350-701 Cloud Security Practice Test 6 — 15 Questions

Question 1

A company uses AWS and Azure and wants to protect its cloud workloads (VMs and containers) from threats. Which TWO technologies are specifically designed for workload protection in the cloud?

Accepted Answer

CWPP (Cloud Workload Protection Platform). Option A (CWPP, Cloud Workload Protection Platform) is correct because CWPPs are purpose-built to secure cloud workloads such as VMs, containers, and serverless functions, providing runtime protection, vulnerability assessment, and behavioral monitoring across hybrid and multi-cloud environments like AWS and Azure. Option D (Container image scanning) is correct because scanning container images for vulnerabilities, malware, and misconfigurations before deployment is a core workload-protection control that directly addresses threats in containerized workloads. Option B (CASB) is incorrect because CASBs focus on governing SaaS usage and enforcing data-security policies for cloud services, not on protecting VM or container runtime workloads. Option C (Cloud WAF) is incorrect because a WAF protects web applications at the HTTP/HTTPS layer from attacks like SQLi and XSS, not the underlying cloud workloads themselves. Option E (CSPM) is incorrect because CSPM tools detect and remediate cloud infrastructure misconfigurations and compliance drift, which is posture management rather than direct workload protection.

Answer

CASB

Answer

Cloud WAF

Answer

CSPM

Question 2

In the shared responsibility model for cloud security, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Operating system and application security. In IaaS, the cloud provider manages the physical infrastructure, virtualization, and network, while the customer manages the operating system, applications, and data.

Answer

Hypervisor security

Answer

Network infrastructure security

Answer

Physical security of the data center

Question 3

A company is using a SaaS application like Office 365. Which security responsibility falls on the customer according to the shared responsibility model?

Accepted Answer

Data classification and access policies. In the shared responsibility model for SaaS, the provider manages the underlying infrastructure, operating system, network, and application, while the customer remains responsible for their data — including data classification, access policies, identity management, and user permissions. This is the core customer-side responsibility in any cloud service model.

Answer

Operating system patching

Answer

Physical security of servers

Answer

Network firewall management

Question 4

A security team wants to gain visibility into shadow IT usage of cloud applications and enforce data loss prevention policies. Which cloud security control should they deploy?

Accepted Answer

CASB. A CASB (Cloud Access Security Broker) is designed to provide visibility into cloud application usage (shadow IT) and enforce data loss prevention (DLP) policies for SaaS applications. It sits between users and cloud services to monitor and control activity.

Answer

Cloud WAF

Answer

CWPP

Answer

CSPM

Question 5

An organization uses Cisco Umbrella to block malicious domains. What is the primary security benefit of DNS-layer security?

Accepted Answer

It blocks malicious domains before a connection is made. DNS-layer security blocks malicious domains at the resolution stage, before the client ever establishes a TCP connection to the attacker's server. By intercepting DNS queries and returning a block page or NXDOMAIN for known malicious domains, it prevents malware, phishing, and C2 callbacks from ever reaching their destination.

Answer

It performs deep packet inspection on all traffic

Answer

It provides SSL decryption for all web traffic

Answer

It encrypts all DNS traffic to prevent eavesdropping

Question 6

A company is deploying Cisco Umbrella with the Intelligent Proxy feature. Under what condition does the Intelligent Proxy perform SSL decryption?

Accepted Answer

Only for traffic to websites with low reputation or in high-risk categories. Intelligent Proxy performs SSL decryption only when the destination's reputation is low or it falls into a high-risk category, based on Umbrella's threat intelligence. For trusted, well-categorized sites, traffic bypasses decryption, so inspection is targeted where risk is highest.

Answer

For all web traffic from the roaming client

Answer

Only for traffic using non-standard ports

Answer

Only when the user is on-network

Question 7

In AWS, which resource acts as a stateful firewall at the instance level to control inbound and outbound traffic?

Accepted Answer

Security Group. Security Groups in AWS are stateful virtual firewalls that operate at the instance (ENI) level. They control inbound and outbound traffic using allow rules only, and because they are stateful, return traffic for an allowed inbound connection is automatically permitted outbound, and vice versa. This stateful behavior means you don't need to explicitly allow ephemeral ports for return traffic, unlike stateless firewalls.

Answer

Network ACL

Answer

Internet Gateway

Answer

VPC Flow Logs

Question 8

A security architect is designing a zero-trust model for cloud access. Which of the following is a core principle of zero trust in the cloud?

Accepted Answer

Identity is the new perimeter. A core principle of zero trust is that identity becomes the new perimeter: access decisions are based on user and device identity, not on network location. In cloud environments, where resources are distributed and users are remote, trust must be continuously verified through identity-centric controls such as strong authentication, conditional access, and least privilege. This aligns with the zero-trust mantra of 'never trust, always verify.'

Answer

All traffic must be inspected by a next-generation firewall

Answer

Network segmentation is the primary security control

Answer

VPNs are required for all cloud access

Question 9

In a DevSecOps pipeline, which tool would be used to scan Infrastructure as Code (IaC) templates for security misconfigurations?

Accepted Answer

Checkov. Checkov is an open-source static analysis tool specifically designed to scan Infrastructure as Code (IaC) templates (Terraform, CloudFormation, Kubernetes, ARM) for security misconfigurations and compliance violations. It fits directly into DevSecOps pipelines to catch issues before deployment.

Answer

SAST tool

Answer

Container image scanner

Answer

DAST tool

Question 10

A security engineer needs to prevent secrets (e.g., API keys) from being stored in code repositories. Which DevSecOps practice should be implemented?

Accepted Answer

Implement secrets management using a tool like Vault. Secrets management tools like HashiCorp Vault securely store and manage secrets, avoiding hardcoding in code.

Answer

Use a SAST scanner to find secrets in code

Answer

Encrypt the code repository

Answer

Use a DAST tool to test for secrets

Question 11

Which cloud workload protection platform (CWPP) capability is essential for protecting containerized applications?

Accepted Answer

Container image vulnerability scanning. CWPP for containers includes image scanning for vulnerabilities and runtime security, but image scanning is a fundamental capability.

Answer

Web application firewall

Answer

Network micro-segmentation

Answer

Identity and access management

Question 12

A security team is implementing CSPM to ensure cloud compliance. Which three checks would a CSPM tool typically perform? (Choose three.)

Accepted Answer

Verifying that EBS volumes are encrypted. A CSPM (Cloud Security Posture Management) tool continuously assesses cloud configurations against compliance baselines and best practices. Option A is correct because verifying that EBS volumes are encrypted is a standard configuration check for data-at-rest protection in AWS. Option B is correct because checking S3 buckets for public read access is a classic CSPM misconfiguration check that detects unintended data exposure. Option E is correct because ensuring IAM roles follow least privilege is a core identity and access management posture check that CSPM tools evaluate against policies and permissions. Option C does not belong because monitoring user behavior analytics is the domain of UEBA or SIEM tools, not CSPM. Option D does not belong because scanning container images for vulnerabilities is performed by container/image scanning tools (e.g., Amazon ECR image scanning, Trivy), which fall under vulnerability management rather than CSPM configuration posture.

Answer

Monitoring user behavior analytics

Answer

Scanning container images for vulnerabilities

Question 13

Which two controls are considered part of a zero-trust architecture for cloud access? (Choose two.)

Accepted Answer

Multi-factor authentication for all cloud access. Multi-factor authentication (A) is a core zero-trust control because it enforces strong identity verification for every cloud access request, aligning with the 'never trust, always verify' principle rather than relying on network location. Conditional access policies based on user and device (E) are also fundamental to zero trust, as they evaluate contextual signals such as user identity, device compliance, location, and risk before granting access to cloud resources. Together, these controls support continuous verification and least-privilege access in a zero-trust architecture. Static firewall rules based on IP addresses (B) are not zero-trust controls because they assume trust based on network location, which zero trust explicitly rejects. Permanent privileged role assignments (C) violate least-privilege and just-in-time access principles central to zero trust. A network-based VPN for all users (D) extends perimeter-based trust by placing users on the internal network, which is contrary to zero-trust access models.

Answer

Static firewall rules based on IP addresses

Answer

Permanent privileged role assignments

Answer

Network-based VPN for all users

Question 14

A company uses a SaaS application for customer relationship management. In the cloud shared responsibility model, which security controls are the customer's primary responsibility?

Accepted Answer

Data classification and access policies. In SaaS, the customer is responsible for managing data and access, while the provider handles the underlying infrastructure, application, and OS.

Answer

Patching the underlying operating system

Answer

Physical security of the data center

Answer

Network security for the application servers

Question 15

A security team wants to enforce data loss prevention (DLP) policies across multiple sanctioned cloud applications used by employees. Which cloud security solution is best suited for this task?

Accepted Answer

CASB (Cloud Access Security Broker). A CASB sits between users and cloud services and enforces policy — including DLP — across sanctioned SaaS applications via API or inline proxy modes. It can inspect data in transit and at rest in cloud apps, apply DLP rules (e.g., block credit card numbers or PII), and enforce access controls, making it the right tool for multi-cloud-app DLP enforcement.

Answer

CWPP (Cloud Workload Protection Platform)

Answer

Cisco Umbrella SIG

Answer

CSPM (Cloud Security Posture Management)