350-701 Cloud Security Practice Test 2 — 15 Questions

Question 1

A company is deploying a cloud-native application using microservices on AWS. They need to ensure that inter-service communication is encrypted and authenticated. The security team wants to use mutual TLS (mTLS) without managing individual certificates. Which solution should they implement?

Accepted Answer

Use AWS Certificate Manager Private CA with a service mesh (e.g., Istio) to issue and rotate certificates for each service.. Option D is correct because AWS Certificate Manager Private CA can integrate with a service mesh like Istio to automatically issue, distribute, and rotate mTLS certificates for each microservice. This eliminates the need for manual certificate management while ensuring encrypted and authenticated inter-service communication via mutual TLS.

Answer

Use AWS IAM roles for each microservice to authenticate via AWS Signature Version 4.

Answer

Store certificates in AWS Secrets Manager and configure sidecar proxies to retrieve them.

Answer

Deploy AWS CloudHSM to generate keys and certificates for each microservice.

Question 2

A multinational corporation is migrating its on-premises data center to a public cloud provider. The security policy requires that all traffic between cloud VPCs and the on-premises network must be inspected by a next-generation firewall (NGFW) deployed in the cloud. The on-premises network uses BGP for dynamic routing. Which design meets the requirement while minimizing latency and administrative overhead?

Accepted Answer

Deploy a transit VPC with an NGFW instance and configure BGP dynamic routing between the transit VPC, other VPCs, and the on-premises network.. Option A is correct because a transit VPC with an NGFW instance allows centralized traffic inspection while using BGP dynamic routing to exchange routes between the transit VPC, other VPCs, and the on-premises network. This design minimizes administrative overhead by avoiding static route management and reduces latency by keeping inspection within the cloud, rather than hair-pinning traffic on-premises. BGP enables automatic failover and route propagation, meeting the dynamic routing requirement.

Answer

Use AWS Transit Gateway with static routes pointing to the NGFW instance for inspection.

Answer

Create a site-to-site VPN between each VPC and the on-premises network, and configure the NGFW on-premises.

Answer

Use AWS Direct Connect to connect all VPCs to the on-premises network and place the NGFW on-premises.

Question 3

A security engineer is configuring a cloud access security broker (CASB) to protect a SaaS application used by employees. The primary concern is to prevent sensitive data from being uploaded to the application. Which deployment mode should the engineer choose?

Accepted Answer

API-based mode, which connects directly to the SaaS application's APIs to scan and block sensitive data.. Option B is correct because API-based mode connects directly to the SaaS application's APIs, allowing the CASB to scan data at rest and in transit using the application's native APIs (e.g., REST or Graph APIs). This mode can block uploads by enforcing data loss prevention (DLP) policies directly within the SaaS application, without requiring traffic redirection or proxy configuration. It is the most effective deployment mode for preventing sensitive data from being uploaded, as it can inspect and block data at the point of storage.

Answer

Forward proxy mode, which intercepts user traffic and inspects it before it reaches the SaaS application.

Answer

Reverse proxy mode, which sits in front of the SaaS application and inspects incoming traffic.

Answer

Web application firewall (WAF) mode, which filters HTTP traffic to the application.

Question 4

An organization uses Cisco Umbrella for DNS-layer security. They want to block access to a newly discovered malicious domain (malware.example.com) immediately. Which action should the administrator take in the Umbrella dashboard?

Accepted Answer

Add the domain to the 'Block List' under the policy's 'Destination Lists'.. Option C is correct because in Cisco Umbrella, the most immediate way to block a specific malicious domain is to add it to the 'Block List' under the policy's 'Destination Lists'. This list is evaluated in real-time for DNS queries, allowing the administrator to enforce the block without waiting for threat intelligence updates or affecting other policies.

Answer

Add the domain to the 'Global Block List' under 'Managed Networks'.

Answer

Add the domain to the 'Temporary Block List' under 'Security Settings'.

Answer

Add the domain to the 'IP Layer Enforcement' list.

Question 5

A company is implementing a cloud security posture management (CSPM) solution. Which TWO of the following are primary functions of CSPM?

Accepted Answer

Detection and remediation of cloud resource misconfigurations (e.g., open S3 buckets).. CSPM is designed to detect and remediate cloud resource misconfigurations, such as publicly accessible S3 buckets, which are a leading cause of data breaches. It continuously assesses cloud infrastructure against security best practices and compliance frameworks like CIS and PCI DSS. Unlike network-based tools, CSPM focuses on the configuration state of cloud resources rather than inspecting traffic or managing identities.

Answer

Real-time inspection of network traffic for malicious patterns.

Answer

Vulnerability scanning of virtual machine operating systems.

Answer

Managing user identities and access permissions.

Question 6

An enterprise is migrating a critical application to AWS. The architecture includes an Application Load Balancer (ALB) in front of EC2 instances across multiple Availability Zones. The application must be protected against common web exploits such as SQL injection and cross-site scripting. The security team decides to use AWS WAF. They also need to ensure that only traffic from the company's corporate IP range (203.0.113.0/24) is allowed to reach the application, except for a partner integration that requires access from a specific IP (198.51.100.5). Additionally, all traffic must be inspected by a third-party NGFW for advanced threat detection. The NGFW is deployed in a separate VPC connected via VPC Peering. The current configuration: ALB is internet-facing, WAF is associated with the ALB, and the NGFW is not in the traffic path. After deployment, traffic from corporate users is not being inspected by the NGFW, and partner traffic is being blocked. What is the most efficient solution to meet all requirements?

Accepted Answer

Change the ALB scheme to internal, update DNS to point to the NGFW's public IP, and configure the NGFW to forward traffic to the ALB after inspection. Create WAF rules to block non-corporate traffic except partner IP.. Option B is correct because it restructures the traffic flow so that all traffic first hits the NGFW (via its public IP) for advanced threat inspection, then the NGFW forwards clean traffic to the internal ALB. By changing the ALB to internal, it no longer accepts direct internet traffic, ensuring the NGFW is in the path. WAF rules on the ALB then enforce the IP allowlist (corporate range plus partner IP) and protect against SQL injection and XSS, meeting all requirements efficiently.

Answer

Configure AWS WAF rate-based rules to block non-corporate IPs and enable managed rules for SQL injection.

Answer

Deploy an additional ALB as a reverse proxy in front of the NGFW, and configure the WAF on the front ALB.

Answer

Set up a site-to-site VPN between the corporate network and the VPC, and route partner traffic through the VPN.

Question 7

A company is migrating critical workloads to AWS and wants to ensure secure connectivity between their on-premises network and the VPC. Which TWO actions should be taken to meet this requirement?

Accepted Answer

Provision an AWS Direct Connect connection for a private, dedicated link.. Option C is correct because AWS Direct Connect provides a private, dedicated network link from on-premises to AWS, bypassing the public internet for consistent latency, higher bandwidth, and enhanced security. This meets the requirement for secure connectivity during a critical workload migration.

Answer

Attach an internet gateway to the VPC and allow all inbound traffic.

Answer

Configure a security group that allows all traffic from the on-premises network.

Answer

Use security groups to allow traffic from the on-premises IP range.

Question 8

A security analyst discovers that a user downloaded a CSV file containing social security numbers from a sanctioned cloud storage app, but no alert was generated. The DLP policy shown in the exhibit was applied. What is the most likely reason the policy failed to trigger?

Accepted Answer

The social security numbers in the file did not contain dashes, so the regex did not match.. The DLP policy uses a regex pattern that expects dashes in the social security numbers (e.g., \d{3}-\d{2}-\d{4}). If the CSV file contained SSNs without dashes (e.g., 123456789), the regex would not match, and no alert would be generated. This is the most likely reason the policy failed to trigger, as the data format did not meet the policy's detection criteria.

Answer

The user bypassed the DLP policy using an API call.

Answer

The policy was not applied to the cloud storage app used by the user.

Answer

The policy only notifies the admin and does not block the download.

Question 9

A financial services company uses a multi-cloud strategy with workloads in AWS and Azure. They must comply with PCI DSS, which requires encryption of cardholder data at rest and in transit. The security team has implemented the following: 1) AWS S3 buckets use server-side encryption with AWS KMS (SSE-KMS). 2) Azure Blob Storage uses Azure Storage Service Encryption (SSE) with Azure Key Vault. 3) All traffic between VPCs and VNets uses IPsec VPN tunnels. During an audit, the assessor notes that data stored in AWS S3 is encrypted with a key that is also used for a development environment. Additionally, logs from Azure Blob Storage are accessible to a group of developers with read-only permissions. Which action should the security team take to address the compliance gaps?

Accepted Answer

Create separate KMS keys for production and development in AWS, and restrict Azure Blob Storage log access to only authorized security auditors.. Option D is correct because PCI DSS requires strict separation of cryptographic keys between production and non-production environments, and logging access must be restricted to authorized personnel. Using the same KMS key for production S3 data and a development environment violates this requirement, and granting developers read-only access to Azure Blob Storage logs exposes sensitive audit data. Creating separate KMS keys for production and development in AWS ensures key isolation, while restricting Azure Blob Storage log access to only authorized security auditors enforces the principle of least privilege required by PCI DSS.

Answer

Change the encryption method to AWS S3 SSE-C and Azure client-side encryption to maintain separate keys.

Answer

Implement a cloud DLP solution to monitor access to encrypted data and alert on unauthorized use.

Answer

Use a third-party VPN appliance to ensure encryption in transit between all cloud environments.

Question 10

Drag and drop the steps to configure a Cisco ISE as a RADIUS server for network access control into the correct order.

Question 11

Match each 802.1X component to its role.

Question 12

An organization is migrating to AWS and wants to ensure that all internet-bound traffic from VPCs is inspected by a central security appliance. Which AWS service should be used to redirect this traffic?

Accepted Answer

Transit Gateway. Transit Gateway is correct because it acts as a central hub that can route traffic between VPCs and on-premises networks, and it supports route tables that can direct all internet-bound traffic to a central security appliance (such as a firewall or IDS/IPS) via a VPC attachment or a Network Virtual Appliance. This enables traffic inspection and policy enforcement without requiring individual VPCs to manage their own internet gateways or NAT devices.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

Internet Gateway

Question 13

A security engineer is configuring Cisco Umbrella to block malicious domains. They need to ensure that internal DNS queries from remote users using Cisco AnyConnect are protected. Which deployment method should they use?

Accepted Answer

Install the Umbrella Roaming Client on all endpoints. The Umbrella Roaming Client (now part of Cisco Secure Client) is the correct deployment method because it provides DNS-layer security directly on endpoints, including remote users connecting via AnyConnect. It intercepts DNS queries on the local machine and forwards them to Umbrella's cloud-based DNS resolvers, ensuring protection even when the user is off-network or behind a VPN. This is the only option that covers remote users without relying on network-level appliances or firewalls.

Answer

Configure DNS Layer Security in the office firewall

Answer

Enable Cisco Cloudlock integration

Answer

Deploy the Umbrella virtual appliance at headquarters

Question 14

A company uses AWS Organizations with multiple accounts. They need to enforce that all S3 buckets have encryption enabled. Which AWS service can centrally audit and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config conformance packs. AWS Config conformance packs allow you to deploy a collection of AWS Config rules and remediation actions as a single entity. By using a conformance pack that includes the 's3-bucket-server-side-encryption-enabled' managed rule, you can continuously audit all S3 buckets across your AWS Organization for encryption compliance and automatically trigger remediation (e.g., via AWS Systems Manager Automation) to enable encryption on non-compliant buckets.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Security Hub

Question 15

A DevOps team is deploying containerized applications on Kubernetes and needs to ensure that only authorized images are run. Which solution should they integrate with Kubernetes to enforce image trust and scanning?

Accepted Answer

Cisco Cloud Workload Protection (CWP). Cisco Cloud Workload Protection (CWP) is the correct solution because it provides integrated image scanning, vulnerability assessment, and trust enforcement for containerized workloads in Kubernetes. CWP uses a policy-based admission controller to block deployments of unauthorized or vulnerable images before they run, directly addressing the requirement to ensure only authorized images are executed.

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Firepower Next-Generation Firewall

Answer

Cisco Umbrella