350-701 Cloud Security — 25 Questions

Question 1

A company uses Cisco ASA access lists to filter network traffic to internal servers. They want to allow RDP access (port 3389) only from the company's public IP range. Which type of access list should be created?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inbound access list with source set to the company's IP range and destination port 3389 [CORRECT]. An inbound access list on the Cisco ASA interface that is closest to the internal servers can allow traffic from the company's IP range to port 3389. Outbound access lists control traffic leaving the interface. NAT rules are for address translation, not for filtering traffic.

Answer

Outbound access list allowing traffic from any source to port 3389 [wrong]

Answer

Cisco ASA NAT rule [wrong]

Answer

Inbound access list with destination set to the company's IP range and source port 3389 [wrong]

Question 2

A company uses AWS and needs to securely connect their on-premises data center to a VPC without traversing the public internet. Which solution should they use?

Accepted Answer

AWS Direct Connect. Private connectivity options like AWS Direct Connect provide direct, private connections to AWS.

Answer

AWS NAT Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS PrivateLink

Question 3

A company uses Cisco Cloud Security Groups (CSGs) to control traffic between subnets. They need to allow traffic from the frontend subnet to the backend subnet only on TCP 443. Which configuration correctly achieves this?

Accepted Answer

Inbound rule on backend CSG allowing TCP 443 from frontend subnet. CSGs are stateful; an inbound rule on the backend CSG allowing TCP 443 from frontend subnet is sufficient. Outbound rules are not needed because stateful filtering allows return traffic.

Answer

Outbound rule on frontend CSG allowing TCP 443 to backend subnet

Answer

Outbound rule on frontend CSG allowing TCP 443 to backend subnet; inbound rule on backend CSG allowing TCP 443 from frontend subnet

Answer

Inbound rule on frontend CSG allowing TCP 443 from backend subnet

Question 4

A company wants to establish private connectivity between its on-premises data center and a VPC in AWS, avoiding the public internet. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is a dedicated private network connection from on-premises to AWS, bypassing the public internet. AWS PrivateLink is designed for private access to AWS services from within a VPC, not for on-premises connectivity. AWS VPN uses the public internet. AWS Transit Gateway is a network transit hub, not a direct connectivity service.

Answer

AWS VPN

Answer

AWS Transit Gateway

Answer

AWS PrivateLink

Question 5

An organization wants to enforce conditional access policies for users accessing cloud applications. Which Cisco product should they use?

Accepted Answer

Cisco Duo Conditional Access. Cisco Duo Conditional Access evaluates signals like user, device, location, and risk to enforce access policies for cloud applications.

Answer

Cisco Duo Multi-Factor Authentication

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Secure Access

Question 6

A company wants to privately connect an on-premises network to a cloud virtual network without traversing the internet. Which Cisco solution should they use?

Accepted Answer

Cisco Dedicated Connection. Cisco Dedicated Connection provides dedicated private connectivity from on-premises to the cloud, bypassing the internet.

Answer

Cisco VPN Gateway

Answer

Cisco CDN

Answer

Cisco Private Link

Question 7

A company is moving its on-premises applications to AWS EC2 instances. According to the shared responsibility model, which of the following is the customer's responsibility?

Accepted Answer

Patching the guest operating system. In IaaS, the cloud provider manages the physical infrastructure (hosts, network, hypervisor), while the customer is responsible for securing the guest OS, applications, and data. Patching the OS is a customer responsibility.

Answer

Hypervisor security

Answer

Network infrastructure hardening

Answer

Physical security of the data center

Question 8

An organization uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which cloud security solution should be deployed?

Accepted Answer

Cloud Access Security Broker (CASB). A CASB provides visibility and control over SaaS applications, including DLP policies to detect and block unauthorized sharing of sensitive data. CSPM focuses on cloud infrastructure posture, CWPP on workloads, and WAF on web application attacks.

Answer

Web Application Firewall (WAF)

Answer

Cloud Security Posture Management (CSPM)

Answer

Cloud Workload Protection Platform (CWPP)

Question 9

A security engineer is configuring Cisco Umbrella to enforce web security for remote users. The requirement is to block threats by intercepting DNS requests and only perform SSL decryption on specific high-risk categories. Which Umbrella feature should be used for selective SSL inspection?

Accepted Answer

Intelligent Proxy. Cisco Umbrella's Intelligent Proxy can selectively proxy traffic (including SSL inspection) based on categories, URL groups, or other policies. The roaming client enables off-network protection but does not handle selective SSL inspection. SIG includes firewall and proxy but selective inspection is via Intelligent Proxy.

Answer

DNS-layer security

Answer

Secure Internet Gateway (SIG)

Answer

Umbrella Roaming Client

Question 10

A company is deploying a multi-tier application in a Cisco cloud security environment. The web servers must be accessible from the internet, but the database servers should only be reachable from the web servers. Which Cisco security controls should be used to enforce this?

Accepted Answer

Assign a Cisco TrustSec security group tag (SGT) to web servers allowing HTTP/S from 0.0.0.0/0, and a separate SGT for databases allowing traffic only from the web server SGT. Cisco TrustSec Security Group Tags (SGTs) provide granular, scalable segmentation based on logical groups rather than IP addresses. They are stateful and can be used to allow traffic from web servers to database servers based on source SGT. This is more effective than stateless ACLs or subnet-level controls, and Cisco CloudLock is primarily a CASB, not for network segmentation.

Answer

Use Cisco ASA access-lists to allow inbound traffic to web servers from 0.0.0.0/0 and deny all traffic to database servers

Answer

Place web servers in a public subnet and database servers in a private subnet, and use a Cisco Firepower access control policy to block all traffic to the private subnet

Answer

Use Cisco CloudLock to restrict access to database servers based on source IP

Question 11

An organization wants to implement zero trust principles for cloud access. Which of the following is a key component of a zero trust architecture in the cloud?

Accepted Answer

Multi-factor authentication (MFA) for all access. Zero trust assumes no implicit trust and requires continuous verification. Identity is the new perimeter, and MFA is a core enforcement mechanism. VPNs create a trusted network model, which is contrary to zero trust. Perimeter firewalls are less relevant. Single password only is inadequate.

Answer

Site-to-site VPN to cloud

Answer

Strong perimeter firewall

Answer

Single sign-on with one password

Question 12

A DevOps team is integrating security into their CI/CD pipeline. They want to automatically scan Terraform scripts for misconfigurations before deployment. Which tool is specifically designed for this purpose?

Accepted Answer

Cisco Cloud Security Posture Management (Cisco CSPM). Cisco Cloud Security Posture Management (Cisco CSPM) is a Cisco tool designed for static analysis of Infrastructure as Code (IaC) files, including Terraform, to detect misconfigurations. SAST and DAST analyze application code, not IaC. Container image scanning tools focus on container vulnerabilities, not IaC templates.

Answer

SAST (Static Application Security Testing)

Answer

Container image scanner

Answer

DAST (Dynamic Application Security Testing)

Question 13

A company uses Azure AD Conditional Access policies to enforce security for cloud applications. They need to require MFA for all external users accessing a sensitive SaaS app, but only when the access is from an untrusted network. Which condition should be configured in the policy?

Accepted Answer

Configure the policy for 'Any location' and exclude 'All trusted locations'. Conditional Access can use network location conditions, such as 'All trusted locations' or 'Any location'. To enforce MFA only from untrusted networks, the policy should target 'Any location' and exclude 'All trusted locations'. The other options are less precise.

Answer

Use device compliance condition

Answer

Use risk-based conditional access

Answer

Configure the policy for 'All locations'

Question 14

An organization wants to connect its on-premises data center to an AWS VPC privately, avoiding the public internet. Which AWS service provides a dedicated, private connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private connection from an on-premises data center to AWS, bypassing the public internet. Site-to-Site VPN uses the internet, PrivateLink is for accessing services privately across VPCs and on-premises, and NAT Gateway is for outbound internet access.

Answer

AWS Site-to-Site VPN

Answer

AWS PrivateLink

Answer

AWS NAT Gateway

Question 15

Which of the following is the primary function of a Cloud Security Posture Management (CSPM) tool?

Accepted Answer

Monitor and remediate cloud misconfigurations against benchmarks. CSPM tools continuously monitor cloud infrastructure for compliance with security best practices and benchmarks (e.g., CIS). They identify misconfigurations but do not typically enforce DLP, block threats, or protect workloads directly.

Answer

Block malicious domains at the DNS layer

Answer

Protect workloads from malware

Answer

Provide DLP for SaaS applications

Question 16

A company uses Cisco Umbrella to provide DNS-layer security. An employee tries to visit a website that is hosting malware, but the domain is not yet categorized. How does Umbrella handle this request?

Accepted Answer

The request is blocked if the domain is identified as malicious by Umbrella's threat intelligence. Umbrella's DNS-layer security can block domains based on intelligence feeds, including newly observed malicious domains. It does not need categorization; it uses real-time threat intelligence. The intelligent proxy is separate.

Answer

The request is redirected to a captive portal for user awareness

Answer

The request is allowed because the domain is not categorized

Answer

The request is proxied through the intelligent proxy for inspection

Question 17

An organization is deploying containerized applications in a Kubernetes cluster on AWS EKS. They need to ensure that container images are scanned for vulnerabilities before deployment. Which approach aligns with DevSecOps best practices?

Accepted Answer

Integrate image scanning into the CI/CD pipeline before pushing to registry. Integrating image scanning into the CI/CD pipeline (e.g., using tools like Trivy or Amazon ECR scanning) ensures vulnerabilities are caught before deployment. Scanning after deployment or manually is less effective, and only scanning base images ignores application layer vulnerabilities.

Answer

Scan container images after deployment using a runtime scanner

Answer

Manually review images before deployment

Answer

Only scan base images, not application layers

Question 18

A security team is implementing AWS WAF to protect a web application. They want to block requests that contain SQL injection patterns in the query string. Which AWS WAF component should be used?

Accepted Answer

Managed rule group for SQL injection. AWS WAF uses managed rule groups (e.g., the SQL injection rule group) to detect common attack patterns. Custom rules can also be written but the easiest is to use the managed rule group. NACLs and security groups operate at network level, not application layer.

Answer

Security group allowing only HTTPS

Answer

Network ACL with deny rule for port 80

Answer

Custom rule matching on source IP

Question 19

In the shared responsibility model for PaaS, which of the following is typically the customer's responsibility?

Accepted Answer

Securing the application code and data. In PaaS, the provider manages the runtime, middleware, OS, and infrastructure. The customer is responsible for the application code and data. Network controls and hypervisor are provider responsibilities.

Answer

Securing the hypervisor

Answer

Patching the underlying operating system

Answer

Managing network firewall rules

Question 20

A DevSecOps team is implementing secrets management for a cloud-native application. They want to avoid storing secrets in environment variables or code. Which solution should they use?

Accepted Answer

Use HashiCorp Vault to dynamically generate and manage secrets. A dedicated secrets management tool like HashiCorp Vault securely stores and provides access to secrets (API keys, passwords) without embedding them in code or environment variables. Azure Key Vault and AWS Secrets Manager are also valid, but Vault is a common cross-platform solution. The other options are insecure.

Answer

Embed secrets in the container image

Answer

Pass secrets via command-line arguments

Answer

Store secrets in a configuration file in the repository