How should I use these Cloud Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Cloud Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Cloud Security domain.

350-701 · topic practice

Cloud Security practice questions

Practise Cisco SCOR / CCNP Security Core 350-701 Cloud Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Cloud Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Cloud Security

Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.

IaaS, PaaS and SaaS responsibilities and examples.

Public, private, hybrid and community cloud deployment models.

On-premises vs cloud trade-offs: cost, control, scalability.

How cloud connectivity options (VPN, Direct Connect, ExpressRoute) work.

Watch out for

Common Cloud Security exam traps

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Practice set

Cloud Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Cloud Security explanation →

A company uses Cisco ASA access lists to filter network traffic to internal servers. They want to allow RDP access (port 3389) only from the company's public IP range. Which type of access list should be created?

Trap 1: Outbound access list allowing traffic from any source to port 3389…

Outbound rules control outbound traffic, not inbound RDP.

Trap 2: Cisco ASA NAT rule [wrong]

Load balancer rules distribute traffic, not filter by source IP.

Trap 3: Inbound access list with destination set to the company's IP range…

Destination should be the VM, source is the company IP range.

Cloud Security practice questions

What to know about Cloud Security

Common Cloud Security exam traps

Cloud Security questions

A company uses Cisco ASA access lists to filter network traffic to internal servers. They want to allow RDP access (port 3389) only from the company's public IP range. Which type of access list should be created?

A company uses AWS and needs to securely connect their on-premises data center to a VPC without traversing the public internet. Which solution should they use?

A company uses Cisco Cloud Security Groups (CSGs) to control traffic between subnets. They need to allow traffic from the frontend subnet to the backend subnet only on TCP 443. Which configuration correctly achieves this?

A company wants to establish private connectivity between its on-premises data center and a VPC in AWS, avoiding the public internet. Which AWS service should be used?

An organization wants to enforce conditional access policies for users accessing cloud applications. Which Cisco product should they use?

A company wants to privately connect an on-premises network to a cloud virtual network without traversing the internet. Which Cisco solution should they use?

A company is moving its on-premises applications to AWS EC2 instances. According to the shared responsibility model, which of the following is the customer's responsibility?

An organization uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which cloud security solution should be deployed?

A security engineer is configuring Cisco Umbrella to enforce web security for remote users. The requirement is to block threats by intercepting DNS requests and only perform SSL decryption on specific high-risk categories. Which Umbrella feature should be used for selective SSL inspection?

A company is deploying a multi-tier application in a Cisco cloud security environment. The web servers must be accessible from the internet, but the database servers should only be reachable from the web servers. Which Cisco security controls should be used to enforce this?

An organization wants to implement zero trust principles for cloud access. Which of the following is a key component of a zero trust architecture in the cloud?

A DevOps team is integrating security into their CI/CD pipeline. They want to automatically scan Terraform scripts for misconfigurations before deployment. Which tool is specifically designed for this purpose?

A company uses Azure AD Conditional Access policies to enforce security for cloud applications. They need to require MFA for all external users accessing a sensitive SaaS app, but only when the access is from an untrusted network. Which condition should be configured in the policy?

An organization wants to connect its on-premises data center to an AWS VPC privately, avoiding the public internet. Which AWS service provides a dedicated, private connection?

Which of the following is the primary function of a Cloud Security Posture Management (CSPM) tool?

A company uses Cisco Umbrella to provide DNS-layer security. An employee tries to visit a website that is hosting malware, but the domain is not yet categorized. How does Umbrella handle this request?

An organization is deploying containerized applications in a Kubernetes cluster on AWS EKS. They need to ensure that container images are scanned for vulnerabilities before deployment. Which approach aligns with DevSecOps best practices?

A security team is implementing AWS WAF to protect a web application. They want to block requests that contain SQL injection patterns in the query string. Which AWS WAF component should be used?

In the shared responsibility model for PaaS, which of the following is typically the customer's responsibility?

A DevSecOps team is implementing secrets management for a cloud-native application. They want to avoid storing secrets in environment variables or code. Which solution should they use?

Track your progress over time

Start a Cloud Security only practice session

Related 350-701 topic practice pages

Security Concepts practice questions

Network Security practice questions

Cloud Security practice questions

Content Security practice questions

Endpoint Protection and Detection practice questions

Secure Network Access, Visibility and Enforcement practice questions

350-701 fundamentals practice questions

350-701 scenario practice questions

350-701 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid