350-701 Cloud Security Practice Test 3 — 15 Questions

Question 1

An organization wants to implement zero trust principles for cloud access. Which of the following is a key component of a zero trust architecture in the cloud?

Accepted Answer

Multi-factor authentication (MFA) for all access. Zero trust assumes no implicit trust and requires continuous verification. Identity is the new perimeter, and MFA is a core enforcement mechanism. VPNs create a trusted network model, which is contrary to zero trust. Perimeter firewalls are less relevant. Single password only is inadequate.

Answer

Site-to-site VPN to cloud

Answer

Strong perimeter firewall

Answer

Single sign-on with one password

Question 2

Which of the following is the primary function of a Cloud Security Posture Management (CSPM) tool?

Accepted Answer

Monitor and remediate cloud misconfigurations against benchmarks. CSPM tools continuously scan cloud environments (AWS, Azure, GCP) against security benchmarks such as CIS, NIST, and PCI DSS to detect misconfigurations like public S3 buckets, overly permissive IAM roles, and disabled logging. Their primary function is to identify, alert on, and often auto-remediate these posture issues. This is distinct from runtime workload protection or network-layer filtering.

Answer

Block malicious domains at the DNS layer

Answer

Protect workloads from malware

Answer

Provide DLP for SaaS applications

Question 3

A company uses Cisco Umbrella to provide DNS-layer security. An employee tries to visit a website that is hosting malware, but the domain is not yet categorized. How does Umbrella handle this request?

Accepted Answer

The request is blocked if the domain is identified as malicious by Umbrella's threat intelligence. Cisco Umbrella uses threat intelligence to block requests to domains that are known to be malicious, even if they are not yet categorized. If the domain is identified as malicious by Umbrella's threat intelligence, the request is blocked. This is a core feature of Umbrella's DNS-layer security.

Answer

The request is redirected to a captive portal for user awareness

Answer

The request is allowed because the domain is not categorized

Answer

The request is proxied through the intelligent proxy for inspection

Question 4

An organization is deploying containerized applications in a Kubernetes cluster on AWS EKS. They need to ensure that container images are scanned for vulnerabilities before deployment. Which approach aligns with DevSecOps best practices?

Accepted Answer

Integrate image scanning into the CI/CD pipeline before pushing to registry. Integrating image scanning into the CI/CD pipeline before pushing to the registry is a DevSecOps best practice: vulnerabilities are caught early, before deployment, and the pipeline can fail the build if critical issues are found. This shifts security left and prevents vulnerable images from reaching production.

Answer

Scan container images after deployment using a runtime scanner

Answer

Manually review images before deployment

Answer

Only scan base images, not application layers

Question 5

A security team is implementing AWS WAF to protect a web application. They want to block requests that contain SQL injection patterns in the query string. Which AWS WAF component should be used?

Accepted Answer

Managed rule group for SQL injection. AWS WAF uses managed rule groups (e.g., the SQL injection rule group) to detect common attack patterns. Custom rules can also be written but the easiest is to use the managed rule group. NACLs and security groups operate at network level, not application layer.

Answer

Security group allowing only HTTPS

Answer

Network ACL with deny rule for port 80

Answer

Custom rule matching on source IP

Question 6

In the shared responsibility model for PaaS, which of the following is typically the customer's responsibility?

Accepted Answer

Securing the application code and data. In the PaaS shared responsibility model, the customer is responsible for securing their application code and data, while the provider manages the underlying infrastructure, OS, and hypervisor. This division means the customer must handle application-level security, including code vulnerabilities, data encryption, and access controls.

Answer

Securing the hypervisor

Answer

Patching the underlying operating system

Answer

Managing network firewall rules

Question 7

A DevSecOps team is implementing secrets management for a cloud-native application. They want to avoid storing secrets in environment variables or code. Which solution should they use?

Accepted Answer

Use HashiCorp Vault to dynamically generate and manage secrets. HashiCorp Vault is a dedicated secrets management solution that dynamically generates, leases, and revokes secrets, and integrates with cloud-native platforms via sidecars or CSI drivers. It avoids hardcoding secrets in images, environment variables, or repositories by providing secure injection at runtime.

Answer

Embed secrets in the container image

Answer

Pass secrets via command-line arguments

Answer

Store secrets in a configuration file in the repository

Question 8

An organization is adopting zero trust principles for cloud access. Which THREE measures are essential for implementing identity-centric security? (Choose three.)

Accepted Answer

Conditional access policies based on user, device, and location. Option B is correct because conditional access policies evaluate signals such as user identity, device compliance state, and location to enforce real-time, context-aware access decisions, which is the core of identity-centric zero trust. Option D is correct because Privileged Identity Management (PIM) with just-in-time access eliminates standing privileged credentials, granting elevated roles only when needed and after approval, thereby reducing the attack surface for identity-based threats. Option E is correct because multi-factor authentication for all users strengthens identity verification by requiring a second factor beyond a password, directly mitigating credential theft and replay attacks. Option A does not belong because a site-to-site VPN provides network-level tunnel connectivity rather than identity-centric access control. Option C does not belong because VLAN segmentation is a network-based isolation control, not an identity-driven enforcement mechanism.

Answer

Site-to-site VPN for connectivity

Answer

Network segmentation using VLANs

Question 9

A company is using Azure and wants to enforce security compliance across their cloud resources. Which TWO services are part of CSPM (Cloud Security Posture Management) in Azure? (Choose two.)

Accepted Answer

Azure Security Center (Defender for Cloud). Azure Security Center, now known as Microsoft Defender for Cloud, is correct (A) because it is Microsoft's core CSPM solution that continuously assesses Azure resources against security benchmarks like the Microsoft Cloud Security Benchmark, surfaces secure score, and provides recommendations to remediate misconfigurations. Azure Policy is also correct (B) because it enforces organizational standards and compliance by evaluating resources against built-in or custom policy definitions and applying deny, audit, or deployIfNotExists effects, which is a foundational CSPM control mechanism. Microsoft Entra ID (C) is an identity and access management service, not a posture management tool, so it does not belong. Azure Monitor (D) is a telemetry and observability platform for metrics, logs, and alerts rather than a compliance posture service. Azure WAF (E) is a web application firewall that protects HTTP/S traffic from exploits like SQL injection and XSS, which is workload protection, not CSPM.

Answer

Azure Active Directory

Answer

Azure Monitor

Answer

Azure WAF

Question 10

In the shared responsibility model for cloud services, which layer is the customer responsible for managing in an IaaS environment?

Accepted Answer

Operating system, applications, and data. In the IaaS shared responsibility model, the cloud provider secures the physical infrastructure (servers, networking, hypervisor), while the customer is responsible for everything from the guest OS upward — including the operating system, middleware, applications, and data. This is the defining characteristic of IaaS: the customer manages the OS and above.

Answer

Virtual machines and storage only

Answer

Only data and access policies

Answer

Physical servers and networking

Question 11

A security team wants to gain visibility into Shadow IT usage of SaaS applications and enforce data loss prevention policies. Which cloud security solution should they deploy?

Accepted Answer

CASB. A CASB (Cloud Access Security Broker) is specifically designed to provide visibility into SaaS usage (including Shadow IT discovery) and enforce DLP policies on cloud traffic. It sits between users and cloud services, using APIs or proxies to inspect data and apply granular controls. CSPM, CWPP, and Umbrella address different layers and do not provide the combined SaaS visibility plus DLP enforcement required here.

Answer

CSPM

Answer

Cisco Umbrella

Answer

CWPP

Question 12

An organization uses Cisco Umbrella to block malicious domains. Which layer does Umbrella primarily operate at to prevent connections before they are established?

Accepted Answer

DNS layer. Cisco Umbrella's core security enforcement point is the DNS layer — it intercepts DNS queries from endpoints and forwards them to Umbrella's global resolvers, which block requests to malicious or unwanted domains before any TCP connection to the destination is established. Because DNS resolution is a prerequisite for nearly all outbound connections, blocking at this layer prevents the connection from ever being initiated. This is why Umbrella is described as a first line of defense that operates before IP or application-layer controls come into play.

Answer

Network layer (IP filtering)

Answer

Application layer

Answer

Transport layer

Question 13

A company wants to ensure that no cloud workload has a public IP address attached to a network security policy that allows inbound SSH from the entire internet. Which Cisco security product can continuously monitor and alert on such misconfigurations?

Accepted Answer

Cisco Secure Cloud Analytics. Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) is a cloud security posture management (CSPM) tool that continuously monitors cloud environments against security benchmarks and alerts on violations such as open SSH from the internet.

Answer

Cisco Umbrella

Answer

Cisco Firepower Management Center

Answer

Cisco Identity Services Engine

Question 14

A DevSecOps team is integrating security into their CI/CD pipeline. They want to scan Terraform configuration files for misconfigurations before deployment. Which tool is specifically designed for that purpose?

Accepted Answer

Checkov. Checkov is an open-source static analysis tool specifically built to scan Infrastructure as Code (IaC) files, including Terraform, CloudFormation, Kubernetes manifests, and others, for security and compliance misconfigurations. It parses Terraform HCL and plan files to detect issues like open security groups, unencrypted storage, or overly permissive IAM policies before deployment. Unlike generic SAST or DAST tools, Checkov understands the declarative syntax and resource relationships unique to IaC, making it the right fit for pre-deployment Terraform scanning.

Answer

DAST scanner

Answer

SAST scanner

Answer

Container image scanner

Question 15

In the shared responsibility model for PaaS, which of the following is the customer responsible for?

Accepted Answer

Applications and data. In the shared responsibility model for PaaS, the customer is responsible for securing their applications and data, while the cloud provider manages the underlying infrastructure, including the operating system, runtime, and physical infrastructure. This is because PaaS provides a platform where the customer deploys their own code and manages data, but the provider handles the platform layers.

Answer

Operating system patching

Answer

Runtime environment

Answer

Physical infrastructure