350-701 Practice Test 26 — 15 Questions

Question 1

A security team wants to gain visibility into shadow IT usage of cloud applications and enforce data loss prevention policies. Which cloud security control should they deploy?

Accepted Answer

CASB. CASB provides visibility, DLP, and threat detection for sanctioned and unsanctioned cloud apps.

Answer

Cloud WAF

Answer

CWPP

Answer

CSPM

Question 2

A security team is implementing CSPM to ensure cloud compliance. Which three checks would a CSPM tool typically perform? (Choose three.)

Accepted Answer

Verifying that EBS volumes are encrypted. CSPM checks cloud configurations against benchmarks like CIS, including public access to storage, encryption settings, and IAM policies.

Answer

Monitoring user behavior analytics

Answer

Scanning container images for vulnerabilities

Question 3

A security team wants to enforce data loss prevention (DLP) policies across multiple sanctioned cloud applications used by employees. Which cloud security solution is best suited for this task?

Accepted Answer

CASB (Cloud Access Security Broker). A Cloud Access Security Broker (CASB) provides visibility into SaaS usage and can enforce DLP policies across cloud applications.

Answer

CWPP (Cloud Workload Protection Platform)

Answer

Cisco Umbrella SIG

Answer

CSPM (Cloud Security Posture Management)

Question 4

In the shared responsibility model for cloud services, which layer is the customer responsible for managing in an IaaS environment?

Accepted Answer

Operating system, applications, and data. In IaaS, the cloud provider manages the physical infrastructure, while the customer manages the OS, applications, and data.

Answer

Virtual machines and storage only

Answer

Only data and access policies

Answer

Physical servers and networking

Question 5

An organization uses AWS WAF to protect its web application. They need to block requests from a specific geographic region. What should they configure?

Accepted Answer

AWS WAF geo match rule. AWS WAF allows creating rules based on geographic location (geo match) to allow or block requests from specific countries.

Answer

CloudFront geo restriction

Answer

Security group with IP-based deny rule

Answer

Network ACL with IP deny rule

Question 6

An organization using Cisco WSA in transparent proxy mode with WCCP redirect notices that some HTTPS traffic is not being decrypted for inspection. The administrator has enabled SSL decryption but certain traffic still bypasses. What is the most likely cause?

Accepted Answer

The SSL decryption policy is not set to decrypt on port 443. In transparent proxy mode, SSL decryption requires that the WSA is positioned in the traffic path (e.g., via WCCP). If decryption is not happening, the WSA may not be intercepting the traffic correctly, often due to the destination port not being included in the decryption policy or the traffic being non-HTTP.

Answer

The clients are not configured to use a proxy

Answer

The web server certificate is self-signed

Answer

The WSA is operating in explicit proxy mode

Question 7

A security team wants to gain visibility into shadow IT usage of SaaS applications and enforce DLP policies for data shared via cloud apps. Which cloud security solution should they deploy?

Accepted Answer

Cloud Access Security Broker (CASB). A CASB provides visibility, DLP, and threat detection for SaaS applications, helping control shadow IT and protect data.

Answer

Cisco Umbrella Secure Internet Gateway (SIG)

Answer

Cloud Security Posture Management (CSPM)

Answer

Cloud Workload Protection Platform (CWPP)

Question 8

A security engineer is configuring Cisco Umbrella to enforce web security for remote users. The requirement is to block threats by intercepting DNS requests and only perform SSL decryption on specific high-risk categories. Which Umbrella feature should be used for selective SSL inspection?

Accepted Answer

Intelligent Proxy. Cisco Umbrella's Intelligent Proxy can selectively proxy traffic (including SSL inspection) based on categories, URL groups, or other policies. The roaming client enables off-network protection but does not handle selective SSL inspection. SIG includes firewall and proxy but selective inspection is via Intelligent Proxy.

Answer

DNS-layer security

Answer

Secure Internet Gateway (SIG)

Answer

Umbrella Roaming Client

Question 9

A company is deploying Cisco Umbrella with the Intelligent Proxy feature. Under what condition does the Intelligent Proxy perform SSL decryption?

Accepted Answer

Only for traffic to websites with low reputation or in high-risk categories. Intelligent Proxy selectively decrypts SSL traffic for high-risk categories or domains, based on policy, to inspect content while preserving user privacy for safe sites.

Answer

For all web traffic from the roaming client

Answer

Only for traffic using non-standard ports

Answer

Only when the user is on-network

Question 10

A security architect is designing a zero-trust model for cloud access. Which of the following is a core principle of zero trust in the cloud?

Accepted Answer

Identity is the new perimeter. Zero trust assumes no implicit trust and requires identity verification for every access request, using identity as the primary perimeter.

Answer

All traffic must be inspected by a next-generation firewall

Answer

Network segmentation is the primary security control

Answer

VPNs are required for all cloud access

Question 11

An organization is using Cisco Firepower NGFW to enforce content filtering. They want to block social media applications like Facebook and Twitter but allow LinkedIn for business purposes. Which feature should be used to differentiate between these applications?

Accepted Answer

Application control with application filters. Firepower NGFW uses application control to identify and block specific applications. By creating a rule that blocks the 'Social Networking' category but then allows 'LinkedIn' specifically (or blocks Facebook and Twitter by application), the administrator can achieve granular control.

Answer

URL filtering based on categories

Answer

Intrusion policy

Answer

TLS server identity discovery

Question 12

In the shared responsibility model for PaaS, which component is the customer responsible for managing?

Accepted Answer

Data and applications. In PaaS, the customer manages applications and data, while the provider manages the runtime, infrastructure, and OS.

Answer

Network infrastructure

Answer

Hypervisor

Answer

Operating system

Question 13

Which of the following is the primary function of a Cloud Security Posture Management (CSPM) tool?

Accepted Answer

Monitor and remediate cloud misconfigurations against benchmarks. CSPM tools continuously monitor cloud infrastructure for compliance with security best practices and benchmarks (e.g., CIS). They identify misconfigurations but do not typically enforce DLP, block threats, or protect workloads directly.

Answer

Block malicious domains at the DNS layer

Answer

Protect workloads from malware

Answer

Provide DLP for SaaS applications

Question 14

An organization is adopting zero trust principles for cloud access. Which THREE components should be implemented to enforce identity as the new perimeter?

Accepted Answer

Multi-Factor Authentication (MFA) for all cloud access. MFA ensures strong authentication, PIM manages privileged access, and conditional access policies enforce context-based controls.

Answer

Network segmentation via VLANs

Answer

Firewall rules based on source IP

Question 15

An organization uses Azure for its cloud workloads. To protect web applications from common exploits like SQL injection and cross-site scripting, they need to deploy a web application firewall (WAF) that integrates with Azure Application Gateway. Which Azure WAF SKU should they choose?

Accepted Answer

Azure Application Gateway WAF_v2. Azure WAF can be deployed with Application Gateway (WAF_v2 SKU) or Front Door. The WAF_v2 SKU of Application Gateway provides integrated WAF capabilities.

Answer

Azure Firewall Premium

Answer

Azure DDoS Protection

Answer

Azure WAF on Azure Front Door