350-701 Cloud Security Practice Test 5 — 15 Questions

Question 1

A company uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which technology provides the ability to scan data in transit and at rest within these SaaS applications?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CASB. CASB solutions can inspect data in transit and at rest within SaaS applications to enforce DLP policies.

Answer

Cisco Umbrella

Answer

CSPM

Answer

CWPP

Question 2

A security engineer is configuring Cisco Umbrella Intelligent Proxy to selectively decrypt and inspect HTTPS traffic. The goal is to balance security and user privacy by only inspecting traffic to high-risk domains. How does Intelligent Proxy decide which traffic to inspect?

Accepted Answer

It evaluates domains against Cisco's security categories and only inspects domains that match certain categories.. Intelligent Proxy uses Cisco Umbrella's security intelligence to categorize domains and selectively apply SSL inspection to those classified as high risk or based on policy.

Answer

It inspects all HTTPS traffic by default.

Answer

It uses a list of manually configured domains.

Answer

It inspects traffic based on the user's identity.

Question 3

A security team is implementing a DevSecOps pipeline for containerized applications. Which TWO of the following practices should be included to ensure container security?

Accepted Answer

Secrets management (avoiding hardcoded secrets in images). Container image scanning checks for vulnerabilities in images, and secrets management prevents exposure of sensitive data in code.

Answer

DAST (Dynamic Application Security Testing)

Answer

IaC security scanning

Answer

Manual code review

Question 4

An organization is adopting zero trust principles for cloud access. Which THREE components should be implemented to enforce identity as the new perimeter?

Accepted Answer

Multi-Factor Authentication (MFA) for all cloud access. MFA ensures strong authentication, PIM manages privileged access, and conditional access policies enforce context-based controls.

Answer

Network segmentation via VLANs

Answer

Firewall rules based on source IP

Question 5

A company uses AWS and Azure and wants to protect its cloud workloads (VMs and containers) from threats. Which TWO technologies are specifically designed for workload protection in the cloud?

Accepted Answer

CWPP (Cloud Workload Protection Platform). CWPP (Cloud Workload Protection Platform) is specifically for workload security, and container image scanning is a key component of CWPP for containers.

Answer

CASB

Answer

Cloud WAF

Answer

CSPM

Question 6

In the shared responsibility model for cloud security, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Operating system and application security. In IaaS, the cloud provider manages the physical infrastructure, virtualization, and network, while the customer manages the operating system, applications, and data.

Answer

Hypervisor security

Answer

Network infrastructure security

Answer

Physical security of the data center

Question 7

A company is using a SaaS application like Office 365. Which security responsibility falls on the customer according to the shared responsibility model?

Accepted Answer

Data classification and access policies. In SaaS, the provider manages the application and infrastructure, while the customer manages data and access control.

Answer

Operating system patching

Answer

Physical security of servers

Answer

Network firewall management

Question 8

A security team wants to gain visibility into shadow IT usage of cloud applications and enforce data loss prevention policies. Which cloud security control should they deploy?

Accepted Answer

CASB. CASB provides visibility, DLP, and threat detection for sanctioned and unsanctioned cloud apps.

Answer

Cloud WAF

Answer

CWPP

Answer

CSPM

Question 9

An organization uses Cisco Umbrella to block malicious domains. What is the primary security benefit of DNS-layer security?

Accepted Answer

It blocks malicious domains before a connection is made. DNS-layer security blocks requests to malicious domains at the DNS level, preventing the connection from being established.

Answer

It performs deep packet inspection on all traffic

Answer

It provides SSL decryption for all web traffic

Answer

It encrypts all DNS traffic to prevent eavesdropping

Question 10

A company is deploying Cisco Umbrella with the Intelligent Proxy feature. Under what condition does the Intelligent Proxy perform SSL decryption?

Accepted Answer

Only for traffic to websites with low reputation or in high-risk categories. Intelligent Proxy selectively decrypts SSL traffic for high-risk categories or domains, based on policy, to inspect content while preserving user privacy for safe sites.

Answer

For all web traffic from the roaming client

Answer

Only for traffic using non-standard ports

Answer

Only when the user is on-network

Question 11

In AWS, which resource acts as a stateful firewall at the instance level to control inbound and outbound traffic?

Accepted Answer

Security Group. Security groups in AWS are stateful firewalls that operate at the instance level, while NACLs are stateless at the subnet level.

Answer

Network ACL

Answer

Internet Gateway

Answer

VPC Flow Logs

Question 12

A security architect is designing a zero-trust model for cloud access. Which of the following is a core principle of zero trust in the cloud?

Accepted Answer

Identity is the new perimeter. Zero trust assumes no implicit trust and requires identity verification for every access request, using identity as the primary perimeter.

Answer

All traffic must be inspected by a next-generation firewall

Answer

Network segmentation is the primary security control

Answer

VPNs are required for all cloud access

Question 13

In a DevSecOps pipeline, which tool would be used to scan Infrastructure as Code (IaC) templates for security misconfigurations?

Accepted Answer

Checkov. Checkov is an open-source tool that scans Terraform, CloudFormation, and other IaC templates for security issues.

Answer

SAST tool

Answer

Container image scanner

Answer

DAST tool

Question 14

A security engineer needs to prevent secrets (e.g., API keys) from being stored in code repositories. Which DevSecOps practice should be implemented?

Accepted Answer

Implement secrets management using a tool like Vault. Secrets management tools like HashiCorp Vault securely store and manage secrets, avoiding hardcoding in code.

Answer

Use a SAST scanner to find secrets in code

Answer

Encrypt the code repository

Answer

Use a DAST tool to test for secrets

Question 15

Which cloud workload protection platform (CWPP) capability is essential for protecting containerized applications?

Accepted Answer

Container image vulnerability scanning. CWPP for containers includes image scanning for vulnerabilities and runtime security, but image scanning is a fundamental capability.

Answer

Web application firewall

Answer

Network micro-segmentation

Answer

Identity and access management