easyMultiple ChoiceObjective-mapped
350-701 Practice Question: Moving its data to AWS and wants to use Cisco…
A company is moving its data to AWS and wants to use Cisco Cloudlock for cloud access security broker (CASB) capabilities. Which deployment mode is required for Cloudlock to inspect traffic for shadow IT discovery?
⚠ Common exam trap
Cisco often tests the misconception that proxy-based modes are required for all CASB functions, but for shadow IT discovery, the API-based mode is specifically designed to work without traffic interception by querying cloud provider APIs directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
API-based
For shadow IT discovery, Cloudlock uses an API-based deployment mode to connect directly to cloud service providers (e.g., AWS, Office 365) via their APIs. This allows Cloudlock to pull metadata, user activity logs, and application usage data without requiring traffic redirection, enabling identification of unsanctioned cloud applications. Proxy-based modes are not used for shadow IT discovery because they require traffic to be routed through the proxy, which is not feasible for cloud-to-cloud traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Proxy-based (forward proxy)
Why it's wrong here
Proxy-based is for inline traffic inspection, not for shadow IT discovery.
- ✓
API-based
Why this is correct
Cloudlock uses API connections to cloud providers to scan data at rest for shadow IT.
- ✗
Log collection
Why it's wrong here
Log collection is an auxiliary data source, not the primary deployment mode for Cloudlock.
- ✗
Reverse proxy
Why it's wrong here
Reverse proxy is used for protecting web applications, not CASB discovery.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.