SkillTestPro | CCNP Security 350-701 SCOR Practice Test 15

CCNP Security 350-701 SCOR Practice Test 15 (Hard) - Cloud Shared Responsibility Model and Security Architecture

CISCO CCNP Security Exam Logo

1 / 10

In the cloud shared responsibility model for Infrastructure as a Service (IaaS), which party is typically responsible for securing the underlying physical data center, hypervisor, and network infrastructure?

A third-party auditor with no ongoing operational role

A regulatory body that manages the physical infrastructure directly

The customer's managed service provider, replacing the cloud provider's role entirely

The customer's own IT department exclusively

The end user of the application with no provider involvement

The cloud service provider

2 / 10

In the shared responsibility model, which security responsibilities typically remain with the customer even when using an IaaS provider?

The provider's global network backbone availability

The provider's underlying hypervisor patching

Physical data center security exclusively

Guest operating system patching, application security, identity and access management, and data encryption/classification

The provider's power and cooling infrastructure

Physical destruction of retired storage hardware

3 / 10

How does the division of security responsibility typically shift when moving from IaaS to SaaS along the shared responsibility spectrum?

The division of responsibility is identical between IaaS and SaaS with no shift at all

Responsibility shifts entirely to a third-party auditor rather than either the provider or customer

The customer assumes full responsibility for every layer with no provider involvement at all

The provider assumes responsibility for more of the stack (including the OS and application layer), while the customer's responsibility narrows mainly to data, identity, and access configuration

The provider becomes responsible only for the physical building and nothing else

The customer assumes full responsibility for the entire stack including the provider's physical infrastructure, though this can vary depending on which specific cloud provider is in use, a consideration that several cloud architecture guides treat as a secondary point

4 / 10

Which term describes a security gap that arises specifically because an organization incorrectly assumes the cloud provider is handling a responsibility that actually remains theirs under the shared responsibility model?

A zero-day vulnerability in the provider's hypervisor

A routing outage on the provider's backbone network

A physical break-in at the provider's data center

A shared responsibility gap (misconfiguration or coverage gap due to misunderstood responsibility boundaries)

A hardware failure in the provider's storage array

A distributed denial-of-service attack against the provider's infrastructure, under the provider's default configuration before any custom policy is applied

5 / 10

Which cloud service model places the greatest share of ongoing security responsibility on the customer, since the customer manages the guest OS, middleware, runtime, and application code themselves?

Desktop as a Service (DaaS) exclusively, with more customer responsibility than IaaS

Infrastructure as a Service (IaaS)

Backup as a Service (BaaS) exclusively, with more customer responsibility than IaaS

Platform as a Service (PaaS) exclusively, with more customer responsibility than IaaS

Software as a Service (SaaS)

Function as a Service (FaaS) exclusively, with more customer responsibility than IaaS

6 / 10

Which cloud security architecture principle involves granting cloud identities (users, roles, and service accounts) only the minimum permissions necessary to perform their required function?

The principle of default allow-all access

The principle of permanent standing administrative access for all users

The principle of relying solely on network-layer controls with no identity controls

The principle of shared credentials across all service accounts

The principle of least privilege

The principle of disabling all logging to reduce noise

7 / 10

Which category of cloud security tooling continuously evaluates cloud environment configurations against best-practice and compliance benchmarks to detect misconfigurations such as publicly exposed storage buckets?

Cloud Access Security Broker (CASB) exclusively, with no posture assessment capability

Security Information and Event Management (SIEM) exclusively, with no cloud configuration scanning

Endpoint Detection and Response (EDR) exclusively

Data Loss Prevention (DLP) exclusively, with no configuration scanning

Cloud Security Posture Management (CSPM)

Network Access Control (NAC) exclusively

8 / 10

In a multi-cloud environment, which challenge is most directly created by each cloud provider having its own distinct identity model, console, and API set?

Inconsistent policy enforcement and increased operational complexity in maintaining uniform security controls across providers

Guaranteed compliance with every regulatory framework without any additional configuration, which some organizations handle differently depending on their governance model

Elimination of the shared responsibility model entirely

Complete elimination of the need for identity and access management

A permanent reduction in the total attack surface with no further action needed

Automatic synchronization of security policy across all providers with zero configuration

9 / 10

Which best practice most directly reduces the risk of a publicly exposed cloud storage bucket leading to a data breach?

Applying least-privilege access policies to storage buckets and regularly auditing them for unintended public access

Disabling encryption on the bucket to simplify access

Sharing a single shared administrative credential across all applications that use the bucket, but typically only once confirmed across multiple regions or accounts

Disabling versioning and backup on all storage buckets

Setting every bucket's default access level to public for ease of use

Removing all access logging on storage resources

10 / 10

Which statement most accurately reflects how compliance obligations (such as PCI DSS or HIPAA) are handled under the cloud shared responsibility model?

The customer remains accountable for overall compliance of their workload, even though certain underlying controls may be inherited from a provider's certified infrastructure

Using a cloud provider automatically transfers full compliance accountability to the provider with no customer obligation, a distinction that grows more important as the environment continues to scale

Only the provider needs to undergo any compliance audit, and the customer is exempt from all audits

The customer can ignore data residency and access control requirements entirely once using a compliant provider

Compliance is guaranteed automatically by the provider's physical data center certification alone

Compliance requirements no longer apply once workloads move to the cloud

Your score is

The average score is 0%