SkillTestPro | CCNP Security 350-701 SCOR Practice Test 18

CCNP Security 350-701 SCOR Practice Test 18 (Hard) - Cloud Security Posture Management and Workload Protection

CISCO CCNP Security Exam Logo

1 / 10

Which primary function does a Cloud Security Posture Management (CSPM) tool perform in a public cloud environment?

Physically racking and cabling servers in the provider's data center

Continuously assessing cloud resource configurations against security best practices and compliance benchmarks to detect misconfigurations

Performing hardware firmware upgrades on the provider's storage arrays, a distinction that grows more important as the environment continues to scale

Managing spanning tree root bridge elections across cloud VLANs

Negotiating the organization's cloud services contract terms

Issuing IP addresses via DHCP to on-premises endpoints

2 / 10

Which common cloud misconfiguration is a CSPM tool specifically designed to detect, such as a storage bucket left accessible to the public internet?

An expired vending machine payment terminal certificate, though this can vary depending on which specific cloud provider is in use

A conference room projector firmware mismatch

A print queue backlog on a local office printer

Overly permissive resource access policies (such as publicly exposed storage)

A parking garage gate malfunction

A user's forgotten office door badge

3 / 10

Which cloud security concept describes protecting the actual running compute instances, containers, and serverless functions themselves, as distinct from assessing the surrounding account/configuration posture?

Cloud Access Security Broker functionality exclusively, a consideration that several cloud architecture guides treat as a secondary point

Cloud Workload Protection (CWP / Cloud Workload Protection Platform)

Domain registration management exclusively

Physical data center badge access control exclusively

Billing and cost management exclusively

DNS-layer security functionality exclusively

4 / 10

Which container security practice involves scanning container images for known vulnerabilities before they are deployed into a production environment?

Relying solely on the base image vendor's marketing claims of security

Container image vulnerability scanning in the CI/CD pipeline (pre-deployment)

Scanning only the container's network interface MAC address

Scanning only after the container has been running in production for 90 days, under the provider's default configuration before any custom policy is applied

Scanning only the physical host's power supply for faults

Disabling all image scanning to speed up the build pipeline

5 / 10

Which principle should govern the network communication allowed between microservices running in a cloud-native container orchestration environment, to limit lateral movement if one service is compromised?

Relying solely on the container runtime's default configuration with no explicit policy

Allowing any pod to reach any external internet destination with no restriction

Disabling all network policy enforcement to simplify troubleshooting

Placing every microservice on a single shared, unsegmented network with no restrictions, which some organizations handle differently depending on their governance model

Least-privilege network segmentation (such as Kubernetes network policies restricting pod-to-pod communication to only what is required)

Allowing unrestricted communication between all pods and namespaces by default

6 / 10

Which CSPM/CWP capability continuously monitors for configuration drift, alerting when a previously compliant cloud resource is later changed in a way that violates policy?

Annual penetration testing report review only

Continuous compliance monitoring and drift detection

Manual quarterly spreadsheet-based review with no automated monitoring

Physical server rack temperature logging

One-time initial assessment only, performed once at account creation

A single static configuration snapshot with no ongoing comparison

7 / 10

Which type of identity risk does CSPM commonly flag when it detects a cloud IAM role or user account granted overly broad administrative permissions beyond what their function requires?

Network cable crosstalk interference risk

Fire suppression system malfunction risk

Physical key duplication risk

Uninterruptible power supply battery degradation risk

Excessive/over-privileged entitlement risk

HVAC humidity control risk

8 / 10

Which workload protection technique establishes a baseline of expected process and network behavior for a given workload, then alerts on deviations that could indicate compromise, such as an unexpected outbound connection from a database server?

Runtime behavioral anomaly detection for workloads

Manual log review performed once per year

Static, one-time code review performed only before the very first deployment

Relying exclusively on perimeter firewall rules with no workload-level visibility

Disabling all workload monitoring to reduce compute overhead

Physical inventory tagging of server hardware

9 / 10

Which practice most directly reduces the risk posed by hardcoded cloud API credentials embedded in application source code or container images?

Sharing the same long-lived static credential across every application and environment

Committing the credentials directly into a public source code repository for convenience, but typically only once confirmed across multiple regions or accounts

Using a dedicated secrets management service and short-lived, dynamically issued credentials instead of embedding static secrets in code

Storing credentials in plaintext configuration files bundled into the container image

Disabling credential rotation entirely to avoid breaking existing integrations

Emailing the credentials to the development team distribution list for reference

10 / 10

Which combination of controls provides the most effective end-to-end cloud workload security posture, spanning build-time, deploy-time, and runtime?

A single annual manual security audit with no automated controls at any stage

Network segmentation alone with no scanning, IAM controls, or runtime monitoring, a distinction that grows more important as the environment continues to scale

IAM policy enforcement alone with no scanning or runtime monitoring

Image vulnerability scanning in CI/CD, least-privilege IAM and network policy enforcement at deployment, and continuous runtime behavioral monitoring

Image scanning alone at build time with no deployment or runtime controls

Runtime monitoring alone with no build-time scanning or deployment-time policy

Your score is

The average score is 0%