Cloud Security

A company is moving its on-premises applications to AWS EC2 instances. According to the shared responsibility model, which of the following is the customer's responsibility?

An organization uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which cloud security solution should be deployed?

An organization wants to implement zero trust principles for cloud access. Which of the following is a key component of a zero trust architecture in the cloud?

Which of the following is the primary function of a Cloud Security Posture Management (CSPM) tool?

A company uses Cisco Umbrella to provide DNS-layer security. An employee tries to visit a website that is hosting malware, but the domain is not yet categorized. How does Umbrella handle this request?

An organization is deploying containerized applications in a Kubernetes cluster on AWS EKS. They need to ensure that container images are scanned for vulnerabilities before deployment. Which approach aligns with DevSecOps best practices?

A security team is implementing AWS WAF to protect a web application. They want to block requests that contain SQL injection patterns in the query string. Which AWS WAF component should be used?

In the shared responsibility model for PaaS, which of the following is typically the customer's responsibility?

A DevSecOps team is implementing secrets management for a cloud-native application. They want to avoid storing secrets in environment variables or code. Which solution should they use?

An organization is adopting zero trust principles for cloud access. Which THREE measures are essential for implementing identity-centric security? (Choose three.)

A company is using Azure and wants to enforce security compliance across their cloud resources. Which TWO services are part of CSPM (Cloud Security Posture Management) in Azure? (Choose two.)

In the shared responsibility model for cloud services, which layer is the customer responsible for managing in an IaaS environment?

A security team wants to gain visibility into Shadow IT usage of SaaS applications and enforce data loss prevention policies. Which cloud security solution should they deploy?

An organization uses Cisco Umbrella to block malicious domains. Which layer does Umbrella primarily operate at to prevent connections before they are established?

A company wants to ensure that no cloud workload has a public IP address attached to a network security policy that allows inbound SSH from the entire internet. Which Cisco security product can continuously monitor and alert on such misconfigurations?

A DevSecOps team is integrating security into their CI/CD pipeline. They want to scan Terraform configuration files for misconfigurations before deployment. Which tool is specifically designed for that purpose?

In the shared responsibility model for PaaS, which of the following is the customer responsible for?

An organization uses Cisco Umbrella's Secure Internet Gateway (SIG). Which of the following sets of capabilities is typically included in a SIG solution?

A cloud security architect is designing zero trust for a multi-cloud environment. Which principle is most critical?

A security team wants to inspect SSL-encrypted traffic from users accessing SaaS applications through Cisco Umbrella. Which feature should they enable?

Which cloud security control is specifically designed to protect workloads such as VMs and containers from threats?

A company uses Azure and wants to restrict network traffic between subnets. Which Azure resource should they use?

In a DevSecOps pipeline, a team wants to prevent secrets (e.g., API keys) from being stored in source code. Which approach is most effective?

In the shared responsibility model for cloud security, which responsibility is the customer's in an IaaS deployment?

A security team wants to gain visibility into shadow IT usage of SaaS applications and enforce DLP policies for data shared via cloud apps. Which cloud security solution should they deploy?

An organization uses Cisco Umbrella to block malicious domains. The security team notices that some malware traffic bypasses DNS-layer blocking because the malware uses hardcoded IP addresses. Which Umbrella feature should be enabled to additionally inspect traffic at the IP layer?

A DevOps team is building a CI/CD pipeline for a cloud-native application. They want to automatically check Terraform scripts for insecure configurations before deployment. Which tool should be integrated into the pipeline?

An organization is adopting a zero-trust model for cloud access. Which component enforces conditional access policies based on user, device, location, and risk level in Azure AD?

In the shared responsibility model, which is the customer's responsibility in a SaaS model?

Which Cisco Umbrella feature provides off-network protection by intercepting DNS requests on a user's device?

A security engineer is configuring Cisco Umbrella to block HTTPS traffic to malicious sites. However, they want to inspect SSL-encrypted traffic selectively to avoid breaking applications. Which Umbrella feature should they use?

A company is moving workloads to Google Cloud and needs private connectivity between its on-premises data center and VPC without traversing the internet. Which service should be used?

A security team is implementing DevSecOps practices. Which TWO actions should be taken to secure secrets (e.g., API keys, passwords) in a CI/CD pipeline? (Choose two.)

A company is adopting a zero-trust security model for its cloud environment. Which THREE practices align with zero-trust principles? (Choose three.)

A security engineer is designing cloud workload protection (CWPP) for a hybrid environment with VMs and containers. Which TWO capabilities should a CWPP solution provide? (Choose two.)

In the shared responsibility model for cloud computing, which responsibility is managed by the customer in all service models (IaaS, PaaS, SaaS)?

A security administrator wants to enforce a policy that blocks upload of sensitive data to unauthorized cloud applications. Which technology should be used to gain visibility and control over sanctioned and unsanctioned SaaS applications?

An organization uses Cisco Umbrella to protect remote users. The security team notices that some malicious domains are not blocked because users are bypassing the DNS layer by using direct IP connections or non-DNS protocols. Which Cisco Umbrella feature should be enabled to inspect all traffic, including non-web traffic, and enforce policies regardless of DNS resolution?

A company is deploying workloads in AWS and wants to ensure that the security groups are not overly permissive. They need to continuously monitor for misconfigurations and compare against the CIS AWS Foundations Benchmark. Which tool should be used?

To enforce zero trust principles in a cloud environment, an administrator requires all access to cloud resources to be authenticated and authorized based on user identity and device health. Which Cisco Duo feature enables policies that consider conditions such as location, device compliance, and risk level?

In a DevSecOps pipeline, a security engineer wants to automatically scan Infrastructure as Code (IaC) templates for security misconfigurations before deployment. Which tool is commonly used for static analysis of Terraform templates?

A security team is implementing secure access for remote users connecting from untrusted networks. They want to enforce DNS-layer security even when users are off the corporate network. Which Cisco Umbrella feature should be deployed on the endpoints?

In the shared responsibility model for PaaS, which component is the customer responsible for managing?

A company uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which technology provides the ability to scan data in transit and at rest within these SaaS applications?

A security engineer is configuring Cisco Umbrella Intelligent Proxy to selectively decrypt and inspect HTTPS traffic. The goal is to balance security and user privacy by only inspecting traffic to high-risk domains. How does Intelligent Proxy decide which traffic to inspect?

A security team is implementing a DevSecOps pipeline for containerized applications. Which TWO of the following practices should be included to ensure container security?

An organization is adopting zero trust principles for cloud access. Which THREE components should be implemented to enforce identity as the new perimeter?

A company uses AWS and Azure and wants to protect its cloud workloads (VMs and containers) from threats. Which TWO technologies are specifically designed for workload protection in the cloud?

In the shared responsibility model for cloud security, which of the following is the customer responsible for in an IaaS deployment?

A company is using a SaaS application like Office 365. Which security responsibility falls on the customer according to the shared responsibility model?

A security team wants to gain visibility into shadow IT usage of cloud applications and enforce data loss prevention policies. Which cloud security control should they deploy?

An organization uses Cisco Umbrella to block malicious domains. What is the primary security benefit of DNS-layer security?

A company is deploying Cisco Umbrella with the Intelligent Proxy feature. Under what condition does the Intelligent Proxy perform SSL decryption?

In AWS, which resource acts as a stateful firewall at the instance level to control inbound and outbound traffic?

A security architect is designing a zero-trust model for cloud access. Which of the following is a core principle of zero trust in the cloud?

In a DevSecOps pipeline, which tool would be used to scan Infrastructure as Code (IaC) templates for security misconfigurations?

A security engineer needs to prevent secrets (e.g., API keys) from being stored in code repositories. Which DevSecOps practice should be implemented?

Which cloud workload protection platform (CWPP) capability is essential for protecting containerized applications?

A security team is implementing CSPM to ensure cloud compliance. Which three checks would a CSPM tool typically perform? (Choose three.)

Which two controls are considered part of a zero-trust architecture for cloud access? (Choose two.)

A company uses a SaaS application for customer relationship management. In the cloud shared responsibility model, which security controls are the customer's primary responsibility?

A security team wants to enforce data loss prevention (DLP) policies across multiple sanctioned cloud applications used by employees. Which cloud security solution is best suited for this task?

A company uses Cisco Umbrella to protect remote users. They want to ensure that SSL-encrypted traffic to malicious websites is inspected, but without breaking compliance with privacy regulations. Which Umbrella feature should they enable?

A cloud engineer is deploying a web application on AWS and needs to control inbound and outbound traffic at both the instance and subnet levels. Which two AWS security controls should they configure? (Select two.)

A DevSecOps team is integrating security into their CI/CD pipeline. They want to scan infrastructure-as-code templates for misconfigurations and container images for vulnerabilities. Which two tools are appropriate? (Select two.)

An organization is adopting a zero trust model for cloud access. Which three principles should be implemented? (Select three.)

A security architect at a financial services firm is deploying a new multi-tier web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer and stores sensitive customer data in an Amazon RDS database. The security team wants to block common web exploits such as SQL injection and cross-site scripting at the edge before traffic reaches the EC2 instances, and they want to use a managed AWS service that integrates with AWS WAF. Which AWS service should the architect use to provide this protection?

A security architect at a financial services company is deploying a new multi-tenant SaaS application on AWS. The application must encrypt sensitive customer data at rest using keys that the company generates and manages, but the company does not want to manage the underlying hardware security modules (HSMs). Which AWS service should be used to meet these requirements?

A security team is using Cisco Umbrella to protect users accessing cloud applications. They want to enforce a policy that blocks access to unsanctioned cloud applications while allowing sanctioned ones, and they need to identify which cloud applications are in use. Which Cisco Umbrella feature should they use?

A security architect is designing a cloud environment on Microsoft Azure and needs to protect outbound traffic from virtual machines to the internet. The organization requires that all outbound traffic be inspected by a next-generation firewall, even when the traffic is destined for arbitrary internet IP addresses. Which Azure-native solution should the architect implement?

A security engineer is configuring Cisco Umbrella to enforce security policies for a remote workforce. The company wants to block access to newly seen domains that are less than 24 hours old, as these are often used in malicious campaigns. Which Umbrella feature should the engineer enable to achieve this?

A cloud security team is using Amazon GuardDuty to monitor their AWS environment. They receive a finding indicating that an EC2 instance is communicating with a known cryptocurrency mining pool. Which action should the team take to automatically remediate this finding?

A security administrator is implementing Cisco Cloudlock to protect data in a SaaS environment. The organization wants to detect and respond to sensitive data exposure in sanctioned cloud applications. Which TWO capabilities does Cisco Cloudlock provide to achieve this? (Choose two.)

A security architect is designing a multi-account AWS environment for a financial services company. The company requires that all API activity across every account be centrally logged, retained for seven years, and protected from modification even by account administrators. Which combination of AWS services should the architect implement to meet these requirements?

A company is migrating its on-premises web application to Google Cloud Platform (GCP). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting. They also want to leverage Google's infrastructure for scaling and DDoS protection. Which GCP service should they implement?

A cloud security engineer is configuring Cisco Umbrella to protect a branch office. The company wants to block access to known malicious domains and also wants visibility into which internal user or device made each request. The branch uses a Cisco router as the DNS forwarder for all endpoints. Which Umbrella component and configuration should the engineer deploy?

A security team is deploying a multi-tier web application on AWS. They need to continuously monitor for misconfigured S3 buckets and overly permissive IAM policies, and receive alerts when deviations occur. Which Cisco solution should they implement to achieve this?

A company is migrating its on-premises web application to AWS. The security team must ensure that only HTTP and HTTPS traffic from the internet reaches the application, while all other inbound ports are blocked. Which AWS feature should they configure to meet this requirement?

A security team is evaluating Cisco Cloudlock to protect data stored in SaaS applications such as Microsoft 365 and Google Workspace. The team wants to understand which capabilities Cloudlock provides natively. (Choose two.)

A security architect is designing a multi-cloud environment that includes AWS, Azure, and on-premises VMware vSphere. The organization wants a single, consistent security policy to be enforced across all workload locations, including east-west traffic between virtual machines. Which Cisco solution should the architect deploy to meet this requirement?

A security architect is deploying a multicloud environment that spans AWS, Azure, and GCP. The organization requires a centralized, agentless solution that discovers all workloads, detects misconfigurations against CIS benchmarks, and provides a unified compliance dashboard across all three providers. Which Cisco solution best meets these requirements?

A security architect is designing a solution to protect user access to SaaS applications. The organization wants to enforce data loss prevention policies, detect anomalous user behavior, and provide granular visibility into sanctioned and unsanctioned cloud apps. Which Cisco technology should be deployed?

A security team is using Cisco Umbrella to protect users who access cloud applications. They want to enforce a policy that prevents users from uploading files containing credit card numbers to any unsanctioned cloud storage service, while still allowing uploads to approved services. Which Cisco Umbrella capability should they configure?

A security architect is designing a cloud access security broker (CASB) deployment for a company that uses Microsoft 365 and Salesforce. The company wants to apply data loss prevention (DLP) policies to data at rest within these SaaS applications without installing endpoint agents, and it wants to maintain full visibility into which users are sharing files externally. Which CASB deployment mode should the architect choose?

A company is migrating its customer-facing web application to Microsoft Azure. The security team must ensure that only HTTP and HTTPS traffic reaches the web tier from the internet and that no other inbound ports are exposed. Which Azure feature should they configure?

A financial services company uses Cisco Umbrella to protect users accessing SaaS applications. The security team needs to block uploads of files containing personally identifiable information (PII) to unsanctioned cloud storage services while allowing uploads to approved services. Which Cisco Umbrella capability should be configured?

A security operations team uses Cisco Secure Workload to protect a Kubernetes cluster running on Amazon EKS. They need to ensure that only approved container images are allowed to run, and that any attempt to run an unapproved image is blocked before the pod starts. Which Cisco Secure Workload capability should they implement?

A security team is implementing a cloud access security broker (CASB) solution to gain visibility and control over SaaS application usage. Which two deployment modes are commonly supported by Cisco Cloudlock? (Choose two.)

A security operations team is using Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) to monitor a hybrid cloud environment. They want to detect threats such as cryptomining and data exfiltration across AWS, Azure, and on-premises networks without deploying agents on every workload. Which statement describes how Cisco Secure Cloud Analytics achieves this?

A company is migrating its on-premises web application to AWS. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also mitigate distributed denial-of-service (DDoS) attacks at the application layer. Which AWS service should they use in conjunction with AWS Shield?

A cloud operations team is deploying a multi-tier application in Microsoft Azure. The security team wants to ensure that only HTTP and HTTPS traffic from the internet can reach the web tier, while the database tier should accept connections only from the web tier. They also want to log allowed and denied flows for auditing. Which Azure feature should they configure to meet these requirements?

A security team is evaluating Cisco Cloudlock to protect data in a sanctioned SaaS environment. They want to understand which capabilities Cisco Cloudlock provides for data security in cloud applications. (Choose two.)

A security team is deploying a web application in a public cloud. They need to protect it from common web exploits like SQL injection and cross-site scripting, and also mitigate bot attacks. Which Cisco cloud security solution provides these capabilities with minimal configuration and integrates with cloud-native load balancers?

A security engineer is reviewing the shared responsibility model for a company that is using a SaaS-based email service. The company wants to understand which security controls they are responsible for managing. According to the shared responsibility model, which area is the customer's responsibility in a SaaS deployment?