350-701 Practice Test 27 — 15 Questions

Question 1

A security team is implementing DevSecOps practices. Which TWO actions should be taken to secure secrets (e.g., API keys, passwords) in a CI/CD pipeline? (Choose two.)

Accepted Answer

Use a secrets management tool like HashiCorp Vault. Secrets should never be hardcoded in code; instead, use a secrets management tool like HashiCorp Vault or cloud-native secret stores. Also, scan for leaked secrets using tools like git-secrets.

Answer

Share secrets via email to team members

Answer

Hardcode secrets in the source code with comments to remind developers

Answer

Store secrets in environment variables in the pipeline configuration

Question 2

An organization wants to enforce MFA for all administrative access to their Azure environment and also require that access from non-compliant devices be blocked. Which Azure feature should they use?

Accepted Answer

Azure AD Conditional Access. Azure AD Conditional Access allows policies based on user, device, location, and risk to enforce MFA and block non-compliant devices.

Answer

Azure Security Center

Answer

Azure AD Privileged Identity Management

Answer

Azure Firewall

Question 3

Which Cisco Umbrella feature provides off-network protection by intercepting DNS requests on a user's device?

Accepted Answer

Umbrella Roaming Client. The Umbrella Roaming Client is installed on endpoints and redirects DNS queries to Cisco Umbrella even when the device is off the corporate network.

Answer

Secure Internet Gateway (SIG)

Answer

Cisco AnyConnect

Answer

Intelligent Proxy

Question 4

A company uses Azure AD Conditional Access policies to enforce security for cloud applications. They need to require MFA for all external users accessing a sensitive SaaS app, but only when the access is from an untrusted network. Which condition should be configured in the policy?

Accepted Answer

Configure the policy for 'Any location' and exclude 'All trusted locations'. Conditional Access can use network location conditions, such as 'All trusted locations' or 'Any location'. To enforce MFA only from untrusted networks, the policy should target 'Any location' and exclude 'All trusted locations'. The other options are less precise.

Answer

Use device compliance condition

Answer

Use risk-based conditional access

Answer

Configure the policy for 'All locations'

Question 5

In a DevSecOps pipeline, which tool would be used to scan Infrastructure as Code (IaC) templates for security misconfigurations?

Accepted Answer

Checkov. Checkov is an open-source tool that scans Terraform, CloudFormation, and other IaC templates for security issues.

Answer

SAST tool

Answer

Container image scanner

Answer

DAST tool

Question 6

A Cisco WSA administrator wants to block access to social media sites for all users during work hours. The proxy is deployed in explicit mode. Which policy type should the administrator use to enforce this restriction?

Accepted Answer

Access policy. In explicit proxy mode, the WSA uses access policies to control web traffic based on URL categories. The administrator should create an access policy that identifies social media traffic and sets the action to 'Block'.

Answer

Identity policy

Answer

Routing policy

Answer

Decryption policy

Question 7

A security team wants to inspect SSL-encrypted traffic from users accessing SaaS applications through Cisco Umbrella. Which feature should they enable?

Accepted Answer

Intelligent Proxy. Intelligent Proxy allows selective SSL inspection based on policies.

Answer

Roaming client

Answer

DNS-layer blocking

Answer

SIG cloud firewall

Question 8

An organization is adopting zero trust principles for cloud access. Which THREE measures are essential for implementing identity-centric security? (Choose three.)

Accepted Answer

Conditional access policies based on user, device, and location. Zero trust relies on strong identity verification: MFA, privileged identity management (PIM) for just-in-time access, and conditional access policies that enforce context-based controls. VPN and network segmentation are network-centric, not identity-centric.

Answer

Site-to-site VPN for connectivity

Answer

Network segmentation using VLANs

Question 9

An organization uses Cisco Umbrella to block malicious domains. The security team notices that some malware traffic bypasses DNS-layer blocking because the malware uses hardcoded IP addresses. Which Umbrella feature should be enabled to additionally inspect traffic at the IP layer?

Accepted Answer

Secure Internet Gateway (SIG). Cisco Umbrella's Secure Internet Gateway (SIG) provides cloud-delivered firewall and web proxy that can inspect IP-based traffic, not just DNS.

Answer

Intelligent Proxy

Answer

DNS-layer security

Answer

Umbrella Roaming Client

Question 10

An organization uses Cisco Umbrella to block malicious domains. Which layer does Umbrella primarily operate at to prevent connections before they are established?

Accepted Answer

DNS layer. Cisco Umbrella operates at the DNS layer to block requests to malicious domains before any connection is made.

Answer

Network layer (IP filtering)

Answer

Application layer

Answer

Transport layer

Question 11

In a DevSecOps pipeline, a team wants to prevent secrets (e.g., API keys) from being stored in source code. Which approach is most effective?

Accepted Answer

Use a secrets management tool like Vault. Using a secrets management tool like HashiCorp Vault ensures secrets are stored securely and not in code.

Answer

Store secrets in environment variables

Answer

Use container image scanning

Answer

Encrypt secrets in code

Question 12

An organization wants to enforce a policy that blocks outbound emails containing Social Security numbers. Which feature of Cisco ESA should be configured?

Accepted Answer

DLP Policies. DLP policies on Cisco ESA scan outbound email for sensitive data patterns like SSNs.

Answer

Anti-Spam

Answer

AMP for Email

Answer

Outbreak Filters

Question 13

Which Cisco email security feature uses SHA-256 hash lookups to detect known malware in email attachments?

Accepted Answer

AMP for Email. Cisco AMP for Email uses SHA-256 hashing to compare file hashes against a cloud database of known malware. If a match is found, the email is blocked or quarantined.

Answer

Outbreak filters

Answer

Anti-spam

Answer

DLP policies

Question 14

An organization wants to prevent employees from accessing social media websites during work hours. Which Cisco WSA feature should be used to enforce this policy?

Accepted Answer

URL filtering. Cisco WSA URL filtering uses categories (e.g., social media) to allow or block access based on policy.

Answer

SSL/TLS decryption

Answer

AMP file scanning

Answer

AVC (Application Visibility and Control)

Question 15

A security engineer is configuring Cisco WSA in explicit proxy mode. Which traffic interception method is being used when each endpoint browser is configured with the proxy address?

Accepted Answer

Explicit proxy. Explicit proxy requires manual browser configuration; transparent proxy uses WCCP or PBR.

Answer

WCCP redirect

Answer

Policy-Based Routing

Answer

Transparent proxy