A security team is designing a Kubernetes environment for a multi-tenant SaaS platform. They need to isolate tenants from each other, but also want to minimize operational overhead. Which approach best meets these requirements?

Use separate namespaces per tenant with NetworkPolicies and RBAC.

Use the same service account for all tenants.

Use a single namespace for all tenants to simplify management.

Deploy a separate cluster for each tenant.

A company is adopting DevSecOps and wants to shift security left. They currently have a CI/CD pipeline that builds and deploys a web application. They want to add security checks without significantly slowing down the pipeline. Which approach best balances speed and security?

Run SAST only on release branches, not on feature branches.

Run SAST and dependency scanning in parallel on every commit, and fail the build on critical findings.

Run all security scans only on a nightly schedule.

Run DAST on every commit, even if it takes a long time.

A company's CI/CD pipeline deploys a microservices application to a Kubernetes cluster. They want to ensure that only signed and trusted container images are deployed, while also preventing secrets from being exposed in the pipeline logs. Which combination of controls should they implement?

Use image signing with a trusted registry and mask secrets in pipeline logs.

Use image scanning and store secrets in environment variables.

Use a private registry and disable pipeline logging.

Use RBAC to control who can push images and store secrets in the image.

Which of the following is an example of a secure coding practice?

Allowing all users to access all functions by default

Disabling all error messages to hide system information

Validating and sanitizing all user input to prevent injection attacks

Using hard-coded credentials for database connections to simplify code

A company's CI/CD pipeline builds a container image and pushes it to a registry. They want to automatically block the deployment if the image contains critical vulnerabilities. Which step should they add to the pipeline?

Use a base image that is known to be secure and never update it.

Perform a manual security review of the Dockerfile before each release.

Enable audit logging on the container registry to track image pulls.

Run a container image scan in the pipeline and fail the build if critical vulnerabilities are found.

CiscoCertified Network Professional Security

Domain 3Objective 7

3.7 Describe DevSecOps (Infrastructure as Code Security, CI/CD Pipeline, Container Orchestration, and Secure Software Development) 350-701 Practice Questions (Page 1)

Part of the Cloud Security domain, which accounts for 15% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

15%of the exam

Questions 1–5

1expert · hard
A security team is designing a Kubernetes environment for a multi-tenant SaaS platform. They need to isolate tenants from each other, but also want to minimize operational overhead. Which approach best meets these requirements?
Select an answer first
2expert · hard
A company is adopting DevSecOps and wants to shift security left. They currently have a CI/CD pipeline that builds and deploys a web application. They want to add security checks without significantly slowing down the pipeline. Which approach best balances speed and security?
Select an answer first
3expert · hard
A company's CI/CD pipeline deploys a microservices application to a Kubernetes cluster. They want to ensure that only signed and trusted container images are deployed, while also preventing secrets from being exposed in the pipeline logs. Which combination of controls should they implement?
Select an answer first
4foundation · easy
Which of the following is an example of a secure coding practice?
Select an answer first
5application · medium
A company's CI/CD pipeline builds a container image and pushes it to a registry. They want to automatically block the deployment if the image contains critical vulnerabilities. Which step should they add to the pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.