350-701 Cloud Security Practice Test 4 — 15 Questions

Question 1

An organization uses Cisco Umbrella to secure remote users. The security team wants to ensure that all DNS queries from endpoints are forwarded to Umbrella even when users are off the corporate network. Which deployment method achieves this?

Accepted Answer

Deploy the Cisco Umbrella Roaming Client on endpoints. The Cisco Umbrella Roaming Client is specifically designed to enforce DNS security on endpoints regardless of their network location. It installs a local DNS forwarder that intercepts all DNS queries and sends them to Umbrella's cloud resolvers, ensuring protection even when users are off the corporate network. This method does not rely on network-level configurations that are ineffective for remote users.

Answer

Configure a network-based proxy

Answer

Use a PAC file to redirect traffic

Answer

Use BGP injection to advertise Umbrella IPs

Question 2

A company is connecting multiple VPCs in AWS to a shared services VPC using AWS Transit Gateway. They want to inspect east-west traffic between VPCs with a common security policy. Which design best achieves this using Cisco solutions?

Accepted Answer

Use AWS Transit Gateway with a centralized Cisco Firepower instance for inspection. Option D is correct because AWS Transit Gateway allows you to route traffic between multiple VPCs through a centralized inspection VPC, where a Cisco Firepower instance can apply a consistent security policy to all east-west traffic. This design avoids deploying separate firewalls in each VPC and ensures that traffic between any two VPCs is inspected by a single, centrally managed policy engine.

Answer

Deploy a Cisco Firepower instance in each VPC

Answer

Use VPC peering with no inspection

Answer

Direct Connect to on-premises Cisco ASA

Question 3

A company wants to enforce consistent security policies for Office 365, Salesforce, and Box. Which Cisco product provides CASB functionality with policy enforcement for SaaS applications?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct answer because it is Cisco's Cloud Access Security Broker (CASB) solution specifically designed to enforce consistent security policies across SaaS applications like Office 365, Salesforce, and Box. It provides visibility, data loss prevention (DLP), threat protection, and compliance monitoring by acting as a policy enforcement point between users and cloud services, using API-based integration to inspect and control data in transit and at rest.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower Threat Defense

Answer

Cisco Umbrella

Question 4

A company deploys a Cisco ASAv in AWS for VPN termination. They need to enforce multi-factor authentication (MFA) for remote access VPN users. Which Cisco solution integrates with ASAv to provide MFA?

Accepted Answer

Cisco Duo. Cisco Duo is the correct solution because it is a cloud-based MFA platform that integrates directly with the Cisco ASAv via the AnyConnect VPN client or the ASA's authentication proxy. Duo acts as a RADIUS or LDAP proxy, intercepting authentication requests and prompting users for a second factor (e.g., push notification, OTP) after primary credentials are validated. This provides the required multi-factor authentication for remote access VPN users without requiring additional on-premises infrastructure.

Answer

Cisco Umbrella

Answer

Cisco ISE

Answer

Cisco Cloudlock

Question 5

A cloud security team is investigating a possible data exfiltration incident involving an AWS S3 bucket configured with cross-region replication. Which Cisco Cloudlock feature can detect unusual replication patterns that may indicate data theft?

Accepted Answer

Cloudlock User and Entity Behavior Analytics (UEBA). Cloudlock UEBA is the correct answer because it establishes behavioral baselines for user and entity activities, such as S3 bucket replication patterns. When cross-region replication deviates from the learned baseline—e.g., unusual volume, frequency, or destination—UEBA generates an anomaly alert, directly detecting potential data exfiltration. This is a core capability of Cisco Cloudlock's cloud access security broker (CASB) functionality.

Answer

Umbrella threat intelligence

Answer

Stealthwatch Cloud flow logs

Answer

Firepower IPS signatures

Question 6

Which TWO Cisco solutions provide virtual firewall capabilities in public cloud environments? (Choose two.)

Accepted Answer

Cisco ASAv. Cisco ASAv (Adaptive Security Virtual Appliance) is a virtualized version of the Cisco ASA firewall that can be deployed in public cloud environments such as AWS, Azure, and GCP. It provides stateful firewall, VPN, and threat defense capabilities natively within the cloud infrastructure. Option A is correct because ASAv is explicitly designed for virtual firewall functions in public clouds.

Answer

Cisco DNA Center

Answer

Cisco Umbrella

Answer

Cisco ISE

Question 7

A company is implementing zero trust architecture in the cloud. Which TWO principles are fundamental to zero trust? (Choose two.)

Accepted Answer

Assume breach. Option A is correct because zero trust architecture operates on the principle of 'never trust, always verify,' which includes assuming that a breach has already occurred or is inevitable. This assumption drives continuous validation of every access request, regardless of source, and enforces least-privilege access to limit lateral movement. In cloud environments, this means treating every API call, workload, and user session as potentially compromised until proven otherwise.

Answer

Implicit trust for internal traffic

Answer

Use static passwords

Answer

Use perimeter firewalls only

Question 8

Which THREE are key components of Cisco's Cloud Security architecture? (Choose three.)

Accepted Answer

Cisco Duo. Cisco Duo is a key component of Cisco's Cloud Security architecture because it provides multi-factor authentication (MFA) as a cloud-delivered service, enforcing zero-trust access policies for users connecting to cloud applications and resources. It integrates with various identity providers and applications via SAML, RADIUS, and OAuth, ensuring that only authenticated and authorized users gain access, which is fundamental to securing cloud environments.

Answer

Cisco Catalyst switches

Answer

Cisco Meraki access points

Question 9

Refer to the exhibit. What is the effect of this NAT rule on the Cisco FTD device deployed in the cloud?

Accepted Answer

Performs identity NAT between the two networks without port translation. The NAT rule shown in the exhibit is a static identity NAT (also known as NAT exempt or no-translation NAT) that translates the source IP address of traffic from the 192.168.1.0/24 network to the same IP address when going to the 10.0.0.0/24 network. This is achieved by specifying the source address as both the original and translated address, effectively bypassing any address translation while still being processed by the NAT engine. Since no port translation is configured, it performs identity NAT without PAT, which is why option A is correct.

Answer

Translates source IP when traffic goes from outside to inside

Answer

Enables Port Address Translation (PAT)

Answer

Translates destination IP from 192.168.1.0 to a public IP

Question 10

Refer to the exhibit. This JSON policy is part of a Cisco Cloudlock DLP configuration. What will happen when a user attempts to upload a file containing the word 'secret' to a cloud storage service?

Accepted Answer

The file upload is blocked if the content contains the word 'secret'. The JSON policy shown in the exhibit is a Cisco Cloudlock DLP policy that uses a data pattern to match the word 'secret' in file content. The action specified is 'block', which means when a user attempts to upload a file containing 'secret' to a cloud storage service, the upload is blocked and an alert is generated. Option B correctly identifies that the file upload is blocked if the content contains the word 'secret', aligning with the policy's enforcement action.

Answer

An alert is generated but the file is not blocked

Answer

Only files with 'secret' in the title are blocked

Answer

All files are blocked regardless of content

Question 11

Refer to the exhibit. Enter the command output from a Cisco Umbrella deployment. An administrator observes that 25 DNS queries were blocked. What does this indicate?

Accepted Answer

Policy enforcement blocking malicious or unwanted domains. The command output from a Cisco Umbrella deployment shows that 25 DNS queries were blocked. In Umbrella, DNS queries are blocked due to policy enforcement, typically when the domain being queried matches a security category (e.g., malware, phishing, command-and-control) or a custom block list. This indicates that Umbrella's cloud-delivered security policy actively prevented resolution of those 25 domains, protecting the network from malicious or unwanted content.

Answer

Successful DNS resolution for those queries

Answer

Internal DNS resolution failures

Answer

Network congestion causing queries to timeout

Question 12

A company is deploying cloud workload protection for their Azure VMs. They want to ensure that security policies are automatically adjusted based on workload changes. Which technology should they implement?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload (formerly Tetration) is the correct choice because it provides workload protection for Azure VMs with automatic policy adjustment based on workload changes. It uses agent-based and agentless sensors to collect telemetry, builds a dependency map, and enforces micro-segmentation policies that dynamically adapt as workloads scale, migrate, or change, meeting the requirement for automated security policy adjustment.

Answer

Cisco Firepower NGFW

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch

Question 13

A company uses multiple cloud providers (AWS and Azure) and wants to unify security monitoring and policy enforcement. They have on-premises data centers as well. Which Cisco solution is best suited for this?

Accepted Answer

Cisco Secure Cloud Analytics. Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) is designed to provide unified visibility and security monitoring across multi-cloud environments (AWS, Azure, GCP) and on-premises data centers. It uses NetFlow/IPFIX data and cloud-native API integrations to detect anomalies and enforce consistent security policies, making it the best fit for the company's requirement to unify security monitoring and policy enforcement across hybrid and multi-cloud deployments.

Answer

Cisco Secure Firewall Cloud Native

Answer

Cisco Secure Workload

Answer

Cisco Secure Network Analytics

Question 14

A security team is troubleshooting an incident where a compromised application running in a Kubernetes cluster on AWS EKS is being used to exfiltrate data to an external IP. They have deployed Cisco Secure Workload. How would the agent on the container report the exfiltration attempt?

Accepted Answer

By creating a violation for a policy that denies egress to unknown IPs. Cisco Secure Workload uses a policy-based enforcement model where agents enforce micro-segmentation rules. When a container attempts egress to an external IP not permitted by an explicit allow policy, the agent creates a violation event for the deny rule that blocks unknown destinations. This violation is the primary reporting mechanism for policy violations, including exfiltration attempts.

Answer

By generating a syslog alert for outbound traffic

Answer

By sending a NetFlow export to the controller

Answer

By blocking the traffic automatically and terminating the pod

Question 15

A cloud security engineer is evaluating CSPM (Cloud Security Posture Management) solutions. Which TWO capabilities are essential for a CSPM tool? (Select two.)

Accepted Answer

Continuous compliance monitoring with industry standards. Option C is correct because CSPM tools are fundamentally designed to continuously monitor cloud environments against industry standards such as CIS, NIST, and PCI DSS. This ensures that the cloud infrastructure remains compliant with regulatory and security frameworks, which is a core requirement for cloud security posture management.

Answer

Vulnerability scanning of container images

Answer

Incident response automation with playbooks

Answer

Real-time network traffic analysis