350-701 Cloud Security Practice Test 3 — 15 Questions

Question 1

An organization uses Cisco Umbrella's Secure Internet Gateway (SIG). Which of the following sets of capabilities is typically included in a SIG solution?

Accepted Answer

Cloud-delivered firewall and web proxy. The correct answer is D, which lists two core capabilities of a Secure Internet Gateway (SIG): cloud-delivered firewall and web proxy. Options A, B, and C are incorrect because A (IPS) is often a separate security function, B (DLP for data at rest) is not typically part of a SIG (DLP for data in motion may be included), and C (DNS-layer security only) is a subset but not the full SIG capability.

Answer

Intrusion prevention system (IPS)

Answer

DLP for data at rest

Answer

DNS-layer security only

Question 2

A cloud security architect is designing zero trust for a multi-cloud environment. Which principle is most critical?

Accepted Answer

Identity as the new perimeter. Zero trust assumes no implicit trust; identity becomes the primary perimeter for access control.

Answer

Use of VPNs for all remote access

Answer

Encryption of all data in transit

Answer

Network segmentation using firewalls

Question 3

A security team wants to inspect SSL-encrypted traffic from users accessing SaaS applications through Cisco Umbrella. Which feature should they enable?

Accepted Answer

Intelligent Proxy. Intelligent Proxy allows selective SSL inspection based on policies.

Answer

Roaming client

Answer

DNS-layer blocking

Answer

SIG cloud firewall

Question 4

Which cloud security control is specifically designed to protect workloads such as VMs and containers from threats?

Accepted Answer

CWPP. CWPP (Cloud Workload Protection Platform) provides security for workloads across clouds.

Answer

CSPM

Answer

CASB

Answer

SIG

Question 5

A company uses Azure and wants to restrict network traffic between subnets. Which Azure resource should they use?

Accepted Answer

Network Security Group (NSG). Network Security Groups (NSGs) filter traffic between subnets based on rules.

Answer

Azure DDoS Protection

Answer

Azure Policy

Answer

Azure Firewall

Question 6

In a DevSecOps pipeline, a team wants to prevent secrets (e.g., API keys) from being stored in source code. Which approach is most effective?

Accepted Answer

Use a secrets management tool like Vault. Using a secrets management tool like HashiCorp Vault ensures secrets are stored securely and not in code.

Answer

Store secrets in environment variables

Answer

Use container image scanning

Answer

Encrypt secrets in code

Question 7

An organization wants to protect their web application hosted on AWS from common exploits like SQL injection. Which Cisco service should they use?

Accepted Answer

Cisco Firepower Next-Generation Firewall (NGFW). Cisco Firepower Next-Generation Firewall (NGFW) with Intrusion Prevention System (IPS) can detect and block SQL injection attacks by inspecting HTTP traffic for malicious payloads. It provides application-layer protection through signature-based and behavioral analysis. The other options: ISE is for identity and access management, Stealthwatch for network visibility, and WSA is a web proxy without native WAF capabilities.

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Stealthwatch

Answer

Cisco Web Security Appliance (WSA)

Question 8

In the shared responsibility model for cloud security, which responsibility is the customer's in an IaaS deployment?

Accepted Answer

Operating system security patches and updates. In IaaS, the cloud provider manages the physical infrastructure and hypervisor, while the customer manages the operating system, applications, and data.

Answer

Physical security of data centers

Answer

Network infrastructure including switches and routers

Answer

Hypervisor vulnerability management

Question 9

A security team wants to gain visibility into shadow IT usage of SaaS applications and enforce DLP policies for data shared via cloud apps. Which cloud security solution should they deploy?

Accepted Answer

Cloud Access Security Broker (CASB). A CASB provides visibility, DLP, and threat detection for SaaS applications, helping control shadow IT and protect data.

Answer

Cisco Umbrella Secure Internet Gateway (SIG)

Answer

Cloud Security Posture Management (CSPM)

Answer

Cloud Workload Protection Platform (CWPP)

Question 10

An organization uses Cisco Umbrella to block malicious domains. The security team notices that some malware traffic bypasses DNS-layer blocking because the malware uses hardcoded IP addresses. Which Umbrella feature should be enabled to additionally inspect traffic at the IP layer?

Accepted Answer

Secure Internet Gateway (SIG). Cisco Umbrella's Secure Internet Gateway (SIG) provides cloud-delivered firewall and web proxy that can inspect IP-based traffic, not just DNS.

Answer

Intelligent Proxy

Answer

DNS-layer security

Answer

Umbrella Roaming Client

Question 11

A company is deploying a multi-tier application on AWS. The web servers must be accessible from the internet only on ports 80 and 443, while the database servers should be accessible only from the web servers on port 3306. Which combination of cloud network security controls should be used?

Accepted Answer

Security groups for each tier and a Network ACL on the database subnet. Security groups act as instance-level firewalls, allowing stateful filtering. NACLs are stateless and applied at the subnet level. Typically, security groups for each tier and NACLs for subnet-level filtering are used.

Answer

Only security groups for both tiers, no NACLs

Answer

Only Network ACLs for both subnets, no security groups

Answer

Network ACLs for the web tier and security groups for the database tier

Question 12

A DevOps team is building a CI/CD pipeline for a cloud-native application. They want to automatically check Terraform scripts for insecure configurations before deployment. Which tool should be integrated into the pipeline?

Accepted Answer

Checkov. Checkov is a static analysis tool specifically designed to scan Infrastructure as Code (IaC) files like Terraform for security misconfigurations.

Answer

Container image scanner

Answer

SAST scanner

Answer

DAST scanner

Question 13

An organization is adopting a zero-trust model for cloud access. Which component enforces conditional access policies based on user, device, location, and risk level in Azure AD?

Accepted Answer

Azure AD Conditional Access. Azure AD Conditional Access evaluates signals (user, device, location, risk) and enforces policies like requiring MFA or blocking access.

Answer

Azure AD Identity Protection

Answer

Azure Security Center

Answer

Privileged Identity Management (PIM)

Question 14

In the shared responsibility model, which is the customer's responsibility in a SaaS model?

Accepted Answer

Data classification and access control. In SaaS, the provider manages the application, runtime, OS, and infrastructure. The customer is responsible for data and access management.

Answer

Network security

Answer

Physical data center security

Answer

Application security patches

Question 15

Which Cisco Umbrella feature provides off-network protection by intercepting DNS requests on a user's device?

Accepted Answer

Umbrella Roaming Client. The Umbrella Roaming Client is installed on endpoints and redirects DNS queries to Cisco Umbrella even when the device is off the corporate network.

Answer

Secure Internet Gateway (SIG)

Answer

Cisco AnyConnect

Answer

Intelligent Proxy