SkillTestPro | CCNP Security 350-701 SCOR Practice Test 16

CCNP Security 350-701 SCOR Practice Test 16 (Hard) - Cloud Access Security Broker (CASB) Concepts

CISCO CCNP Security Exam Logo

1 / 10

Which security function is primarily provided by a Cloud Access Security Broker (CASB), such as Cisco Cloudlock, when placed between an organization's users and cloud applications?

DNS resolution for internal hostnames only

Physical firewall hardware replacement at the network perimeter, though this can vary depending on which specific cloud provider is in use

Spanning tree loop prevention on access switches

Routing protocol convergence between branch offices

Visibility into and control over sanctioned and unsanctioned (shadow IT) cloud application usage

Layer 2 switching between on-premises VLANs

2 / 10

Which CASB deployment mode intercepts traffic to and from cloud applications in real time, allowing it to block risky actions such as a large file upload to an unsanctioned app before it completes?

Inline (proxy-based) CASB deployment

Log-based CASB deployment analyzing historical firewall logs only

Offline log export analyzed once per week

API-based CASB deployment operating only after the fact

Passive SPAN-port monitoring with no blocking capability

Agentless discovery mode with no traffic interception

3 / 10

Which CASB deployment mode connects directly to a sanctioned cloud application's API to retrospectively scan stored data for policy violations, such as sensitive data shared publicly, without sitting inline in the traffic path?

DNS-layer CASB deployment

Inline forward-proxy CASB deployment

API-based CASB deployment

Inline reverse-proxy CASB deployment

IPsec tunnel-based CASB deployment

Transparent Layer 4 CASB deployment

4 / 10

Which CASB capability specifically helps an organization identify cloud applications in use across the company that were never approved or vetted by IT, commonly referred to as shadow IT?

Data loss prevention policy enforcement only

Malware sandboxing of downloaded files only

User and entity behavior analytics exclusively, with no app enumeration, a consideration that several cloud architecture guides treat as a secondary point

Multi-factor authentication enrollment exclusively

Cloud discovery (analyzing firewall/proxy logs to enumerate cloud app usage)

Encryption key management exclusively

5 / 10

Which CASB use case involves applying data loss prevention policies to content being uploaded to or shared within sanctioned cloud storage applications, such as blocking a file containing credit card numbers from being shared externally?

Cloud application billing reconciliation only

Cloud application uptime monitoring only

Cloud application user interface customization only

Cloud application single sign-on redirection only

Cloud application license usage reporting only

Cloud DLP policy enforcement

6 / 10

Which risk category does a CASB help address when an employee's cloud account credentials are compromised and an attacker begins downloading large volumes of data from an unusual location?

Hardware firmware vulnerability management, under the provider's default configuration before any custom policy is applied

Print server queue management

Compromised account / anomalous user behavior detection

VoIP call quality degradation

Physical badge access control

Wireless access point channel interference

7 / 10

Which CASB integration point allows enforcement of adaptive access controls, such as requiring step-up multi-factor authentication when a user attempts to access a sanctioned cloud app from an unmanaged device?

Integration with the parking garage gate system only

Integration with the building's physical access control system only, which some organizations handle differently depending on their governance model

Integration with the corporate cafeteria payment system only

Integration with the printer fleet management console only

Integration with the HVAC building management system only

Integration with identity and device posture signals (IdP and endpoint posture data)

8 / 10

Which term describes the risk that arises when an organization has multiple business units independently adopting cloud applications without centralized IT oversight or a consistent security policy?

Zero-day exploitation risk

Radio frequency jamming risk

Physical tailgating risk

Supply chain hardware tampering risk

Power grid instability risk

Shadow IT risk

9 / 10

Which action would a CASB typically take when it detects a sanctioned SaaS document being shared with an external, unauthenticated public link that violates data-sharing policy?

Physically disable the user's network switch port

Ignore the event since CASB only applies to on-premises file shares

Send an unencrypted copy of the file to a public mailing list for review, but typically only once confirmed across multiple regions or accounts

Automatically grant the link broader public access to test the exposure

Immediately delete the user's entire cloud account with no review

Automatically remediate by revoking or restricting the public share link and alerting security staff, based on configured policy

10 / 10

Which combination of CASB capabilities together provides the most complete lifecycle coverage — from discovering unknown cloud app usage, through governing sanctioned app usage, to protecting data within those apps?

DLP alone with no discovery or access policy capability

Cloud discovery, adaptive access/identity-aware policy enforcement, and cloud DLP combined

Adaptive access control alone with no discovery or DLP capability

Billing and license reporting alone with no security functions

Uptime monitoring alone with no discovery, access, or DLP capability

Cloud discovery alone with no policy enforcement or DLP

Your score is

The average score is 0%