Cloud Security
Concepts to know
Cloud security in CCNP Security centers on Cisco Umbrella and cloud-delivered security: DNS-layer security, intelligent proxy, cloud firewall, CASB, DLP, and secure internet gateway functions. Understand SASE and SSE terminology: policy enforced near the user, identity-aware, and delivered as a service. Know the shared responsibility model-the provider secures cloud infrastructure; you secure identities, configurations, data, and workloads. DNS security intercepts domain lookups; the intelligent proxy handles URLs and file inspection; the cloud firewall handles IP and port traffic. CASB can operate API-based (out-of-band) or inline.
Traps
- Umbrella DNS protection only sees DNS queries; traffic to an allowed IP without DNS is not blocked by DNS policy.
- A roaming client can be bypassed if users change DNS settings; internal networks need a virtual appliance or resolver forwarding.
- CASB API mode cannot block real-time sessions; inline mode can.
- Cloud firewall rules and DNS policies are separate layers-do not assume one covers the other.
- Identity provider integration matters for user-based rules; IP-based rules fail for roaming users.
Worked example
A user resolves malware.example and Umbrella returns a block page. If the same user connects directly to the IP, DNS policy does not apply; the intelligent proxy or firewall must block it. Rule of thumb: DNS first, proxy second, firewall third-layer the controls and verify which layer sees the traffic.