350-701 Cloud Security Practice Test 7 — 15 Questions

Question 1

A company uses Cisco Umbrella to protect remote users. They want to ensure that SSL-encrypted traffic to malicious websites is inspected, but without breaking compliance with privacy regulations. Which Umbrella feature should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Intelligent Proxy. Intelligent Proxy allows selective SSL inspection based on policy, balancing security and privacy.

Answer

Secure Internet Gateway (SIG)

Answer

Roaming Client

Answer

DNS-layer security

Question 2

A cloud engineer is deploying a web application on AWS and needs to control inbound and outbound traffic at both the instance and subnet levels. Which two AWS security controls should they configure? (Select two.)

Accepted Answer

Security Groups. Security Groups (B) are the correct control for instance-level traffic filtering, acting as stateful virtual firewalls attached to ENIs that allow or deny inbound and outbound rules by protocol, port, and source/destination. Network ACLs (E) are the correct control for subnet-level traffic filtering, acting as stateless, ordered allow/deny rules applied to all resources in a subnet for both ingress and egress. Together, B and E satisfy the requirement to control traffic at both the instance and subnet levels. AWS PrivateLink (A) only provides private connectivity to services via VPC endpoints and does not filter instance or subnet traffic. AWS WAF (C) filters HTTP/HTTPS application-layer requests at CloudFront, ALB, or API Gateway, not at the instance or subnet layer. AWS Shield (D) provides DDoS protection, not granular inbound/outbound traffic control at the instance or subnet level.

Answer

AWS PrivateLink

Answer

AWS WAF

Answer

AWS Shield

Question 3

A DevSecOps team is integrating security into their CI/CD pipeline. They want to scan infrastructure-as-code templates for misconfigurations and container images for vulnerabilities. Which two tools are appropriate? (Select two.)

Accepted Answer

Trivy. Checkov (D) is correct because it is a static analysis tool specifically designed to scan infrastructure-as-code templates such as Terraform, CloudFormation, Kubernetes manifests, and ARM templates for security misconfigurations and compliance violations. Trivy (B) is correct because it is a vulnerability scanner that can inspect container images (as well as filesystems and repositories) for known CVEs in OS packages and application dependencies, directly matching the container image scanning requirement. The other options do not fit: SAST (A) and DAST (E) are application security testing approaches targeting source code and running web applications respectively, not IaC templates or container images, while HashiCorp Vault (C) is a secrets management tool for storing and controlling access to credentials, not a scanner.

Answer

SAST

Answer

HashiCorp Vault

Answer

DAST

Question 4

An organization is adopting a zero trust model for cloud access. Which three principles should be implemented? (Select three.)

Accepted Answer

Use conditional access policies based on user, device, and location. Option C is correct because zero trust enforces context-aware, least-privilege decisions through conditional access policies that evaluate signals such as user identity, device compliance/health, and location before granting access. Option D is correct because strong authentication is foundational to zero trust; requiring MFA for all cloud access prevents compromised passwords from being sufficient on their own. Option E is correct because zero trust shifts the security boundary away from the network edge and makes identity the control plane, so every request is authenticated and authorized regardless of network origin. Option A is not correct because a blanket VPN extends implicit network trust rather than eliminating it, which is contrary to zero trust's per-request verification model. Option B is not correct because permanent privileged access violates least privilege and just-in-time/just-enough access principles central to zero trust.

Answer

Deploy a VPN for all remote users

Answer

Grant permanent privileged access to administrators

Question 5

A security architect at a financial services firm is deploying a new multi-tier web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer and stores sensitive customer data in an Amazon RDS database. The security team wants to block common web exploits such as SQL injection and cross-site scripting at the edge before traffic reaches the EC2 instances, and they want to use a managed AWS service that integrates with AWS WAF. Which AWS service should the architect use to provide this protection?

Accepted Answer

Amazon CloudFront with AWS WAF. The requirement is to block web exploits such as SQL injection and cross-site scripting at the edge, before traffic reaches the EC2 instances, using a managed AWS service that integrates with AWS WAF. Amazon CloudFront, when associated with AWS WAF, inspects HTTP/HTTPS requests at edge locations and can enforce AWS Managed Rules to block these attacks. The other services provide DDoS protection, network-layer filtering, or threat detection, but not inline application-layer web exploit prevention.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Network Firewall

Question 6

A security architect at a financial services company is deploying a new multi-tenant SaaS application on AWS. The application must encrypt sensitive customer data at rest using keys that the company generates and manages, but the company does not want to manage the underlying hardware security modules (HSMs). Which AWS service should be used to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS) with customer managed keys. AWS KMS with customer managed keys allows the organization to create, rotate, and control keys while AWS handles the HSM infrastructure. This satisfies the need for customer-managed encryption keys without the operational burden of managing HSMs. CloudHSM would require managing the HSMs, Secrets Manager is for secrets, and ACM is for TLS certificates, so they do not meet the stated requirements.

Answer

AWS Secrets Manager with automatic rotation

Answer

AWS CloudHSM with customer-managed keys

Answer

AWS Certificate Manager (ACM) with private CA

Question 7

A security team is using Cisco Umbrella to protect users accessing cloud applications. They want to enforce a policy that blocks access to unsanctioned cloud applications while allowing sanctioned ones, and they need to identify which cloud applications are in use. Which Cisco Umbrella feature should they use?

Accepted Answer

Cloud Application Control. Cisco Umbrella's Cloud Application Control provides both discovery and policy enforcement for cloud applications. It allows the team to see which apps are in use and to block unsanctioned ones while allowing sanctioned ones. DNS-layer security and Secure Web Gateway do not provide the same application-level granularity, and Cloud Application Discovery lacks enforcement.

Answer

Cloud Application Discovery

Answer

Secure Web Gateway

Answer

DNS-Layer Security

Question 8

A security architect is designing a cloud environment on Microsoft Azure and needs to protect outbound traffic from virtual machines to the internet. The organization requires that all outbound traffic be inspected by a next-generation firewall, even when the traffic is destined for arbitrary internet IP addresses. Which Azure-native solution should the architect implement?

Accepted Answer

Azure Firewall with forced tunneling. Azure Firewall is a managed, cloud-native next-generation firewall that provides stateful inspection and filtering. By configuring forced tunneling, all outbound internet traffic is routed through the firewall, ensuring inspection regardless of destination. This meets the requirement for a next-generation firewall to inspect all outbound traffic from virtual machines.

Answer

Azure DDoS Protection Standard

Answer

Azure Application Gateway with WAF

Answer

Network Security Groups (NSGs)

Question 9

A security engineer is configuring Cisco Umbrella to enforce security policies for a remote workforce. The company wants to block access to newly seen domains that are less than 24 hours old, as these are often used in malicious campaigns. Which Umbrella feature should the engineer enable to achieve this?

Accepted Answer

Newly Seen Domains. Cisco Umbrella's Newly Seen Domains category is specifically designed to block domains that have been observed for the first time within the last 24 hours. This is effective against attacks that use newly registered domains to evade reputation-based blocking. Enabling this category directly fulfills the requirement to block access to newly seen domains.

Answer

DNS Tunneling

Answer

Block Page Bypass

Answer

Dynamic DNS

Question 10

A cloud security team is using Amazon GuardDuty to monitor their AWS environment. They receive a finding indicating that an EC2 instance is communicating with a known cryptocurrency mining pool. Which action should the team take to automatically remediate this finding?

Accepted Answer

Create an Amazon CloudWatch Events rule that triggers an AWS Lambda function to isolate the EC2 instance.. Amazon GuardDuty findings can be automatically remediated using Amazon CloudWatch Events (EventBridge) to trigger AWS Lambda functions. This allows for immediate isolation of compromised instances, such as stopping the instance or modifying security groups. This automation is a best practice for responding to security findings in AWS.

Answer

Enable AWS Shield Advanced on the EC2 instance.

Answer

Use Amazon Inspector to automatically patch the EC2 instance.

Answer

Configure AWS WAF to block the cryptocurrency mining pool's IP address.

Question 11

A security administrator is implementing Cisco Cloudlock to protect data in a SaaS environment. The organization wants to detect and respond to sensitive data exposure in sanctioned cloud applications. Which TWO capabilities does Cisco Cloudlock provide to achieve this? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policies that scan content in cloud applications for sensitive information.. Cisco Cloudlock is a cloud access security broker (CASB) that provides data loss prevention (DLP) and user and entity behavior analytics (UEBA) for sanctioned cloud applications. DLP scans content for sensitive data and enforces policies, while UEBA detects anomalous behavior that may indicate a breach. Together, they enable detection and response to sensitive data exposure in SaaS environments.

Answer

DNS-layer security that blocks access to malicious domains used for data exfiltration.

Answer

Network-based intrusion prevention system (IPS) that inspects traffic to and from cloud applications.

Answer

Cloud Security Posture Management (CSPM) that scans infrastructure-as-a-service configurations for misconfigurations.

Question 12

A security architect is designing a multi-account AWS environment for a financial services company. The company requires that all API activity across every account be centrally logged, retained for seven years, and protected from modification even by account administrators. Which combination of AWS services should the architect implement to meet these requirements?

Accepted Answer

AWS CloudTrail with an organization trail delivering logs to a centralized S3 bucket protected by S3 Object Lock in compliance mode, with a bucket policy denying deletion.. Centralized, immutable audit logging across an AWS Organization is achieved with an organization trail that automatically applies to all current and future accounts. Delivering those logs to an S3 bucket with Object Lock in compliance mode enforces write-once-read-many semantics that even privileged administrators cannot override, meeting both the seven-year retention and the protection-from-modification requirements.

Answer

AWS CloudTrail in each account with logs delivered to a local CloudWatch Logs group, and a subscription filter forwarding events to a central Kinesis Data Firehose stream.

Answer

AWS Config with an aggregator collecting configuration snapshots from all accounts, stored in a DynamoDB table with point-in-time recovery enabled.

Answer

Amazon GuardDuty enabled in every account with findings exported to a central security account via EventBridge and archived in an S3 bucket with versioning.

Question 13

A company is migrating its on-premises web application to Google Cloud Platform (GCP). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting. They also want to leverage Google's infrastructure for scaling and DDoS protection. Which GCP service should they implement?

Accepted Answer

Google Cloud Armor. Google Cloud Armor is a WAF and DDoS protection service that integrates with Google Cloud load balancing. It provides preconfigured rules to block OWASP Top 10 threats, including SQL injection and cross-site scripting. It also leverages Google's global infrastructure for DDoS mitigation. This makes it the correct choice for protecting a web application on GCP.

Answer

Google Cloud Next-Generation Firewall

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

VPC Service Controls

Question 14

A cloud security engineer is configuring Cisco Umbrella to protect a branch office. The company wants to block access to known malicious domains and also wants visibility into which internal user or device made each request. The branch uses a Cisco router as the DNS forwarder for all endpoints. Which Umbrella component and configuration should the engineer deploy?

Accepted Answer

Configure the Cisco router to forward DNS queries to the Umbrella Virtual Appliance IP addresses and enable the Virtual Appliance to send internal IP and user mappings to Umbrella.. The Umbrella Virtual Appliance is the on-premises component that lets network devices forward DNS while preserving internal IP and user attribution. Combined with the Active Directory Connector, it maps internal IPs to usernames so Umbrella reports show which user or device generated each DNS request, while still enforcing Umbrella's malicious-domain blocklists.

Answer

Deploy a Cisco Umbrella SIG tunnel from the branch router to Umbrella and enable the Intelligent Proxy for all DNS requests.

Answer

Install the Umbrella Roaming Client on every endpoint and register them to the branch's network identity.

Answer

Point the router's DNS to the public Umbrella resolver IPs and enable EDNS Client Subnet so Umbrella can identify internal users.

Question 15

A security team is deploying a multi-tier web application on AWS. They need to continuously monitor for misconfigured S3 buckets and overly permissive IAM policies, and receive alerts when deviations occur. Which Cisco solution should they implement to achieve this?

Accepted Answer

Cisco Cloud Security Posture Management (CSPM). Cisco Cloud Security Posture Management (CSPM) is designed to continuously assess cloud infrastructure for misconfigurations and compliance issues, including S3 bucket permissions and IAM policies. It provides visibility and alerts for deviations, enabling security teams to remediate risks. The other options focus on different security layers, such as SaaS security, network traffic analysis, or DNS security, and do not provide the required configuration monitoring.

Answer

Cisco Cloudlock

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch Cloud