3.4 Describe Network, Application, and Data Security in Cloud Environments with Solutions Such as Cisco Multicloud Defense and Cisco Secure Workload 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a cloud environment, what is a common way to implement a virtual firewall to protect east-west traffic?

   • ABy installing a physical firewall in the cloud data center
   • BBy using security groups and network ACLs provided by the cloud provider
   • CBy deploying a firewall appliance in each availability zone and routing all traffic through it
   • DBy configuring the hypervisor to block all traffic between virtual machines
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of application dependency mapping in Cisco Secure Workload?

   • ATo automatically patch all workloads
   • BTo replace the need for network monitoring tools
   • CTo encrypt all traffic between workloads
   • DTo identify which workloads communicate with each other, enabling the creation of precise security policies
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company runs a legacy application on a set of virtual machines in a private cloud. The application has not been updated in years, and the security team cannot install agents on the VMs. They still want to implement micro-segmentation to limit lateral movement. Which Cisco Secure Workload deployment mode should be used?

   • AUse agent-based enforcement on the VMs.
   • BUse a cloud-native security group in the private cloud.
   • CUse a traditional VLAN-based segmentation approach.
   • DUse network-based enforcement with the Cisco Secure Workload platform analyzing flow data from the network.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company stores sensitive documents in a cloud storage service. The security team wants to prevent sensitive data from being uploaded to the storage in the first place. They also want to ensure that data is encrypted at rest. Which set of controls should be implemented?

   • AUse a VPN for all access to the storage and enable encryption at rest.
   • BImplement a DLP policy and use a WAF.
   • CImplement a Data Loss Prevention (DLP) policy and enable encryption at rest.
   • DEnable encryption at rest and use a network firewall.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company exposes a REST API to external partners. The API is hosted in a cloud environment and is protected by a web application firewall. The security team wants to add protection against API-specific threats such as excessive data exposure, broken object-level authorization, and mass assignment. Which capability should be added?

   • AA DDoS protection service at the network layer.
   • BA VPN gateway for all external partner connections.
   • CA network firewall with deep packet inspection for HTTP traffic.
   • DAn API gateway with schema validation and rate limiting.
   Reveal Solution Discussion Select an answer first