I85PREP
⌘ K
CCIE Security study materials
CCIE Security study resources

CCIE Security practice questions

One question at a time. Build your CCIE Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security

When an AnyConnect client connects to a Cisco ASA using IKEv2 with certificate-based authentication, which check does the ASA perform on the client certificate by default before completing the tunnel?

  1. It accepts any certificate presented and relies on the username/password in EAP for authorization
  2. It verifies the certificate chain to a trusted CA and checks revocation via CRL or OCSP Correct answer.
  3. It requires the client certificate to be signed by the same CA that issued the ASA's identity certificate only
  4. It validates the certificate subject against a local LDAP group name before IKEv2 completes

Explanation

The ASA validates the peer certificate by building a chain to a CA in its trustpoint list and, when configured, checking revocation through CRL or OCSP. Authorization attributes such as group policy are applied after authentication, not as a precondition of chain validation.

Question 2Network Security

Which statement correctly describes the function of the IKEv2 IKE_AUTH exchange in an IPsec site-to-site tunnel?

  1. It performs a Diffie-Hellman exchange to derive the IKE SA keys and nothing else
  2. It negotiates the child SA proposals and installs the IPsec SAs used for data traffic
  3. It rekeys the IKE SA when the lifetime expires without touching child SAs
  4. It authenticates the peers and creates the first child SA (IPsec SA) in the same exchange Correct answer.

Explanation

IKE_AUTH authenticates the peers using the chosen method and, in the same exchange, creates the first child SA that carries data traffic. Subsequent child SAs are created with CREATE_CHILD_SA, and DH key derivation for the IKE SA occurs in IKE_SA_INIT.

Question 3Network Security

A network engineer wants the ASA to drop traffic from any source that has not completed a successful posture assessment when using AnyConnect with HostScan. Which configuration element enforces this?

  1. A tunnel group with the authentication method set to certificate only
  2. A class map matching the posture status and a policy map with the drop action
  3. A dynamic access policy (DAP) with an endpoint attribute condition that terminates the session Correct answer.
  4. A group policy with the vpn-simultaneous-logins set to zero

Explanation

Dynamic access policies evaluate endpoint posture attributes supplied by HostScan and can restrict or terminate the session when the posture condition is not met. Class maps and policy maps in the ASA modular policy framework match traffic, not endpoint posture state.

Question 4Network Security

In a Cisco Identity Services Engine deployment, which component makes the final authorization decision for a network access request?

  1. The external LDAP server after returning group membership
  2. The network access device (NAD) after receiving the RADIUS Access-Accept
  3. The endpoint supplicant after completing 802.1X EAP exchange
  4. The Policy Service node after evaluating identity, posture, and authorization policy Correct answer.

Explanation

The Policy Service node evaluates identity, group, posture, and other conditions against the authorization policy and returns the resulting authorization profile to the NAD. The NAD enforces the returned attributes but does not itself decide the policy outcome.

Question 5Network Security

Which Cisco ISE node persona is responsible for running the profiler service that identifies endpoint types based on network behavior and attributes?

  1. The pxGrid controller node
  2. The Policy Service node Correct answer.
  3. The Monitoring and Troubleshooting node
  4. The Administration node

Explanation

Profiling runs on the Policy Service persona, which collects and analyzes endpoint attributes to classify devices. The Administration persona manages configuration and the MnT persona handles logging and reporting.

Question 6Network Security

A threat defense device running Cisco Secure Firewall Threat Defense software receives a file over an SMB session. Which feature inspects the file to determine whether it is malicious?

  1. Intrusion policy with the balanced security and connectivity ruleset
  2. File policy with AMP for Networks and threat intelligence cloud lookup Correct answer.
  3. SSL policy with default decryption rules
  4. Network discovery policy with host profile updates

Explanation

A file policy sends files to AMP for Networks for local analysis and cloud lookup to determine disposition, and can block files based on the verdict. SSL, intrusion, and discovery policies do not perform file reputation analysis.

Question 7Network Security

In a Cisco Secure Firewall deployment, which statement describes the difference between an access control rule with an intrusion policy and a prefilter policy?

  1. The prefilter policy performs deep inspection while the access control rule only does logging
  2. The prefilter policy is evaluated only after the access control policy has allowed the traffic
  3. The access control rule applies only to decrypted traffic while the prefilter applies to all traffic
  4. The access control rule can invoke intrusion inspection, while the prefilter policy performs fast-path or tunnel handling before the access control policy Correct answer.

Explanation

Prefilter policies are evaluated before the access control policy and handle fast-path, analyze, and tunnel rules to optimize processing. Access control rules can attach intrusion and file policies for deep inspection of permitted traffic.

Question 8Network Security

Which mechanism does Cisco TrustSec use to carry a security group tag (SGT) in a packet without modifying the payload?

  1. 802.1Q VLAN tag with the SGT encoded in the PCP bits
  2. Cisco Meta Data (CMD) header inserted by the ingress device Correct answer.
  3. IP DSCP field with the SGT mapped to a DSCP value
  4. IPsec ESP header with the SGT in the SPI field

Explanation

TrustSec inline tagging uses the Cisco Meta Data header, which carries the SGT and is inserted and removed by TrustSec-capable hardware. VLAN tags, DSCP, and IPsec headers do not natively convey SGTs.

Question 9Network Security

An engineer configures a Cisco ASA to authenticate administrators using TACACS+ with command authorization. Which statement about the ASA's TACACS+ implementation is correct?

  1. The ASA encrypts the entire TACACS+ packet body but leaves the header in clear text Correct answer.
  2. The ASA encrypts only the username field and sends the rest unencrypted
  3. The ASA relies on IPsec to protect TACACS+ because the protocol has no encryption
  4. The ASA uses TLS to protect TACACS+ sessions by default

Explanation

TACACS+ encrypts the body of each packet using a shared secret while leaving the header in clear text, which allows the server to identify the session. It does not use TLS and does not depend on IPsec for confidentiality.

Question 10Network Security

Which Cisco ASA feature allows an administrator to apply a single policy to traffic matching a Layer 3/4 class map and then invoke multiple inspection actions?

  1. The modular policy framework with class maps and policy maps Correct answer.
  2. The global access control policy with implicit deny
  3. The route map with match and set clauses
  4. The object group hierarchy with nested network objects

Explanation

The modular policy framework uses class maps to classify traffic and policy maps to apply actions such as inspection, QoS, or connection limits. Access control lists, object groups, and route maps do not provide this inspection framework.

Question 11Network Security

A Cisco Secure Firewall Management Center manages multiple threat defense devices. Which statement about how access control policy is deployed is correct?

  1. Access control policies are evaluated on the management center for all managed devices
  2. Access control policies are stored only on the device and never on the management center
  3. A single access control policy can be shared across devices, and policy deployment pushes the configuration to each targeted device Correct answer.
  4. Each device must have its own unique access control policy that cannot be shared

Explanation

The management center stores policy definitions centrally and can share one policy across multiple managed devices. Deployment compiles and pushes the relevant configuration to each device, where the policy is actually enforced.

Question 12Network Security

Which statement best describes how Cisco Umbrella SIG (Secure Internet Gateway) enforces DNS-layer security for roaming users?

  1. It relies on endpoint antivirus signatures to block malicious domains
  2. It requires all traffic to be backhauled to a data center before DNS resolution
  3. It resolves DNS queries through Umbrella resolvers that block domains based on policy before a connection is made Correct answer.
  4. It inspects only HTTP traffic after the browser establishes a TLS session

Explanation

Umbrella DNS-layer security uses Umbrella resolvers to evaluate DNS queries against policy and block malicious or unwanted domains before any connection is established. This works for roaming users without backhauling traffic.

Question 13Network Security

When configuring 802.1X on a Cisco switch port, which command enables authentication and specifies the method list to be used on the interface?

  1. switchport port-security
  2. aaa authentication dot1x default group radius
  3. dot1x system-auth-control
  4. authentication port-control auto Correct answer.

Explanation

The interface-level command authentication port-control auto enables 802.1X authentication on the port and uses the configured method list. dot1x system-auth-control is a global command that enables 802.1X on the switch.

Question 14Network Security

Which Cisco ISE feature allows an endpoint to be placed in a quarantine VLAN based on the result of a posture assessment?

  1. Authorization policy with a posture condition and a quarantine authorization profile Correct answer.
  2. Guest portal with sponsor approval workflow
  3. Profiler policy with an endpoint identity group assignment
  4. BYOD onboarding with certificate provisioning

Explanation

The authorization policy evaluates posture conditions and can return a quarantine authorization profile that places the endpoint in a restricted VLAN. Profiling, guest, and BYOD features support identity context but do not themselves enforce posture-based quarantine.

Question 15Network Security

Which statement about Cisco Secure Network Analytics (formerly Stealthwatch) Flow Collector deployment is correct?

  1. The Flow Collector receives flow telemetry such as NetFlow or IPFIX and forwards summarized data to the Management Console Correct answer.
  2. The Flow Collector enforces access control by blocking flows directly
  3. The Flow Collector performs deep packet inspection of payloads to detect malware
  4. The Flow Collector replaces the role of the firewall in the network

Explanation

Flow Collectors ingest flow records exported by network devices and send analyzed data to the Management Console for visibility and threat detection. They are monitoring components and do not enforce blocking or replace firewalls.

Question 16Network Security

A security engineer needs to ensure that traffic from a specific subnet is never sent to the Cisco Secure Firewall for inspection and instead is fast-pathed. Which configuration accomplishes this?

  1. A NAT rule with the destination interface set to any
  2. An SSL policy rule with the do not decrypt action
  3. An access control rule with the block action
  4. A prefilter policy fast-path rule matching the subnet Correct answer.

Explanation

A prefilter fast-path rule bypasses further inspection for matching traffic, sending it directly to the egress path. Blocking, decryption, and NAT rules do not provide the fast-path bypass behavior.

Question 17Network Security

Which Cisco ASA command verifies the current state of IKEv2 security associations for a site-to-site tunnel?

  1. show crypto ipsec sa
  2. show crypto ikev2 sa Correct answer.
  3. show vpn-sessiondb detail
  4. show running-config crypto map

Explanation

show crypto ikev2 sa displays the IKEv2 security associations and their status. The IPsec SA command shows child SAs, and the session database shows remote-access and site-to-site session details rather than IKEv2 SA state.

Question 18Network Security

Which statement describes the purpose of the Cisco ASA's DNS inspection with the 'preserve' action?

  1. It rewrites DNS A records to the ASA's interface address for NAT
  2. It blocks all DNS queries that exceed the maximum message length
  3. It encrypts DNS responses before forwarding them to clients
  4. It leaves the DNS payload unchanged while still enforcing protocol conformance Correct answer.

Explanation

The preserve action keeps DNS payloads intact for NAT scenarios while DNS inspection still validates message format and enforces configured limits. Rewriting A records is the translate action, and DNS inspection does not encrypt responses.

Question 19Network Security

Which Cisco ISE deployment mode allows the Policy Service nodes to operate independently for authentication when connectivity to the primary node is lost?

  1. Distributed deployment where PSNs continue serving cached policies Correct answer.
  2. Standalone deployment
  3. Distributed deployment with high availability
  4. Distributed deployment with the PAN Auto-Failover

Explanation

In a distributed deployment, Policy Service nodes can continue processing authentications using cached policy when they lose connectivity to the primary administration node. Standalone and HA configurations address different failure scenarios.

Question 20Network Security

Which Cisco firewall feature enables an administrator to decrypt and inspect traffic that uses TLS 1.3?

  1. DNS policy with the sinkhole action
  2. Intrusion policy with the security over connectivity ruleset
  3. SSL policy with an outbound decryption rule and a trusted CA certificate Correct answer.
  4. File policy with the block malware action

Explanation

An SSL policy with an outbound decryption rule and a certificate the client trusts allows the firewall to intercept and inspect TLS traffic, including TLS 1.3 where supported. File, intrusion, and DNS policies operate on traffic that has already been decrypted or on other protocols.

Question 21Network Security

Which statement accurately describes the role of the Cisco ASA in a site-to-site VPN using the hub-and-spoke topology?

  1. The spokes must use GRE to reach the hub ASA
  2. The hub ASA must have a static crypto map entry for every spoke's public IP
  3. The hub ASA cannot terminate more than one spoke tunnel
  4. The hub ASA can use dynamic crypto maps to accept spokes with unknown IP addresses Correct answer.

Explanation

A hub ASA can use a dynamic crypto map to accept incoming tunnels from spokes whose public addresses are not known in advance. Static entries per spoke are not required, and the hub can terminate many spoke tunnels.

Question 22Network Security

What is the primary function of the Cisco TrustSec Security Group ACL (SGACL)?

  1. To assign an SGT to an endpoint based on its MAC address
  2. To define which traffic is permitted between source and destination security group tags Correct answer.
  3. To replace 802.1X authentication on access ports
  4. To encrypt traffic between TrustSec-capable switches

Explanation

SGACLs are enforced on TrustSec-capable devices and permit or deny traffic based on the source and destination SGTs. SGT assignment is done through classification mechanisms, and SGACLs do not encrypt traffic or replace authentication.

Question 23Network Security

Which Cisco Secure Firewall Threat Defense feature can detect and block exploit attempts by matching traffic against a library of known vulnerability signatures?

  1. Intrusion policy with a ruleset such as security over connectivity Correct answer.
  2. Access control policy with the trust action
  3. Prefilter policy with an analyze rule
  4. NAT policy with dynamic translation

Explanation

Intrusion policies use signature-based rulesets such as security over connectivity to detect and block exploit attempts. Access control trust actions, NAT, and prefilter analyze rules do not perform signature-based exploit detection.

Question 24Network Security

An engineer needs to verify that a Cisco ASA is receiving the correct authorization attributes from ISE for a VPN user. Which command shows the attributes assigned to the active session?

  1. show interface ip brief
  2. show aaa-server
  3. show vpn-sessiondb detail anyconnect Correct answer.
  4. show running-config group-policy

Explanation

show vpn-sessiondb detail anyconnect displays active session information including authorization attributes returned by the AAA server. The other commands show server configuration, stored group policy, or interface status.

Question 25Network Security

Which statement about Cisco ISE pxGrid is correct?

  1. It is a backup mechanism that replicates the ISE configuration database
  2. It is a publish-subscribe framework that shares contextual data such as endpoint identity and SGT between ISE and integrated systems Correct answer.
  3. It is an encryption protocol that secures RADIUS traffic between the NAD and ISE
  4. It is a routing protocol used between ISE nodes to exchange policy updates

Explanation

pxGrid provides a publish-subscribe framework for sharing context such as endpoint identity, SGTs, and session data with integrated security systems. It is not a routing protocol, encryption protocol, or database replication mechanism.

Question 26Network Security

A Cisco Secure Firewall Threat Defense device is configured with a URL object that uses a category-based reputation lookup and an access control rule that blocks the Malware category. A user requests a site whose category lookup has not yet completed. Which default behavior applies to the initial request while reputation is still pending?

  1. The connection is redirected to the block response page until categorization finishes.
  2. The connection is reset immediately because the category is unknown.
  3. The connection is allowed while reputation is pending and re-evaluated once the lookup completes, unless the rule is set to block on pending. Correct answer.
  4. The connection is dropped and logged as a URL reputation timeout event.

Explanation

Access control rules that use URL category and reputation evaluate the connection based on the reputation state at the time of the request. When the lookup is still pending, the default is to allow the traffic and rely on subsequent evaluation or logging, unless the rule is explicitly configured to block when reputation is undetermined. This prevents unknown or uncategorized destinations from causing unnecessary outages.

Question 27Network Security

An engineer wants Cisco Secure Firewall Threat Defense to apply an intrusion policy only to traffic that matches a specific access control rule, while other allowed traffic is inspected with a different policy. Which configuration element makes this possible?

  1. A variable set attached to the platform settings
  2. An intrusion policy referenced by the specific access control rule Correct answer.
  3. A single global intrusion policy applied to all access control rules
  4. A file policy attached to the default action of the access control policy

Explanation

Intrusion policies are associated with individual access control rules, so traffic matching different rules can be inspected with different intrusion policies or left uninspected. The default action can also carry an intrusion policy, but rule-level association is what allows per-rule differentiation. This design supports tuning detection to the traffic profile of each rule.

Question 28Network Security

Which statement describes how Cisco TrustSec enforces policy on a Cisco Catalyst switch that supports inline tagging?

  1. The switch inserts an SGT into the Ethernet frame and enforces SGACLs locally without a separate tagging protocol. Correct answer.
  2. The switch rewrites the source MAC address to encode the security group.
  3. The switch relies on 802.1Q VLAN tags to represent the security group.
  4. The switch encapsulates the frame in a GRE tunnel carrying the SGT to the egress device.

Explanation

Inline tagging carries the SGT directly in the Ethernet frame using the Cisco Metadata header, allowing capable hardware to propagate and enforce the tag without SXP or GRE. SGACLs are then enforced at the egress point based on the source and destination tags. This preserves the payload and avoids the need for an overlay.

Question 29Network Security

A Cisco ASA is configured for remote access VPN using IKEv2 with certificate authentication. Users report that the tunnel fails after a certificate renewal even though the new certificate is valid. Which action most directly resolves the failure?

  1. Change the IKEv2 proposal to use a stronger encryption algorithm.
  2. Disable certificate revocation checking on the ASA.
  3. Update the trustpoint to reference the new identity certificate and ensure the issuing CA chain is trusted. Correct answer.
  4. Increase the IKEv2 SA lifetime on the group policy.

Explanation

When the identity certificate is renewed, the ASA trustpoint must be updated to bind the new certificate, and the issuing CA chain must remain trusted for validation to succeed. A mismatch between the configured trustpoint and the presented certificate causes IKEv2 authentication to fail. Algorithm or lifetime changes do not address a certificate binding problem.

Question 30Network Security

Which Cisco ISE node role is responsible for storing the configuration and serving as the source of truth for policy across a distributed deployment?

  1. pxGrid controller
  2. Policy Service node
  3. Monitoring node
  4. Primary Administration node Correct answer.

Explanation

The Primary Administration node holds the authoritative configuration and replicates it to secondary administration and policy service nodes. Policy Service nodes enforce policy but do not own the configuration source of truth. The monitoring node stores logging and reporting data, while pxGrid handles context sharing.

Question 31Network Security

An engineer needs to verify that a Cisco ASA is passing traffic that matches a specific class map in a service policy. Which command displays per-class statistics for the applied policy?

  1. show asp drop
  2. show conn detail
  3. show service-policy Correct answer.
  4. show running-config policy-map

Explanation

The show service-policy command displays hit counts and statistics for each class within the applied service policies, confirming whether traffic is matching. The running configuration shows the policy definition but not counters. Connection and ASP drop outputs provide different diagnostic perspectives.

Question 32Network Security

A security team wants to block outbound DNS requests to unauthorized resolvers while allowing queries to approved internal servers. Which Cisco Secure Firewall Threat Defense capability best accomplishes this with minimal performance impact?

  1. A file policy that inspects DNS responses for malware
  2. An SSL policy that decrypts DNS over TLS
  3. A network discovery policy that logs DNS traffic
  4. An access control rule with a DNS application filter that permits only the approved resolvers Correct answer.

Explanation

Application filtering for DNS within an access control rule can match the DNS application and restrict which resolvers are permitted, blocking unauthorized destinations efficiently. File policies inspect transferred files, not resolver selection. SSL decryption and discovery do not enforce resolver allowlisting on their own.

Question 33Network Security

Which statement correctly describes the behavior of a Cisco ASA interface configured with the security-level 0 and the nameif outside?

  1. Traffic from level 0 to a higher level requires no ACL because security levels only affect inspection.
  2. Traffic from a higher security level to level 0 is denied by default unless an ACL permits it. Correct answer.
  3. Traffic from level 0 to a higher security level is permitted by default.
  4. Traffic between two level 0 interfaces is permitted by default.

Explanation

The ASA permits traffic from a higher security level to a lower one by default, but traffic entering a lower level and exiting a higher level requires an explicit ACL permit. Level 0 is the lowest, so traffic toward it is permitted by default and traffic from it is denied by default. Security levels govern the default permit direction.

Question 34Network Security

A Cisco Secure Firewall Management Center manages several threat defense devices in different domains. An engineer wants a rule created once and applied to devices in multiple domains. Which approach is appropriate?

  1. Create the rule in the Global domain and assign it to the target devices. Correct answer.
  2. Create the rule in a leaf domain and promote it to Global.
  3. Create identical rules separately in each leaf domain.
  4. Use a shared object in one domain and reference it from rules in other domains.

Explanation

Rules defined in the Global domain can be applied to devices across leaf domains, centralizing policy that must be consistent everywhere. Leaf domains inherit global rules and can add local ones. Objects and rules are scoped to domains, so cross-domain reuse requires the global scope.

Question 35Network Security

Which Cisco Umbrella capability allows an administrator to block domains for a specific group of users while leaving other users unaffected?

  1. Applying a policy to a selected identity such as a roaming client group Correct answer.
  2. Enabling DNSSEC validation on the virtual appliance
  3. Using the investigate console to search historical DNS activity
  4. Configuring a single global block list for the entire organization

Explanation

Umbrella policies can be scoped to identities such as networks, roaming clients, or directory groups, so blocking decisions apply only to the targeted population. A global block list affects all users. DNSSEC and Investigate provide validation and visibility rather than scoped blocking.

Question 36Network Security

An engineer configures 802.1X with MAC Authentication Bypass (MAB) fallback on a Cisco switch port. A device that does not support supplicant software connects. Which sequence describes the expected behavior?

  1. 802.1X times out, then MAB is attempted using the device MAC address. Correct answer.
  2. MAB is attempted first, then 802.1X after MAB fails.
  3. Both methods run simultaneously and the first success wins.
  4. The port remains unauthorized because MAB requires a supplicant.

Explanation

When 802.1X is enabled with MAB fallback, the switch first sends EAPoL requests and waits for the supplicant timeout. If no supplicant responds, the switch attempts MAB using the source MAC address as the identity. This supports devices such as printers that lack 802.1X software.

Question 37Network Security

A Cisco ASA is configured with a site-to-site VPN to a peer. The engineer wants to confirm which traffic selectors are currently negotiated for the tunnel. Which output provides that information?

  1. show crypto ipsec sa Correct answer.
  2. show running-config tunnel-group
  3. show crypto ikev2 sa detail
  4. show vpn-sessiondb l2l

Explanation

The show crypto ipsec sa command lists the negotiated security associations along with the local and remote traffic selectors, showing which subnets are protected. IKEv2 SA output covers the control-plane tunnel, not the child selectors. Session database and running configuration do not show negotiated selectors.

Question 38Network Security

An engineer must ensure that traffic from a management subnet to a Cisco Secure Firewall Threat Defense device is inspected by an intrusion policy even though the traffic is destined to the device itself. Which configuration is required?

  1. Enable the intrusion policy globally under platform settings only.
  2. Attach the intrusion policy to the access control rule that permits the traffic and ensure the rule applies to traffic to the device. Correct answer.
  3. Apply the intrusion policy to the default action of the access control policy.
  4. Create a prefilter policy that bypasses inspection for the management subnet.

Explanation

Traffic destined to the device is inspected only when an access control rule explicitly permits it and references the intrusion policy; otherwise it is handled by the device's own control-plane rules. Global platform settings do not attach intrusion inspection to specific traffic. Prefilter bypass would exclude the traffic from inspection.

Question 39Network Security

Which statement accurately describes how Cisco TrustSec SGACLs are enforced when a packet traverses multiple devices that support inline tagging?

  1. Each device enforces SGACLs independently based on its local policy, potentially applying multiple checks. Correct answer.
  2. SGACLs are enforced only at the egress device where the destination tag is known.
  3. Only the first device enforces SGACLs and subsequent devices trust the result.
  4. SGACLs are enforced only at the ingress device where the source tag is applied.

Explanation

Inline tagging preserves the SGT across the path, and each enforcement device applies its own SGACL policy based on the source and destination tags it can resolve. This can result in multiple enforcement points along the path. Enforcement is not restricted to a single ingress or egress device.

Question 40Network Security

An engineer wants to reduce the risk of credential theft from endpoints while still allowing domain authentication for legacy applications. Which Cisco ISE capability best supports this goal?

  1. Deploying a monitoring node for log retention
  2. Enabling RADIUS accounting for all authentications
  3. Configuring a guest portal with sponsor approval
  4. Enabling protected EAP with certificate-based machine authentication and restricting password-based methods Correct answer.

Explanation

Certificate-based machine authentication with EAP-TLS avoids transmitting reusable passwords, reducing exposure to credential theft. Restricting weaker password-based methods limits legacy fallback. Guest portals and accounting or monitoring features do not address credential protection.

Question 41Cloud Security

In an AWS deployment, a security engineer must ensure that traffic between two EC2 instances in different VPCs never traverses the public internet while still allowing the instances to use their private IPv4 addresses. Which mechanism satisfies this requirement?

  1. Internet gateway attached to both VPCs
  2. NAT gateway in each VPC
  3. AWS Site-to-Site VPN with static routing
  4. VPC peering connection between the two VPCs Correct answer.

Explanation

A VPC peering connection provides private IP connectivity between two VPCs and keeps traffic on the AWS backbone rather than the public internet. Peering requires non-overlapping CIDR ranges and supports cross-account and cross-Region peering.

Question 42Cloud Security

A security team wants to enforce that no Amazon S3 bucket in an AWS organization can be made public, regardless of individual account administrator actions. Which control provides this guarantee with the least operational effort?

  1. An AWS Config rule that remediates public buckets after evaluation
  2. An SCP at the organization root that denies s3:PutBucketPublicAccessBlock and public ACL operations Correct answer.
  3. Per-account IAM password policies requiring MFA
  4. A CloudTrail alarm that pages the security team when a bucket policy is changed

Explanation

Service control policies set at the organization root apply to every member account and can deny the API actions that would make a bucket public, preventing the change before it happens. Detective controls such as alarms and Config rules react after the fact.

Question 43Cloud Security

Which Azure construct is used to define and enforce allowed resource types and configurations across subscriptions in a management group hierarchy?

  1. Azure Key Vault access policy
  2. Network security group
  3. Azure Policy Correct answer.
  4. Azure RBAC role assignment

Explanation

Azure Policy evaluates resource properties against rules and can deny non-compliant deployments or remediate existing resources, and it inherits down the management group hierarchy. RBAC controls who can perform actions, not what configuration is allowed.

Question 44Cloud Security

A company needs to give an on-premises application access to Google Cloud Storage without embedding long-lived service account keys. Which approach best meets this requirement?

  1. A Google account with a strong password and 2FA
  2. Workload identity federation using an OIDC or SAML identity provider Correct answer.
  3. A shared API key created in the Cloud Console
  4. A JSON service account key stored in the application configuration

Explanation

Workload identity federation lets external workloads exchange credentials from a trusted identity provider for short-lived Google Cloud credentials, eliminating static keys. This is the recommended pattern for hybrid and multi-cloud access.

Question 45Cloud Security

What is the primary security purpose of a cloud security posture management tool in a multi-cloud environment?

  1. Replacing the need for identity and access management
  2. Providing layer 4 firewall filtering between subnets
  3. Encrypting data at rest in object storage
  4. Continuously detecting misconfigurations and policy violations against benchmarks Correct answer.

Explanation

Cloud security posture management continuously assesses cloud accounts against benchmarks and organizational policy to surface misconfigurations and drift. It complements, but does not replace, encryption, firewalling, or IAM.

Question 46Cloud Security

Which statement correctly describes the shared responsibility model for a managed database service such as Amazon RDS?

  1. The provider is responsible for customer data classification and IAM policy design
  2. The provider is responsible for configuring the customer's security groups
  3. The customer is responsible for patching the underlying host operating system
  4. The provider secures the managed infrastructure, while the customer secures data, access, and network configuration Correct answer.

Explanation

For managed services, the provider handles the physical and managed platform layers, while the customer retains responsibility for data, identity, network controls, and client-side encryption choices. The split shifts with the service model but never transfers data accountability to the provider.

Question 47Cloud Security

A team wants to store application secrets in AWS so that they are automatically rotated and access is auditable per-secret. Which service is designed for this?

  1. AWS Systems Manager Parameter Store plaintext parameters
  2. AWS Secrets Manager Correct answer.
  3. Amazon S3 with SSE-KMS
  4. Amazon DynamoDB with client-side encryption

Explanation

AWS Secrets Manager is purpose-built for storing and rotating secrets such as database credentials and supports fine-grained access and audit through CloudTrail. Parameter Store can hold secrets but rotation is not native to plaintext parameters.

Question 48Cloud Security

Which Google Cloud feature allows an organization to centrally restrict which APIs and services member projects may use?

  1. VPC Service Controls
  2. Organization policy constraints Correct answer.
  3. Cloud Armor security policies
  4. Identity-Aware Proxy

Explanation

Organization policies are constraints applied at the organization, folder, or project level that restrict resource configuration and service usage. VPC Service Controls create a service perimeter against data exfiltration but do not centrally restrict which APIs a project may enable.

Question 49Cloud Security

A security architect is designing connectivity so that an on-premises data center and an AWS VPC exchange routes dynamically over an encrypted link with BGP. Which combination should be used?

  1. AWS Direct Connect alone without a VPN
  2. AWS Site-to-Site VPN attached to a virtual private gateway or transit gateway Correct answer.
  3. VPC peering with static routes
  4. An internet gateway with a NAT instance

Explanation

A Site-to-Site VPN provides IPsec encryption and uses BGP for dynamic route exchange between the customer gateway and the AWS virtual private gateway or transit gateway. Direct Connect alone is not encrypted by default.

Question 50Cloud Security

An engineer needs to allow EC2 instances in a private subnet to reach an external package repository for patching while preventing inbound connections from the internet. Which design meets this requirement?

  1. Attach an internet gateway and assign public IPs to the instances
  2. Use a VPC endpoint for the external repository
  3. Open inbound 443 on the instances' security group
  4. Route the subnet through a NAT gateway in a public subnet with a security group allowing outbound 443 Correct answer.

Explanation

A NAT gateway lets instances in a private subnet initiate outbound connections while remaining unreachable from the internet, and a security group can restrict egress to HTTPS. This provides one-way connectivity consistent with the requirement.