350-701 Cloud Security Practice Test 2 — 15 Questions

Question 1

A company uses Cisco Umbrella to provide DNS-layer security. An employee tries to visit a website that is hosting malware, but the domain is not yet categorized. How does Umbrella handle this request?

Accepted Answer

The request is blocked if the domain is identified as malicious by Umbrella's threat intelligence. Umbrella's DNS-layer security can block domains based on intelligence feeds, including newly observed malicious domains. It does not need categorization; it uses real-time threat intelligence. The intelligent proxy is separate.

Answer

The request is redirected to a captive portal for user awareness

Answer

The request is allowed because the domain is not categorized

Answer

The request is proxied through the intelligent proxy for inspection

Question 2

An organization is deploying containerized applications in a Kubernetes cluster on AWS EKS. They need to ensure that container images are scanned for vulnerabilities before deployment. Which approach aligns with DevSecOps best practices?

Accepted Answer

Integrate image scanning into the CI/CD pipeline before pushing to registry. Integrating image scanning into the CI/CD pipeline (e.g., using tools like Trivy or Amazon ECR scanning) ensures vulnerabilities are caught before deployment. Scanning after deployment or manually is less effective, and only scanning base images ignores application layer vulnerabilities.

Answer

Scan container images after deployment using a runtime scanner

Answer

Manually review images before deployment

Answer

Only scan base images, not application layers

Question 3

A security team is implementing AWS WAF to protect a web application. They want to block requests that contain SQL injection patterns in the query string. Which AWS WAF component should be used?

Accepted Answer

Managed rule group for SQL injection. AWS WAF uses managed rule groups (e.g., the SQL injection rule group) to detect common attack patterns. Custom rules can also be written but the easiest is to use the managed rule group. NACLs and security groups operate at network level, not application layer.

Answer

Security group allowing only HTTPS

Answer

Network ACL with deny rule for port 80

Answer

Custom rule matching on source IP

Question 4

In the shared responsibility model for PaaS, which of the following is typically the customer's responsibility?

Accepted Answer

Securing the application code and data. In PaaS, the provider manages the runtime, middleware, OS, and infrastructure. The customer is responsible for the application code and data. Network controls and hypervisor are provider responsibilities.

Answer

Securing the hypervisor

Answer

Patching the underlying operating system

Answer

Managing network firewall rules

Question 5

A DevSecOps team is implementing secrets management for a cloud-native application. They want to avoid storing secrets in environment variables or code. Which solution should they use?

Accepted Answer

Use HashiCorp Vault to dynamically generate and manage secrets. A dedicated secrets management tool like HashiCorp Vault securely stores and provides access to secrets (API keys, passwords) without embedding them in code or environment variables. Azure Key Vault and AWS Secrets Manager are also valid, but Vault is a common cross-platform solution. The other options are insecure.

Answer

Embed secrets in the container image

Answer

Pass secrets via command-line arguments

Answer

Store secrets in a configuration file in the repository

Question 6

A security administrator is evaluating Cisco Umbrella for cloud-delivered security. Which TWO capabilities are provided by the Secure Internet Gateway (SIG) feature? (Choose two.)

Accepted Answer

Cloud-delivered firewall. Cisco Umbrella SIG includes a cloud-delivered firewall and a web proxy for URL filtering. DNS-layer security is a separate feature, and VPN is not part of SIG. DLP is typically a CASB function.

Answer

Data loss prevention for SaaS

Answer

DNS-layer security

Answer

Site-to-site VPN connectivity

Question 7

An organization is adopting zero trust principles for cloud access. Which THREE measures are essential for implementing identity-centric security? (Choose three.)

Accepted Answer

Conditional access policies based on user, device, and location. Zero trust relies on strong identity verification: MFA, privileged identity management (PIM) for just-in-time access, and conditional access policies that enforce context-based controls. VPN and network segmentation are network-centric, not identity-centric.

Answer

Site-to-site VPN for connectivity

Answer

Network segmentation using VLANs

Question 8

A company is using Azure and wants to enforce security compliance across their cloud resources. Which TWO services are part of CSPM (Cloud Security Posture Management) in Azure? (Choose two.)

Accepted Answer

Azure Security Center (Defender for Cloud). Azure Security Center (now Defender for Cloud) provides CSPM capabilities including continuous assessment and secure score. Azure Policy enforces compliance rules. Azure AD is identity, WAF is application protection, and Monitor is monitoring.

Answer

Azure Active Directory

Answer

Azure Monitor

Answer

Azure WAF

Question 9

In the shared responsibility model for cloud services, which layer is the customer responsible for managing in an IaaS environment?

Accepted Answer

Operating system, applications, and data. In IaaS, the cloud provider manages the physical infrastructure, while the customer manages the OS, applications, and data.

Answer

Virtual machines and storage only

Answer

Only data and access policies

Answer

Physical servers and networking

Question 10

A security team wants to gain visibility into Shadow IT usage of SaaS applications and enforce data loss prevention policies. Which cloud security solution should they deploy?

Accepted Answer

CASB. CASB provides visibility, DLP, and threat detection for sanctioned and unsanctioned SaaS apps.

Answer

CSPM

Answer

Cisco Umbrella

Answer

CWPP

Question 11

An organization uses Cisco Umbrella to block malicious domains. Which layer does Umbrella primarily operate at to prevent connections before they are established?

Accepted Answer

DNS layer. Cisco Umbrella operates at the DNS layer to block requests to malicious domains before any connection is made.

Answer

Network layer (IP filtering)

Answer

Application layer

Answer

Transport layer

Question 12

A company wants to ensure that no cloud workload has a public IP address attached to a network security policy that allows inbound SSH from the entire internet. Which Cisco security product can continuously monitor and alert on such misconfigurations?

Accepted Answer

Cisco Secure Cloud Analytics. Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) is a cloud security posture management (CSPM) tool that continuously monitors cloud environments against security benchmarks and alerts on violations such as open SSH from the internet.

Answer

Cisco Umbrella

Answer

Cisco Firepower Management Center

Answer

Cisco Identity Services Engine

Question 13

An organization wants to enforce MFA for all administrative access to their Azure environment and also require that access from non-compliant devices be blocked. Which Azure feature should they use?

Accepted Answer

Azure AD Conditional Access. Azure AD Conditional Access allows policies based on user, device, location, and risk to enforce MFA and block non-compliant devices.

Answer

Azure Security Center

Answer

Azure AD Privileged Identity Management

Answer

Azure Firewall

Question 14

A DevSecOps team is integrating security into their CI/CD pipeline. They want to scan Terraform configuration files for misconfigurations before deployment. Which tool is specifically designed for that purpose?

Accepted Answer

Checkov. Checkov is an open-source static analysis tool for IaC (Terraform, CloudFormation) to detect security misconfigurations.

Answer

DAST scanner

Answer

SAST scanner

Answer

Container image scanner

Question 15

In the shared responsibility model for PaaS, which of the following is the customer responsible for?

Accepted Answer

Applications and data. In PaaS, the provider manages the runtime, middleware, and OS; the customer manages applications and data.

Answer

Operating system patching

Answer

Runtime environment

Answer

Physical infrastructure