350-701 Cloud Security Practice Test 8 — 15 Questions

Question 1

A company is migrating its on-premises web application to AWS. The security team must ensure that only HTTP and HTTPS traffic from the internet reaches the application, while all other inbound ports are blocked. Which AWS feature should they configure to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Security Group. Security groups are stateful, instance-level virtual firewalls in AWS. By creating a security group with inbound rules that permit only TCP 80 and 443 from any source and relying on the implicit deny for all other traffic, the team restricts access exactly as required. Network ACLs are subnet-level and stateless, WAF inspects layer 7 content, and Shield Advanced mitigates DDoS, so none of them replace the port-filtering function of a security group.

Answer

AWS Network ACL

Answer

AWS WAF

Answer

AWS Shield Advanced

Question 2

A security team is evaluating Cisco Cloudlock to protect data stored in SaaS applications such as Microsoft 365 and Google Workspace. The team wants to understand which capabilities Cloudlock provides natively. (Choose two.)

Accepted Answer

Data Loss Prevention that classifies and protects sensitive content in sanctioned SaaS applications.. Cisco Cloudlock is an API-based Cloud Access Security Broker that provides data loss prevention for sanctioned SaaS applications and user behavior analytics to detect compromised accounts and insider threats. It does not perform DNS filtering, firewall inspection, or web proxy TLS decryption, which belong to other Cisco cloud and network security products.

Answer

DNS-layer security that blocks resolution of malicious domains before a connection is established.

Answer

Next-generation firewall inspection of east-west traffic between workloads in a public cloud VPC.

Answer

Secure web gateway proxy that decrypts and inspects TLS traffic from branch users to unsanctioned websites.

Question 3

A security architect is designing a multi-cloud environment that includes AWS, Azure, and on-premises VMware vSphere. The organization wants a single, consistent security policy to be enforced across all workload locations, including east-west traffic between virtual machines. Which Cisco solution should the architect deploy to meet this requirement?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload is purpose-built for microsegmentation and policy enforcement across hybrid and multi-cloud workloads. It uses agents and cloud connectors to map dependencies and then enforce least-privilege policies on east-west traffic. The other options provide internet gateway security, identity-based network access, or traffic analytics, none of which deliver consistent workload-level segmentation across AWS, Azure, and on-premises vSphere.

Answer

Cisco Umbrella SIG

Answer

Cisco Identity Services Engine

Answer

Cisco Secure Network Analytics

Question 4

A security architect is deploying a multicloud environment that spans AWS, Azure, and GCP. The organization requires a centralized, agentless solution that discovers all workloads, detects misconfigurations against CIS benchmarks, and provides a unified compliance dashboard across all three providers. Which Cisco solution best meets these requirements?

Accepted Answer

Cisco Cloud Security Posture Management (CSPM). Cisco CSPM is purpose-built for agentless multicloud workload discovery and continuous compliance assessment against standards like CIS benchmarks, with a unified dashboard. The other options address different security domains: Cloudlock for SaaS, Secure Workload for microsegmentation, and Umbrella for internet gateway security, none of which deliver the required multicloud posture management.

Answer

Cisco Cloudlock

Answer

Cisco Umbrella

Answer

Cisco Secure Workload

Question 5

A security architect is designing a solution to protect user access to SaaS applications. The organization wants to enforce data loss prevention policies, detect anomalous user behavior, and provide granular visibility into sanctioned and unsanctioned cloud apps. Which Cisco technology should be deployed?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is a CASB that delivers the needed capabilities: DLP for SaaS data, user behavior analytics to detect anomalies, and discovery of sanctioned/unsanctioned apps. It uses APIs to inspect data at rest and in motion, and applies policies based on user, device, and content. The other options provide network or identity security but lack the specialized SaaS visibility and data protection functions.

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Identity Services Engine (ISE)

Question 6

A security team is using Cisco Umbrella to protect users who access cloud applications. They want to enforce a policy that prevents users from uploading files containing credit card numbers to any unsanctioned cloud storage service, while still allowing uploads to approved services. Which Cisco Umbrella capability should they configure?

Accepted Answer

Cloud Access Security Broker (CASB) with data loss prevention. The requirement is to prevent uploads of files containing credit card numbers to unsanctioned cloud storage while allowing them to approved services. This demands content inspection within cloud applications, which is the domain of a CASB. Cisco Umbrella's CASB, enhanced by Cloudlock, provides API-based scanning of cloud services, DLP engines that recognize sensitive data patterns, and the ability to enforce granular policies based on app sanction status. DNS, SWG, and firewall policies lack the necessary depth.

Answer

DNS-layer security policies

Answer

Secure Web Gateway (SWG) with file inspection

Answer

Firewall policies with application control

Question 7

A security architect is designing a cloud access security broker (CASB) deployment for a company that uses Microsoft 365 and Salesforce. The company wants to apply data loss prevention (DLP) policies to data at rest within these SaaS applications without installing endpoint agents, and it wants to maintain full visibility into which users are sharing files externally. Which CASB deployment mode should the architect choose?

Accepted Answer

API-based CASB. API-based CASB integration is the correct choice because it uses the SaaS provider's own APIs to inspect data at rest, apply DLP policies, and enumerate external sharing without any endpoint agent. Forward-proxy and reverse-proxy modes are inline or application-facing and only see traffic in motion, while log collection is passive and cannot enforce policy.

Answer

Forward-proxy CASB

Answer

Reverse-proxy CASB

Answer

Log-collection CASB

Question 8

A company is migrating its customer-facing web application to Microsoft Azure. The security team must ensure that only HTTP and HTTPS traffic reaches the web tier from the internet and that no other inbound ports are exposed. Which Azure feature should they configure?

Accepted Answer

Azure Network Security Group applied to the web tier subnet, with inbound rules allowing only TCP 80 and 443 from the Internet and a default deny for all other inbound traffic.. Azure Network Security Groups are the native stateful packet filter for subnets and network interfaces in a virtual network. By allowing only TCP 80 and 443 from the Internet and leaving the default deny rule in place, the team restricts the web tier to web traffic while the stateful engine permits return flows, which is the simplest correct control for this requirement.

Answer

Azure Firewall deployed in a hub virtual network with a DNAT rule translating public IP port 80 and 443 to the web tier's private IP addresses.

Answer

Azure Application Gateway with a Web Application Firewall policy in Prevention mode attached to the web tier.

Answer

Azure DDoS Protection Standard enabled on the virtual network hosting the web tier.

Question 9

A financial services company uses Cisco Umbrella to protect users accessing SaaS applications. The security team needs to block uploads of files containing personally identifiable information (PII) to unsanctioned cloud storage services while allowing uploads to approved services. Which Cisco Umbrella capability should be configured?

Accepted Answer

Cloud Access Security Broker (CASB) with DLP. Cisco Umbrella's CASB with DLP is designed to provide granular, content-aware control over SaaS application usage. It can discover unsanctioned cloud storage services, inspect file uploads for sensitive data patterns like PII, and enforce policies that block only the risky uploads while permitting approved services. The other capabilities operate at DNS, URL, or network layers without content inspection.

Answer

Firewall rules with application control

Answer

Secure Web Gateway (SWG) URL filtering

Answer

DNS-layer security policies

Question 10

A security operations team uses Cisco Secure Workload to protect a Kubernetes cluster running on Amazon EKS. They need to ensure that only approved container images are allowed to run, and that any attempt to run an unapproved image is blocked before the pod starts. Which Cisco Secure Workload capability should they implement?

Accepted Answer

Configure the Cisco Secure Workload Kubernetes admission controller with an image allowlist policy so that unapproved images are rejected during pod admission.. Cisco Secure Workload's Kubernetes admission controller enforces image policy at the point of pod admission. When the API server receives a pod creation request, the webhook checks the image against the allowlist and rejects non-compliant requests, ensuring unapproved images never reach the scheduler and cannot start on the cluster.

Answer

Apply Cisco Secure Workload network policies to the EKS cluster's pod CIDR to restrict egress from containers using unapproved images.

Answer

Enable process-level segmentation policies on the worker nodes to detect and block execution of binaries from unapproved container images.

Answer

Deploy Cisco Secure Workload agents on each worker node and enable vulnerability scanning of running container images.

Question 11

A security team is implementing a cloud access security broker (CASB) solution to gain visibility and control over SaaS application usage. Which two deployment modes are commonly supported by Cisco Cloudlock? (Choose two.)

Accepted Answer

Inline proxy (forward proxy) mode. Cisco Cloudlock supports two primary deployment modes: API-based (out-of-band) for scanning data at rest in sanctioned applications, and inline proxy (forward proxy) for real-time inspection and enforcement. These modes can be used together to provide comprehensive CASB coverage. The other options describe unrelated technologies or policy configurations, not deployment modes.

Answer

Agent-based endpoint mode

Answer

Log-only mode without enforcement

Answer

DNS sinkhole mode

Question 12

A security operations team is using Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) to monitor a hybrid cloud environment. They want to detect threats such as cryptomining and data exfiltration across AWS, Azure, and on-premises networks without deploying agents on every workload. Which statement describes how Cisco Secure Cloud Analytics achieves this?

Accepted Answer

It ingests VPC flow logs, Azure NSG flow logs, and on-premises NetFlow/IPFIX to build behavioral models and detect anomalies.. Cisco Secure Cloud Analytics is an agentless network traffic analysis solution that ingests flow logs from public clouds and on-premises networks. It builds behavioral baselines and detects anomalies such as cryptomining, data exfiltration, and lateral movement without requiring agents on workloads. The other options describe agent-based, DNS-based, or API-based approaches that do not match its primary detection mechanism.

Answer

It relies on DNS query logs from Cisco Umbrella to identify malicious domains contacted by workloads.

Answer

It uses agent-based sensors installed on each virtual machine to capture process-level telemetry.

Answer

It uses API calls to cloud providers to inventory resources and check against CIS benchmarks.

Question 13

A company is migrating its on-premises web application to AWS. The security team must ensure that only HTTP and HTTPS traffic from the internet reaches the application, while all other inbound ports are blocked. Which AWS feature should they configure to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS WAF. AWS WAF is the appropriate service to protect web applications from application-layer exploits like SQL injection and cross-site scripting. It integrates with AWS Shield, which mitigates DDoS attacks, to provide layered protection. The other services operate at different layers or serve detection/management functions rather than inline web traffic filtering.

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 14

A cloud operations team is deploying a multi-tier application in Microsoft Azure. The security team wants to ensure that only HTTP and HTTPS traffic from the internet can reach the web tier, while the database tier should accept connections only from the web tier. They also want to log allowed and denied flows for auditing. Which Azure feature should they configure to meet these requirements?

Accepted Answer

Azure Network Security Group (NSG). Network security groups are the correct Azure feature because they provide stateful allow/deny rules at the subnet or NIC level, support service tags and source restrictions, and can generate NSG flow logs for auditing. Azure Firewall is a broader managed firewall, ASGs are grouping constructs used inside NSG rules, and DDoS Protection Standard mitigates attacks rather than segmenting application tiers.

Answer

Azure Application Security Group (ASG)

Answer

Azure DDoS Protection Standard

Answer

Azure Firewall

Question 15

A security team is evaluating Cisco Cloudlock to protect data in a sanctioned SaaS environment. They want to understand which capabilities Cisco Cloudlock provides for data security in cloud applications. (Choose two.)

Accepted Answer

User and entity behavior analytics (UEBA) to detect anomalous cloud application activity. Cisco Cloudlock provides API-based data loss prevention for data at rest in sanctioned SaaS applications and user and entity behavior analytics to detect anomalous cloud activity. DNS-layer enforcement belongs to Umbrella, inline TLS decryption belongs to secure web gateway or SIG functions, and NAT is a networking function unrelated to Cloudlock's cloud access security broker capabilities.

Answer

Network address translation (NAT) for cloud workloads

Answer

DNS-layer security enforcement for roaming endpoints

Answer

Inline decryption and inspection of TLS traffic between users and SaaS applications