Cloud Security

350-701 · 45 questions

• A company moves its customer relationship management system from on-premises servers to a SaaS provider. An auditor asks who is responsible for patching the CRM application and its underlying platform. What is the correct answer?
• An attacker compromises a virtual machine in an IaaS environment through a vulnerability in the guest operating system that had a patch available for months. Under a typical shared responsibility model, who failed in their duty?
• A team uses a managed PaaS database service. The provider runs the database engine and its hosts, but a developer added a network rule allowing access from any internet address, and the data was scraped. Who is responsible for the exposure?
• An auditor building a cloud risk register asks who is responsible for physical security of the data centers, such as badge access, guards and environmental controls, for workloads in IaaS, PaaS and SaaS. What is the correct answer?
• An employee with valid access to a SaaS collaboration platform deletes a large set of shared project files before leaving the company. The files are past the provider's retention window. Who was responsible for preventing this loss?
• A security team is building one responsibility matrix covering workloads in IaaS, PaaS and SaaS. Which statement should guide how the customer's share is shown across the three models?
• An organization wants a framework of cloud-specific security controls, mapped to other standards, to assess prospective cloud providers and its own cloud deployments. Which resource fits this purpose?
• An enterprise runs dozens of cloud accounts, and teams change settings by hand. Storage buckets become public and logging gets disabled without anyone noticing. Which capability continuously detects these misconfigurations against a security baseline?
• A company runs workloads in AWS, Azure and Google Cloud. Each team writes network security rules separately in each provider's native console, and the policies have drifted apart. The company wants one centrally managed policy enforced across all three. Which solution fits?
• Cloud workloads in several virtual networks currently reach the internet directly. The security team needs inline inspection of this outbound traffic, including threat prevention and URL filtering, before it leaves the cloud. Which deployment model fits?
• A security team wants to guarantee that no Terraform template can create a publicly readable storage bucket. Violations must be stopped before anything is deployed, not reported afterward. Which control meets this requirement?
• A security team must assess vulnerabilities and misconfigurations on thousands of virtual machines across 40 cloud accounts within days. Other teams own the workloads, and the security team is not permitted to install software on them. Which approach fits?
• A regulator requires that encryption keys protecting customer records in cloud object storage stay under the company's control, including the ability to disable a key and render the data unreadable. Which capability should be selected?
• Several regional hospitals want to share cloud infrastructure that is provisioned for their exclusive use, because they all have the same regulatory and privacy requirements. One of the hospitals will operate it on behalf of the group. Which NIST SP 800-145 deployment model is this?
• A development team wants to deploy its web application code to the cloud using the provider's languages, runtimes and tools, without managing servers, operating systems or storage, while still controlling the application and its configuration. Which NIST SP 800-145 service model is this?
• A healthcare company keeps its patient-record databases in its own data center under tight control, but bursts its customer web front end into a public cloud provider during seasonal peaks. The two environments stay separate yet are linked so data and workloads can move between them. Which NIST SP 800-145 deployment model describes this arrangement?
• Firewall logs show employees uploading files to several personal cloud storage services the company never approved. Leadership wants the security team to discover which SaaS applications are in use, rate each one's risk, and then block or restrict the risky ones. Which type of security solution is designed for this requirement?
• Files already stored in the company's sanctioned Microsoft 365 tenant must be scanned for sensitive data and have public sharing links revoked, including files employees uploaded from personal, unmanaged phones that never route through a corporate proxy. Which CASB deployment mode meets this requirement?
• A company rents virtual machines, block storage and virtual networks from a provider. Its own team installs and patches the guest operating systems, deploys its middleware and applications, and configures host firewalls, while the provider runs the physical hosts and the hypervisor. Which NIST SP 800-145 service model is this?
• A defense contractor builds a cloud with on-demand self-service provisioning, resource pooling and measured usage. The infrastructure is provisioned for the exclusive use of that one organization and its business units, whether it sits in the contractor's own facility or in a third-party hosted facility. Which deployment model is this?
• A team runs applications in AWS VPCs and Azure VNets and must apply ingress, egress and east-west inspection with one policy set managed centrally, without hand-building and scaling separate firewall stacks in each cloud. How does Cisco Multicloud Defense deliver this?
• Before writing segmentation policy for a three-tier application, the security team needs an accurate map of which workloads talk to which and on what ports, so it can build an allowlist that permits only the observed, required flows. Which Cisco Secure Workload capability provides this?
• An enterprise's applications run on VMware VMs in its data center, on bare-metal Linux servers, and on instances in two public clouds. The security team wants one microsegmentation policy model enforced consistently at each workload regardless of where it runs. Which approach does Cisco Secure Workload use?
• Developers create new VPCs, VNets and instances across several clouds faster than the security team can record them, so the team often learns about exposed assets only after an incident. Which Cisco Multicloud Defense capability addresses this gap first?
• A cloud storage bucket holds customer records. An audit warns that a future misconfiguration could make the bucket reachable, and the company wants the records to stay unreadable and governed even if that happens. Which combination of controls addresses data security most directly?
• A customer-facing web application in a public cloud is being probed with SQL injection and cross-site scripting payloads inside otherwise normal HTTPS requests to port 443. The security group must keep allowing TCP 443 from anywhere. Which control addresses these attacks?
• A cloud security service can push its events as JSON over HTTPS to a URL, but nothing can be installed in the vendor's environment and the Splunk team does not want to add a forwarder. How should the Splunk administrator accept these events directly?
• The SOC wants AWS CloudTrail events from several accounts searchable in Splunk beside its other security data, using a supported Splunk-built integration rather than custom code. What is the appropriate approach?
• Cisco Secure Firewall events are arriving in Splunk, but they land as raw text under a generic sourcetype, so analysts cannot filter on fields such as source address or rule action and the data does not populate Common Information Model data models. What is the most likely fix?
• Several on-premises Linux servers write application and audit logs to local files. The Splunk team wants those files collected continuously, with the collector tracking how far it has read and holding data when the indexers are briefly unreachable, so no lines are lost. What should be deployed?
• A SOC wants data from several Cisco security products, such as Secure Firewall, Secure Endpoint and Duo, brought into Splunk through one Cisco-supported integration that also provides ready-made dashboards for those products. Which approach fits best?
• Splunk will ingest firewall logs that must be kept for one year and be searchable by the whole SOC, and HR system audit logs that must be kept for seven years and be searchable only by two investigators. What is the correct design?
• A platform team wants deep visibility into process execution, system calls and network connections on its Linux workload hosts, but the operations group refuses to load third-party kernel modules because a faulty module can crash the kernel. Which technology fits this requirement?
• A payment application's web tier needs only HTTPS from the load balancer and must reach the app tier on one TCP port, and the app tier reaches the database on one port. The security team wants a workload policy that limits lateral movement if any tier is compromised. Which policy model should it apply?
• An audit finds that container images in the company's registry include operating system packages and libraries with published CVEs, and some of those images are already running in production. Which control addresses the source of this problem?
• Images passed vulnerability scanning, yet an attacker exploited an unknown flaw in a running container, spawned an interactive shell and began downloading tools. Which control is designed to catch this activity as it happens?
• A team compares two workload agents for Linux hosts. One relies on long iptables rule chains and periodic log parsing for visibility; the other attaches eBPF programs to kernel hooks. Why is the eBPF-based design generally preferred for visibility and enforcement at scale?
• In a Kubernetes cluster with autoscaling, workload IP addresses change every time pods are rescheduled, and IP-based security rules keep breaking or matching the wrong workloads. How should the workload security policy be written instead?
• A team's Terraform modules have repeatedly created cloud storage buckets with public read access, and each time the problem is found only after deployment by a posture tool. The team wants these misconfigurations caught before any resource exists. What should it add?
• Security testing for a product happens only in a two-week window before each release, and late findings repeatedly delay launches. Leadership wants most code vulnerabilities found within hours of the code being written. What DevSecOps change addresses this?
• A CI pipeline printed a cloud access key into its build logs, where anyone with read access to the CI project could see it. The same key was stored as plaintext in the repository's pipeline configuration file. What is the right DevSecOps fix?
• A review finds that many Kubernetes pods run as privileged containers with root users and host access, and developers can deploy any pod specification they like. The platform team wants such pods rejected before they are ever scheduled. Which control fits?
• A critical vulnerability is announced in a widely used open-source logging library. The security team must determine quickly which of the company's hundreds of applications include that library, including as a transitive dependency. Which practice makes this answerable in minutes?
• A team already runs static analysis on its source code. It now wants to test the deployed staging build of its web application from the outside, sending crafted requests to find exploitable flaws such as injection and broken authentication in the running system. Which testing type is this?
• Scanners already run in the team's CI pipeline, but their findings are only written to a report that nobody reads, and builds with critical vulnerabilities keep reaching production. The team wants the pipeline itself to stop such builds. What should it implement?