350-701 Cloud Security Practice Test 5 — 15 Questions

Question 1

A security team is implementing DevSecOps practices. Which TWO actions should be taken to secure secrets (e.g., API keys, passwords) in a CI/CD pipeline? (Choose two.)

Accepted Answer

Use a secrets management tool like HashiCorp Vault. Option C is correct because a dedicated secrets management tool such as HashiCorp Vault centralizes storage, enforces access control, and can dynamically issue short-lived credentials, so API keys and passwords are never embedded in code or pipeline files. Option D is correct because scanning repositories with tools like git-secrets detects accidentally committed credentials early in the CI/CD pipeline, allowing them to be revoked and rotated before they are exploited. Option A is wrong because email is an unencrypted, unauditable channel that exposes secrets to unintended recipients and violates least-privilege handling. Option B is wrong because hardcoding secrets in source code permanently exposes them to anyone with repository access and to history scraping. Option E is wrong because environment variables in pipeline configuration are often stored in plaintext, visible in logs or job definitions, and lack the rotation, auditing, and fine-grained access control that a proper secrets manager provides.

Answer

Share secrets via email to team members

Answer

Hardcode secrets in the source code with comments to remind developers

Answer

Store secrets in environment variables in the pipeline configuration

Question 2

A company is adopting a zero-trust security model for its cloud environment. Which THREE practices align with zero-trust principles? (Choose three.)

Accepted Answer

Use privileged identity management (PIM) for just-in-time access. Option A is correct because privileged identity management (PIM) enforces just-in-time elevation of privileges, so administrative rights are granted only when needed and expire automatically, which directly supports zero-trust's least-privilege and never-trust-implicitly principles. Option D is correct because requiring multi-factor authentication (MFA) for all cloud access verifies identity with more than a single factor and prevents access based solely on network location, a core zero-trust requirement. Option E is correct because conditional access policies evaluate signals such as user identity, device compliance, location, and risk to make dynamic, context-aware authorization decisions, which is exactly how zero-trust grants access per request. Option B is not correct because trusting all traffic from the corporate network is the implicit-trust perimeter model that zero-trust explicitly rejects. Option C is not correct because granting permanent administrative privileges violates least privilege and standing-access reduction, both central to zero-trust.

Answer

Trust all traffic from within the corporate network

Answer

Grant permanent administrative privileges for convenience

Question 3

A security engineer is designing cloud workload protection (CWPP) for a hybrid environment with VMs and containers. Which TWO capabilities should a CWPP solution provide? (Choose two.)

Accepted Answer

Intrusion prevention system (IPS) for workloads. Option B is correct because a CWPP solution must protect running workloads in hybrid VM and container environments, and an intrusion prevention system (IPS) provides runtime threat detection and blocking of malicious activity such as exploits, shellcode, and lateral movement at the workload level. Option E is correct because CWPP includes vulnerability scanning of the operating system and installed applications on VMs and container images, identifying missing patches and known CVEs so they can be remediated before exploitation. Option A is not correct here because CSPM addresses cloud configuration and compliance posture rather than runtime workload protection, which is the focus of CWPP. Option C is not correct because DNS-layer security protects user devices and outbound name resolution, not VM or container workloads. Option D is not correct because DLP for SaaS applications is a data-centric control for cloud services, not a CWPP workload protection capability.

Answer

Cloud security posture management (CSPM) for configuration

Answer

DNS-layer security for user devices

Answer

Data loss prevention (DLP) for SaaS applications

Question 4

In the shared responsibility model for cloud computing, which responsibility is managed by the customer in all service models (IaaS, PaaS, SaaS)?

Accepted Answer

Data and access management. In all cloud service models, the customer is always responsible for their own data and access management, including who has access to the data and how it is protected.

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Answer

Hypervisor patching

Question 5

A security administrator wants to enforce a policy that blocks upload of sensitive data to unauthorized cloud applications. Which technology should be used to gain visibility and control over sanctioned and unsanctioned SaaS applications?

Accepted Answer

CASB. A CASB (Cloud Access Security Broker) is purpose-built to sit between users and cloud services, providing visibility into sanctioned and unsanctioned SaaS usage and enforcing data-loss-prevention policies such as blocking uploads of sensitive data. It discovers shadow IT, classifies data, and applies granular controls (upload/download/block) across SaaS apps. This directly matches the requirement to gain visibility and control over SaaS applications.

Answer

Cisco Umbrella SIG

Answer

CWPP

Answer

CSPM

Question 6

An organization uses Cisco Umbrella to protect remote users. The security team notices that some malicious domains are not blocked because users are bypassing the DNS layer by using direct IP connections or non-DNS protocols. Which Cisco Umbrella feature should be enabled to inspect all traffic, including non-web traffic, and enforce policies regardless of DNS resolution?

Accepted Answer

Secure Internet Gateway (SIG). Cisco Umbrella Secure Internet Gateway (SIG) is the correct answer because it extends protection beyond DNS-layer security to inspect all traffic, including non-web and non-DNS protocols, by acting as a cloud-based secure web gateway. SIG provides full Layer 3/4 and Layer 7 inspection, enforcing policies on direct IP connections, non-standard ports, and protocols like SSH or FTP that bypass DNS filtering. This ensures that even if a user attempts to connect directly to a malicious IP, the traffic is still inspected and blocked according to policy.

Answer

Intelligent Proxy

Answer

Umbrella Roaming Client

Answer

DNS-layer Security

Question 7

A company is deploying workloads in AWS and wants to ensure that the security groups are not overly permissive. They need to continuously monitor for misconfigurations and compare against the CIS AWS Foundations Benchmark. Which tool should be used?

Accepted Answer

CSPM. A Cloud Security Posture Management (CSPM) tool is purpose-built to continuously scan cloud environments for misconfigurations, drift, and policy violations, and it natively maps findings to benchmarks like CIS AWS Foundations. CSPM solutions (e.g., AWS Security Hub, Prisma Cloud, Wiz) ingest configuration data across accounts and regions and produce compliance scores against CIS, PCI-DSS, and other frameworks. This directly matches the requirement for continuous monitoring against the CIS benchmark.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

CASB

Question 8

To enforce zero trust principles in a cloud environment, an administrator requires all access to cloud resources to be authenticated and authorized based on user identity and device health. Which Cisco Duo feature enables policies that consider conditions such as location, device compliance, and risk level?

Accepted Answer

Duo Access Policies. Cisco Duo Access Policies allow administrators to create policies that enforce access controls based on conditions like user location, device compliance, and sign-in risk.

Answer

Duo Multi-Factor Authentication (MFA)

Answer

Duo Device Health

Answer

Duo Privileged Access Management

Question 9

In a DevSecOps pipeline, a security engineer wants to automatically scan Infrastructure as Code (IaC) templates for security misconfigurations before deployment. Which tool is commonly used for static analysis of Terraform templates?

Accepted Answer

Checkov. Checkov is a static analysis tool specifically designed for scanning IaC files like Terraform to find security misconfigurations.

Answer

SAST scanner

Answer

DAST scanner

Answer

Container image scanner

Question 10

A security team is implementing secure access for remote users connecting from untrusted networks. They want to enforce DNS-layer security even when users are off the corporate network. Which Cisco Umbrella feature should be deployed on the endpoints?

Accepted Answer

Umbrella Roaming Client. The Umbrella Roaming Client is a lightweight endpoint agent that enforces DNS-layer security on devices even when they are off the corporate network, forwarding DNS queries to Umbrella's global network for policy enforcement. This directly addresses the requirement to protect remote users on untrusted networks at the DNS layer.

Answer

Secure Internet Gateway (SIG)

Answer

Intelligent Proxy

Answer

Virtual Appliance

Question 11

In the shared responsibility model for PaaS, which component is the customer responsible for managing?

Accepted Answer

Data and applications. In the PaaS shared responsibility model, the cloud provider manages the underlying infrastructure — network, servers, hypervisor, and the runtime/OS — while the customer is responsible for their data and the applications they deploy on top of the platform. This is the defining characteristic of PaaS: the customer focuses on code and data, not infrastructure.

Answer

Network infrastructure

Answer

Hypervisor

Answer

Operating system

Question 12

A company uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which technology provides the ability to scan data in transit and at rest within these SaaS applications?

Accepted Answer

CASB. CASB solutions can inspect data in transit and at rest within SaaS applications to enforce DLP policies.

Answer

Cisco Umbrella

Answer

CSPM

Answer

CWPP

Question 13

A security engineer is configuring Cisco Umbrella Intelligent Proxy to selectively decrypt and inspect HTTPS traffic. The goal is to balance security and user privacy by only inspecting traffic to high-risk domains. How does Intelligent Proxy decide which traffic to inspect?

Accepted Answer

It evaluates domains against Cisco's security categories and only inspects domains that match certain categories.. Cisco Umbrella Intelligent Proxy uses Cisco's threat intelligence and domain categorization to selectively decrypt HTTPS traffic. It only performs SSL/TLS interception (decryption) for domains that fall into specific security categories deemed high-risk (e.g., newly seen domains, malware, phishing, or other risky categories), while leaving traffic to trusted, benign categories encrypted. This balances inspection coverage with user privacy and performance.

Answer

It inspects all HTTPS traffic by default.

Answer

It uses a list of manually configured domains.

Answer

It inspects traffic based on the user's identity.

Question 14

A security team is implementing a DevSecOps pipeline for containerized applications. Which TWO of the following practices should be included to ensure container security?

Accepted Answer

Secrets management (avoiding hardcoded secrets in images). Option A (Secrets management, avoiding hardcoded secrets in images) is correct because container images are frequently pushed to registries and layered on disk, so embedding credentials in Dockerfiles or image layers exposes them to anyone who can pull the image; using a secrets manager or mounted secrets keeps sensitive values out of the image and injects them at runtime. Option C (Container image scanning for vulnerabilities) is correct because scanning images in the CI/CD pipeline (for example with Trivy, Clair, or Grype against CVE databases) detects vulnerable OS packages and application dependencies in each layer before deployment, which is a core DevSecOps control for containerized workloads. Option B (DAST) is not the best fit here because DAST tests a running application's HTTP interfaces and does not specifically address container image composition or embedded secrets. Option D (IaC security scanning) targets infrastructure-as-code templates such as Terraform or CloudFormation, not the container image itself. Option E (Manual code review) is a general practice and is neither automated nor container-specific, so it does not satisfy the pipeline requirement as directly as image scanning and secrets management.

Answer

DAST (Dynamic Application Security Testing)

Answer

IaC security scanning

Answer

Manual code review

Question 15

An organization is adopting zero trust principles for cloud access. Which THREE components should be implemented to enforce identity as the new perimeter?

Accepted Answer

Multi-Factor Authentication (MFA) for all cloud access. Multi-Factor Authentication (MFA) for all cloud access (B) is correct because zero trust requires strong, verified identity for every access request, and MFA adds a possession or biometric factor beyond a password, preventing credential-only compromise. Privileged Identity Management (PIM) for just-in-time access (C) is correct because it enforces least privilege by granting elevated roles only when needed, for a limited time, with approval and audit trails, rather than standing admin rights. Conditional access policies based on user and device context (D) are correct because they evaluate signals such as user risk, sign-in risk, location, and device compliance before granting access, which is the core of identity-as-the-perimeter enforcement. Network segmentation via VLANs (A) is not correct here because it is a network-layer control that does not verify identity and is largely ineffective for cloud/SaaS access. Firewall rules based on source IP (E) are not correct because IP addresses are not reliable identity signals in cloud environments and can be spoofed or changed, contradicting zero trust principles.

Answer

Network segmentation via VLANs

Answer

Firewall rules based on source IP