350-701 Cloud Security Practice Test 4 — 15 Questions

Question 1

A security engineer is configuring Cisco Umbrella to block HTTPS traffic to malicious sites. However, they want to inspect SSL-encrypted traffic selectively to avoid breaking applications. Which Umbrella feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Intelligent Proxy. The Intelligent Proxy in Cisco Umbrella allows selective SSL decryption based on rules, enabling inspection of traffic to risky categories while bypassing trusted applications.

Answer

DNS-layer security

Answer

Umbrella Roaming Client

Answer

Secure Internet Gateway (SIG)

Question 2

An organization uses AWS WAF to protect its web application. They need to block requests from a specific geographic region. What should they configure?

Accepted Answer

AWS WAF geo match rule. AWS WAF allows creating rules based on geographic location (geo match) to allow or block requests from specific countries.

Answer

CloudFront geo restriction

Answer

Security group with IP-based deny rule

Answer

Network ACL with IP deny rule

Question 3

A company is moving workloads to Google Cloud and needs private connectivity between its on-premises data center and VPC without traversing the internet. Which service should be used?

Accepted Answer

Google Cloud Dedicated Interconnect. Google Cloud Dedicated Interconnect provides direct private physical connections between on-premises and GCP VPCs.

Answer

Azure ExpressRoute

Answer

AWS Direct Connect

Answer

Cloud VPN

Question 4

A security team is implementing DevSecOps practices. Which TWO actions should be taken to secure secrets (e.g., API keys, passwords) in a CI/CD pipeline? (Choose two.)

Accepted Answer

Use a secrets management tool like HashiCorp Vault. Secrets should never be hardcoded in code; instead, use a secrets management tool like HashiCorp Vault or cloud-native secret stores. Also, scan for leaked secrets using tools like git-secrets.

Answer

Share secrets via email to team members

Answer

Hardcode secrets in the source code with comments to remind developers

Answer

Store secrets in environment variables in the pipeline configuration

Question 5

A company is adopting a zero-trust security model for its cloud environment. Which THREE practices align with zero-trust principles? (Choose three.)

Accepted Answer

Use privileged identity management (PIM) for just-in-time access. Zero trust assumes no implicit trust; verify every request. MFA, conditional access, and privileged identity management are key components.

Answer

Trust all traffic from within the corporate network

Answer

Grant permanent administrative privileges for convenience

Question 6

A security engineer is designing cloud workload protection (CWPP) for a hybrid environment with VMs and containers. Which TWO capabilities should a CWPP solution provide? (Choose two.)

Accepted Answer

Intrusion prevention system (IPS) for workloads. CWPP solutions focus on workload protection including vulnerability scanning, intrusion detection, file integrity monitoring, and sometimes container security.

Answer

Cloud security posture management (CSPM) for configuration

Answer

DNS-layer security for user devices

Answer

Data loss prevention (DLP) for SaaS applications

Question 7

In the shared responsibility model for cloud computing, which responsibility is managed by the customer in all service models (IaaS, PaaS, SaaS)?

Accepted Answer

Data and access management. In all cloud service models, the customer is always responsible for their own data and access management, including who has access to the data and how it is protected.

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Answer

Hypervisor patching

Question 8

A security administrator wants to enforce a policy that blocks upload of sensitive data to unauthorized cloud applications. Which technology should be used to gain visibility and control over sanctioned and unsanctioned SaaS applications?

Accepted Answer

CASB. A CASB (Cloud Access Security Broker) provides visibility into SaaS usage and enables data loss prevention (DLP) policies to control data uploads to cloud apps.

Answer

Cisco Umbrella SIG

Answer

CWPP

Answer

CSPM

Question 9

An organization uses Cisco Umbrella to protect remote users. The security team notices that some malicious domains are not blocked because users are bypassing the DNS layer by using direct IP connections or non-DNS protocols. Which Cisco Umbrella feature should be enabled to inspect all traffic, including non-web traffic, and enforce policies regardless of DNS resolution?

Accepted Answer

Secure Internet Gateway (SIG). The Cisco Umbrella Secure Internet Gateway (SIG) provides a cloud-delivered firewall that can inspect all traffic (including non-web) and enforce policies without relying solely on DNS blocking.

Answer

Intelligent Proxy

Answer

Umbrella Roaming Client

Answer

DNS-layer Security

Question 10

A company is deploying workloads in AWS and wants to ensure that the security groups are not overly permissive. They need to continuously monitor for misconfigurations and compare against the CIS AWS Foundations Benchmark. Which tool should be used?

Accepted Answer

CSPM. CSPM (Cloud Security Posture Management) tools continuously monitor cloud configurations and compare against benchmarks like CIS to detect misconfigurations.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

CASB

Question 11

To enforce zero trust principles in a cloud environment, an administrator requires all access to cloud resources to be authenticated and authorized based on user identity and device health. Which Cisco Duo feature enables policies that consider conditions such as location, device compliance, and risk level?

Accepted Answer

Duo Access Policies. Cisco Duo Access Policies allow administrators to create policies that enforce access controls based on conditions like user location, device compliance, and sign-in risk.

Answer

Duo Multi-Factor Authentication (MFA)

Answer

Duo Device Health

Answer

Duo Privileged Access Management

Question 12

In a DevSecOps pipeline, a security engineer wants to automatically scan Infrastructure as Code (IaC) templates for security misconfigurations before deployment. Which tool is commonly used for static analysis of Terraform templates?

Accepted Answer

Checkov. Checkov is a static analysis tool specifically designed for scanning IaC files like Terraform to find security misconfigurations.

Answer

SAST scanner

Answer

DAST scanner

Answer

Container image scanner

Question 13

A security team is implementing secure access for remote users connecting from untrusted networks. They want to enforce DNS-layer security even when users are off the corporate network. Which Cisco Umbrella feature should be deployed on the endpoints?

Accepted Answer

Umbrella Roaming Client. The Cisco Umbrella Roaming Client provides DNS-layer security for endpoints regardless of their network location, including off-network protection.

Answer

Secure Internet Gateway (SIG)

Answer

Intelligent Proxy

Answer

Virtual Appliance

Question 14

An organization uses Azure for its cloud workloads. To protect web applications from common exploits like SQL injection and cross-site scripting, they need to deploy a web application firewall (WAF) that integrates with Azure Application Gateway. Which Azure WAF SKU should they choose?

Accepted Answer

Azure Application Gateway WAF_v2. Azure WAF can be deployed with Application Gateway (WAF_v2 SKU) or Front Door. The WAF_v2 SKU of Application Gateway provides integrated WAF capabilities.

Answer

Azure Firewall Premium

Answer

Azure DDoS Protection

Answer

Azure WAF on Azure Front Door

Question 15

In the shared responsibility model for PaaS, which component is the customer responsible for managing?

Accepted Answer

Data and applications. In PaaS, the customer manages applications and data, while the provider manages the runtime, infrastructure, and OS.

Answer

Network infrastructure

Answer

Hypervisor

Answer

Operating system