350-701 Cloud Security Practice Test 2 — 15 Questions

Question 1

An organization wants to enforce conditional access policies for users accessing cloud applications. Which Cisco product should they use?

Accepted Answer

Cisco Duo Conditional Access. Cisco Duo Conditional Access evaluates signals like user, device, location, and risk to enforce access policies for cloud applications.

Answer

Cisco Duo Multi-Factor Authentication

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Secure Access

Question 2

A company wants to privately connect an on-premises network to a cloud virtual network without traversing the internet. Which Cisco solution should they use?

Accepted Answer

Cisco Dedicated Connection. Cisco Dedicated Connection provides dedicated private connectivity from on-premises to the cloud, bypassing the internet.

Answer

Cisco VPN Gateway

Answer

Cisco CDN

Answer

Cisco Private Link

Question 3

A company is using Cisco Umbrella for cloud security. Which two features are part of the Secure Internet Gateway (SIG) functionality? (Choose two.)

Accepted Answer

Cloud-delivered firewall. The Cisco Umbrella Secure Internet Gateway (SIG) bundles several cloud-delivered security services, and among the listed options the cloud-delivered firewall (C) is a core SIG component that provides layer 3/4 traffic inspection and enforcement in the cloud, while the web proxy (E) is also a core SIG component that inspects and controls HTTP/HTTPS web traffic, including file inspection and SSL decryption. These two features are explicitly part of the SIG functionality along with DNS-layer security, CASB, and DLP. DNS-layer security (D) is a foundational Umbrella capability but is categorized as its own Umbrella service rather than a distinct SIG feature in this question's framing, and CASB functionality (A) is likewise a separate Umbrella offering (though integrated with SIG) rather than one of the two SIG features being tested here. CSPM capabilities (B) belong to cloud security posture management products and are not part of Umbrella SIG functionality.

Answer

CASB functionality

Answer

CSPM capabilities

Answer

DNS-layer security

Question 4

An organization is implementing a zero trust strategy for cloud access. They require that all access to cloud resources be authenticated and authorized based on user identity and device health, with session risk assessment. Which Azure AD feature should they primarily use?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID evaluate signals (user, device, location, risk) to enforce access controls, aligning with zero trust principles.

Answer

Azure AD Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Azure AD Multi-Factor Authentication

Question 5

A security architect is designing a multi-cloud environment that spans AWS and Azure. The organization wants a single solution that continuously discovers cloud assets, identifies misconfigurations such as publicly accessible storage buckets, and provides a unified compliance dashboard across both clouds. Which Cisco solution best meets these requirements?

Accepted Answer

Cisco Cloud Security Posture Management (CSPM) within Cisco Secure Workload. The requirement is for continuous discovery, misconfiguration detection across AWS and Azure, and unified compliance reporting. Cisco's Cloud Security Posture Management, delivered through Cisco Secure Workload and Cisco Defense Orchestrator, provides agentless and agent-based discovery of cloud resources, evaluates configurations against benchmarks like CIS and PCI, and consolidates findings into a single pane of glass. Other Cisco cloud security products address different layers such as DNS, SaaS data, or traffic analytics, and cannot fulfill the infrastructure posture management need.

Answer

Cisco Umbrella

Answer

Cisco Secure Cloud Analytics

Answer

Cisco Cloudlock

Question 6

A security team is using Cisco Umbrella to protect users from malicious domains. They notice that some requests for known malicious domains are not being blocked because the domains are being resolved by an internal DNS server that forwards queries directly to the internet, bypassing Umbrella. Which Umbrella feature should be configured to ensure that all DNS queries are visible and enforced by Umbrella?

Accepted Answer

DNS Forwarder. The Umbrella DNS Forwarder is specifically designed to be deployed on-premises and configured as the forwarder for internal DNS servers. This ensures that all DNS queries from internal resolvers are sent to Umbrella, making them visible and subject to policy enforcement. Other options either encrypt DNS, provide identity mapping, or are not Umbrella features for this purpose.

Answer

DNSCrypt

Answer

Umbrella Virtual Appliance

Answer

DNS over HTTPS

Question 7

A security engineer is deploying a containerized application on Google Kubernetes Engine (GKE). The team wants to ensure that only container images from a trusted private registry can be deployed, and that any attempt to run an untrusted image is blocked. Which Kubernetes-native mechanism should they implement?

Accepted Answer

Admission controllers with image policy webhook. Admission controllers are the correct Kubernetes-native mechanism to enforce policies on resource creation. By deploying an image policy webhook admission controller, the cluster can be configured to allow only container images from a designated private registry. This controller evaluates pod creation requests and rejects any that reference untrusted images. Network policies, pod security policies, and RBAC operate at different layers and cannot enforce image registry restrictions.

Answer

Pod Security Policies

Answer

Role-Based Access Control (RBAC)

Answer

Kubernetes Network Policies

Question 8

A company is migrating its on-premises data center to a multi-cloud environment with AWS, Azure, and GCP. The security team needs to ensure consistent security policy enforcement and visibility across all cloud workloads. Which TWO Cisco solutions should be integrated to achieve centralized management and threat detection? (Choose two.)

Accepted Answer

Cisco Stealthwatch Cloud. Cisco Cloudlock and Cisco Stealthwatch Cloud together provide the required capabilities: Cloudlock delivers SaaS security and policy enforcement, while Stealthwatch Cloud offers network traffic visibility and threat detection for cloud workloads. Integrated, they enable centralized management and consistent security across multi-cloud environments. The other options focus on internet security, network access control, or firewall management, which do not fully address multi-cloud workload security.

Answer

Cisco Umbrella

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Identity Services Engine (ISE)

Question 9

A company is migrating its on-premises web application to Amazon Web Services (AWS) and wants to protect it from common web exploits such as SQL injection and cross-site scripting. The security team wants a managed service that integrates with an Application Load Balancer and can be configured with rules that are automatically updated by the vendor. Which AWS service should they deploy?

Accepted Answer

AWS WAF. AWS WAF is the correct service because it is a managed web application firewall that integrates with Application Load Balancers and CloudFront, inspects HTTP requests, and can use AWS Managed Rules that are automatically updated. Shield Advanced handles DDoS, GuardDuty provides detection, and Network Firewall handles VPC-level traffic filtering, none of which block application-layer exploit payloads.

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Question 10

A company is migrating its on-premises web application to AWS. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to rate-limit requests from specific IP addresses to mitigate bot attacks. Which AWS service should they use to meet these requirements?

Accepted Answer

AWS WAF. AWS WAF is the correct service because it provides application-layer protection with managed and custom rules for SQL injection and cross-site scripting, as well as rate-based rules to limit requests from specific IPs. Shield Advanced is for DDoS, GuardDuty is for detection, and Network Firewall is for network-level filtering, so none of them provide the required web application firewall capabilities.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Question 11

A security engineer is configuring Cisco Umbrella to protect a remote workforce that uses both company-managed laptops and personal devices. The engineer wants to enforce DNS-layer security on managed Windows and macOS endpoints even when users are off the corporate network, and wants the ability to identify the specific user generating DNS requests for policy and reporting. Which Umbrella component should be deployed on the managed endpoints?

Accepted Answer

Cisco Umbrella roaming client (Umbrella Agent). The Umbrella roaming client, or Umbrella Agent, is the correct component because it installs on managed Windows and macOS endpoints, forwards DNS requests to Umbrella from any network, and supports Active Directory-based user identification. The virtual appliance is on-premises only, SIG tunnels are network-edge constructs, and the DNS resolver is backend infrastructure, none of which provide per-user off-network enforcement.

Answer

Cisco Umbrella virtual appliance

Answer

Cisco Umbrella DNS resolver

Answer

Cisco Umbrella SIG (Secure Internet Gateway) tunnel

Question 12

A security administrator is configuring Cisco Umbrella to protect users from accessing malicious domains. They want to block requests to known command-and-control (C2) servers and prevent data exfiltration via DNS tunneling. Which Umbrella feature should be enabled to detect and block such threats?

Accepted Answer

DNS Tunneling Detection. Cisco Umbrella's DNS Tunneling Detection is designed to identify and block DNS-based data exfiltration and C2 communication by analysing query patterns. It complements DNS Security, which blocks known malicious domains. The other features operate at different layers and do not provide the specific DNS tunneling analysis needed. Enabling this feature ensures protection against stealthy DNS-based threats.

Answer

Intelligent Proxy

Answer

DNS Security

Answer

Cloud Firewall

Question 13

A security administrator is configuring Cisco Umbrella to provide DNS-layer security for a distributed workforce. The administrator wants to ensure that roaming users are protected even when they are off the corporate network, and that policies can be applied based on user identity. Which TWO components should be deployed to meet these requirements? (Choose two.)

Accepted Answer

Cisco Umbrella AD Connector. To protect roaming users and apply policies based on identity, the Umbrella Roaming Client is needed on endpoints to direct DNS to Umbrella, and the AD Connector is needed to sync user identities from Active Directory. The Virtual Appliance is for on-premises DNS forwarding, SIG is for cloud-delivered internet security, and ISE is an on-premises identity platform, so they do not satisfy both requirements together.

Answer

Cisco Umbrella SIG

Answer

Cisco Umbrella Virtual Appliance

Answer

Cisco Identity Services Engine

Question 14

A company is moving its on-premises applications to AWS EC2 instances. According to the shared responsibility model, which of the following is the customer's responsibility?

Accepted Answer

Patching the guest operating system. In IaaS, the cloud provider manages the physical infrastructure (hosts, network, hypervisor), while the customer is responsible for securing the guest OS, applications, and data. Patching the OS is a customer responsibility.

Answer

Hypervisor security

Answer

Network infrastructure hardening

Answer

Physical security of the data center

Question 15

An organization uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which cloud security solution should be deployed?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) is deployed to enforce security policies, including DLP, for cloud applications and services. It acts as an intermediary between users and SaaS applications, providing visibility and control to prevent sensitive data from being shared externally.

Answer

Web Application Firewall (WAF)

Answer

Cloud Security Posture Management (CSPM)

Answer

Cloud Workload Protection Platform (CWPP)