350-701 Cloud Security — 30 Questions

Question 1

A security engineer is configuring Cisco Umbrella to enforce web security for remote users. The requirement is to block threats by intercepting DNS requests and only perform SSL decryption on specific high-risk categories. Which Umbrella feature should be used for selective SSL inspection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Intelligent Proxy. Umbrella's Intelligent Proxy selectively performs SSL decryption only for traffic to destinations that are suspicious or in high-risk categories, rather than decrypting all traffic. This matches the requirement to intercept DNS and apply SSL inspection selectively to high-risk categories while avoiding blanket decryption.

Answer

DNS-layer security

Answer

Secure Internet Gateway (SIG)

Answer

Umbrella Roaming Client

Question 2

A company is deploying a multi-tier application in a Cisco cloud security environment. The web servers must be accessible from the internet, but the database servers should only be reachable from the web servers. Which Cisco security controls should be used to enforce this?

Accepted Answer

Assign a Cisco TrustSec security group tag (SGT) to web servers allowing HTTP/S from 0.0.0.0/0, and a separate SGT for databases allowing traffic only from the web server SGT. Cisco TrustSec uses Security Group Tags (SGTs) to enforce segmentation based on identity/role rather than IP addresses. Assigning an SGT to web servers that permits HTTP/S from 0.0.0.0/0, and a separate SGT for databases that only permits traffic from the web server SGT, enforces the required tiered access using group-based policy. This is the correct Cisco cloud security control for role-based microsegmentation.

Answer

Use Cisco ASA access-lists to allow inbound traffic to web servers from 0.0.0.0/0 and deny all traffic to database servers

Answer

Place web servers in a public subnet and database servers in a private subnet, and use a Cisco Firepower access control policy to block all traffic to the private subnet

Answer

Use Cisco CloudLock to restrict access to database servers based on source IP

Question 3

A DevOps team is integrating security into their CI/CD pipeline. They want to automatically scan Terraform scripts for misconfigurations before deployment. Which tool is specifically designed for this purpose?

Accepted Answer

Cisco Cloud Security Posture Management (Cisco CSPM). Cisco Cloud Security Posture Management (Cisco CSPM) is specifically designed to continuously monitor cloud infrastructure for misconfigurations, compliance violations, and security risks. It can integrate into CI/CD pipelines to scan Infrastructure as Code (IaC) templates like Terraform before deployment, identifying issues such as overly permissive security groups, unencrypted storage, or public S3 buckets. Unlike generic SAST tools that analyze application source code, CSPM focuses on cloud configuration and IaC, making it the right fit for scanning Terraform scripts.

Answer

SAST (Static Application Security Testing)

Answer

Container image scanner

Answer

DAST (Dynamic Application Security Testing)

Question 4

A company uses Azure AD Conditional Access policies to enforce security for cloud applications. They need to require MFA for all external users accessing a sensitive SaaS app, but only when the access is from an untrusted network. Which condition should be configured in the policy?

Accepted Answer

Configure the policy for 'Any location' and exclude 'All trusted locations'. The requirement is to enforce MFA for external users accessing a sensitive SaaS app only when they are on an untrusted network. In Microsoft Entra Conditional Access, this is achieved by setting the Locations condition to 'Any location' and then excluding 'All trusted locations'. This ensures the policy applies everywhere except from IP addresses or countries you have explicitly marked as trusted, effectively targeting untrusted networks. The 'Any location' setting includes all IPs, and the exclusion carves out trusted ones, leaving only untrusted access subject to MFA.

Answer

Use device compliance condition

Answer

Use risk-based conditional access

Answer

Configure the policy for 'All locations'

Question 5

An organization wants to connect its on-premises data center to an AWS VPC privately, avoiding the public internet. Which AWS service provides a dedicated, private connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet. It is the standard service for private, high-bandwidth, low-latency connectivity between a data center and a VPC.

Answer

AWS Site-to-Site VPN

Answer

AWS PrivateLink

Answer

AWS NAT Gateway

Question 6

A company uses Cisco ASA access lists to filter network traffic to internal servers. They want to allow RDP access (port 3389) only from the company's public IP range. Which type of access list should be created?

Accepted Answer

Inbound access list with source set to the company's IP range and destination port 3389. An inbound access list on the Cisco ASA interface that is closest to the internal servers can allow traffic from the company's IP range to port 3389. Outbound access lists control traffic leaving the interface. NAT rules are for address translation, not for filtering traffic.

Answer

Outbound access list allowing traffic from any source to port 3389

Answer

Cisco ASA NAT rule

Answer

Inbound access list with destination set to the company's IP range and source port 3389

Question 7

A security administrator is evaluating Cisco Umbrella for cloud-delivered security. Which TWO capabilities are provided by the Secure Internet Gateway (SIG) feature? (Choose two.)

Accepted Answer

Cloud-delivered firewall. Option A (Cloud-delivered firewall) is correct because Cisco Umbrella SIG includes a cloud-delivered firewall capability that enforces Layer 3/Layer 4 traffic policies and IP/port-based rules in the cloud, without requiring on-premises appliances. Option E (Web proxy with URL filtering) is correct because SIG provides a secure web gateway function that proxies HTTP/HTTPS traffic and applies URL/category-based filtering and file inspection to block malicious or inappropriate sites. The unmarked options do not belong: DNS-layer security (C) is Umbrella's foundational DNS security feature rather than a SIG capability, data loss prevention for SaaS (B) is not a SIG function, and site-to-site VPN connectivity (D) is a network connectivity feature, not part of SIG's cloud-delivered security services.

Answer

Data loss prevention for SaaS

Answer

DNS-layer security

Answer

Site-to-site VPN connectivity

Question 8

An organization wants to enforce MFA for all administrative access to their Azure environment and also require that access from non-compliant devices be blocked. Which Azure feature should they use?

Accepted Answer

Azure AD Conditional Access. Microsoft Entra Conditional Access is the correct answer because it is the policy engine in Microsoft Entra ID that evaluates signals (user, device, location, application, risk) and enforces access controls such as requiring MFA and blocking access from non-compliant devices. It directly supports the requirement to enforce MFA for administrative access and to block access from non-compliant devices via device compliance conditions. Conditional Access policies can be scoped to administrative roles and integrated with Intune compliance data to allow or block access.

Answer

Azure Security Center

Answer

Azure AD Privileged Identity Management

Answer

Azure Firewall

Question 9

A company uses AWS and needs to securely connect their on-premises data center to a VPC without traversing the public internet. Which solution should they use?

Accepted Answer

AWS Direct Connect. Private connectivity options like AWS Direct Connect provide direct, private connections to AWS.

Answer

AWS NAT Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS PrivateLink

Question 10

An organization wants to protect their web application hosted on AWS from common exploits like SQL injection. Which Cisco service should they use?

Accepted Answer

Cisco Firepower Next-Generation Firewall (NGFW). Cisco Firepower Next-Generation Firewall (NGFW) with Intrusion Prevention System (IPS) can detect and block SQL injection attacks by inspecting HTTP traffic for malicious payloads. It provides application-layer protection through signature-based and behavioral analysis. The other options: ISE is for identity and access management, Stealthwatch for network visibility, and WSA is a web proxy without native WAF capabilities.

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Stealthwatch

Answer

Cisco Web Security Appliance (WSA)

Question 11

A company is deploying a multi-tier application on AWS. The web servers must be accessible from the internet only on ports 80 and 443, while the database servers should be accessible only from the web servers on port 3306. Which combination of cloud network security controls should be used?

Accepted Answer

Security groups for each tier and a Network ACL on the database subnet. Security groups provide stateful, instance-level filtering that can restrict web servers to ports 80/443 from the internet and database servers to port 3306 only from the web server security group. A Network ACL on the database subnet adds a stateless, subnet-level layer that can explicitly deny unauthorized traffic, providing defense in depth. This combination meets the requirement for layered controls across both tiers.

Answer

Only security groups for both tiers, no NACLs

Answer

Only Network ACLs for both subnets, no security groups

Answer

Network ACLs for the web tier and security groups for the database tier

Question 12

A company uses Cisco Cloud Security Groups (CSGs) to control traffic between subnets. They need to allow traffic from the frontend subnet to the backend subnet only on TCP 443. Which configuration correctly achieves this?

Accepted Answer

Inbound rule on backend CSG allowing TCP 443 from frontend subnet. CSGs are stateful; an inbound rule on the backend CSG allowing TCP 443 from frontend subnet is sufficient. Outbound rules are not needed because stateful filtering allows return traffic.

Answer

Outbound rule on frontend CSG allowing TCP 443 to backend subnet

Answer

Outbound rule on frontend CSG allowing TCP 443 to backend subnet; inbound rule on backend CSG allowing TCP 443 from frontend subnet

Answer

Inbound rule on frontend CSG allowing TCP 443 from backend subnet

Question 13

An organization uses AWS WAF to protect its web application. They need to block requests from a specific geographic region. What should they configure?

Accepted Answer

AWS WAF geo match rule. AWS WAF supports a geo match condition that inspects the source country of a request (based on the IP's geolocation) and allows you to block or allow traffic from specific countries. Configuring a geo match rule in a WAF web ACL attached to CloudFront, ALB, or API Gateway blocks requests from the targeted region at the application layer.

Answer

CloudFront geo restriction

Answer

Security group with IP-based deny rule

Answer

Network ACL with IP deny rule

Question 14

A company wants to establish private connectivity between its on-premises data center and a VPC in AWS, avoiding the public internet. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is a dedicated private network connection from on-premises to AWS, bypassing the public internet. AWS PrivateLink is designed for private access to AWS services from within a VPC, not for on-premises connectivity. AWS VPN uses the public internet. AWS Transit Gateway is a network transit hub, not a direct connectivity service.

Answer

AWS VPN

Answer

AWS Transit Gateway

Answer

AWS PrivateLink

Question 15

An organization uses Azure for its cloud workloads. To protect web applications from common exploits like SQL injection and cross-site scripting, they need to deploy a web application firewall (WAF) that integrates with Azure Application Gateway. Which Azure WAF SKU should they choose?

Accepted Answer

Azure Application Gateway WAF_v2. Azure Application Gateway WAF_v2 is the SKU that bundles a regional Layer 7 web application firewall with Application Gateway, providing OWASP Core Rule Set protection against SQL injection, XSS, and other common exploits. Because the requirement explicitly states integration with Application Gateway, WAF_v2 is the correct choice.

Answer

Azure Firewall Premium

Answer

Azure DDoS Protection

Answer

Azure WAF on Azure Front Door

Question 16

An organization wants to enforce conditional access policies for users accessing cloud applications. Which Cisco product should they use?

Accepted Answer

Cisco Duo Conditional Access. Cisco Duo Conditional Access evaluates signals like user, device, location, and risk to enforce access policies for cloud applications.

Answer

Cisco Duo Multi-Factor Authentication

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Secure Access

Question 17

A company wants to privately connect an on-premises network to a cloud virtual network without traversing the internet. Which Cisco solution should they use?

Accepted Answer

Cisco Dedicated Connection. Cisco Dedicated Connection provides dedicated private connectivity from on-premises to the cloud, bypassing the internet.

Answer

Cisco VPN Gateway

Answer

Cisco CDN

Answer

Cisco Private Link

Question 18

A company is using Cisco Umbrella for cloud security. Which two features are part of the Secure Internet Gateway (SIG) functionality? (Choose two.)

Accepted Answer

Cloud-delivered firewall. The Cisco Umbrella Secure Internet Gateway (SIG) bundles several cloud-delivered security services, and among the listed options the cloud-delivered firewall (C) is a core SIG component that provides layer 3/4 traffic inspection and enforcement in the cloud, while the web proxy (E) is also a core SIG component that inspects and controls HTTP/HTTPS web traffic, including file inspection and SSL decryption. These two features are explicitly part of the SIG functionality along with DNS-layer security, CASB, and DLP. DNS-layer security (D) is a foundational Umbrella capability but is categorized as its own Umbrella service rather than a distinct SIG feature in this question's framing, and CASB functionality (A) is likewise a separate Umbrella offering (though integrated with SIG) rather than one of the two SIG features being tested here. CSPM capabilities (B) belong to cloud security posture management products and are not part of Umbrella SIG functionality.

Answer

CASB functionality

Answer

CSPM capabilities

Answer

DNS-layer security

Question 19

An organization is implementing a zero trust strategy for cloud access. They require that all access to cloud resources be authenticated and authorized based on user identity and device health, with session risk assessment. Which Azure AD feature should they primarily use?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID evaluate signals (user, device, location, risk) to enforce access controls, aligning with zero trust principles.

Answer

Azure AD Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Azure AD Multi-Factor Authentication

Question 20

A security architect is designing a multi-cloud environment that spans AWS and Azure. The organization wants a single solution that continuously discovers cloud assets, identifies misconfigurations such as publicly accessible storage buckets, and provides a unified compliance dashboard across both clouds. Which Cisco solution best meets these requirements?

Accepted Answer

Cisco Cloud Security Posture Management (CSPM) within Cisco Secure Workload. The requirement is for continuous discovery, misconfiguration detection across AWS and Azure, and unified compliance reporting. Cisco's Cloud Security Posture Management, delivered through Cisco Secure Workload and Cisco Defense Orchestrator, provides agentless and agent-based discovery of cloud resources, evaluates configurations against benchmarks like CIS and PCI, and consolidates findings into a single pane of glass. Other Cisco cloud security products address different layers such as DNS, SaaS data, or traffic analytics, and cannot fulfill the infrastructure posture management need.

Answer

Cisco Umbrella

Answer

Cisco Secure Cloud Analytics

Answer

Cisco Cloudlock