the database servers so that east-west traffic generates less noise
   3. COpen ports between all tiers so that application teams can troubleshoot connectivity faster
   4. DMicrosegmentation policies that permit only required flows between workload groups
   Show answer and explanationHide answer

   Correct answer: D

   Microsegmentation enforces allow lists between workload groups, so a compromised workload cannot reach others it has no need to contact. A flat subnet, disabled logging, and open ports all increase lateral movement or reduce visibility.