Cloud Security
Cloud Security (15%) tests whether you can map a workload to the right deployment and service model, place responsibility correctly, and choose the Cisco control that fits - Umbrella, CASB, a virtual firewall, or workload protection.
Models and the responsibility split
Deployment: public, private, hybrid, community. Service: IaaS, PaaS, SaaS. The provider always owns physical security, the hypervisor, and the underlying network. The customer always owns data classification, identity and access configuration, and how the service is used.
- IaaS - customer patches guest OS and above.
- PaaS - customer patches the application only.
- SaaS - customer configures identity, sharing, and data loss policy.
Cisco controls
Umbrella is DNS-layer security first: it blocks resolution of malicious or unwanted domains before a connection exists, so no decryption is needed. On top of that sit the Secure Internet Gateway functions (proxy, file inspection, IPS), CASB, DLP, and remote browser isolation, delivered via roaming client, virtual appliance, or IPsec tunnel from a branch.
CASB modes matter for item stems. API-based (out-of-band) mode gives visibility into sanctioned SaaS, applies DLP and can quarantine content, and scans data already at rest, but it cannot block a session in real time. Forward proxy is inline and can block, but requires traffic redirection. Reverse proxy fronts the application.
Cisco Secure Firewall Threat Defense Virtual runs in AWS, Azure, and GCP. Cloud-native security groups are stateful and allow-only by default; network ACLs are stateless and evaluated in order. NAT gateways and load-balancer insertion (GWLB) affect whether traffic is inspected at all. Workload-level controls include Secure Workload for micro-segmentation and Cisco's multicloud defense tooling for misconfiguration detection.
SASE converges networking (SD-WAN) with cloud-delivered security services (SWG, FWaaS, ZTNA, CASB) at the edge, replacing backhauling to a data center.
Worked example
A company adopts a SaaS CRM and wants to block uploads of customer PII, including files already stored. Because the traffic is SaaS and the requirement includes data at rest, an API-based CASB with a DLP rule is the fit: it scans and quarantines existing and new content. A forward proxy would need all users redirected and would not remediate stored files.
Traps that cost marks
Assuming the provider patches a guest OS in IaaS; treating security groups as stateless (they are stateful); expecting API-mode CASB to block in real time; and forgetting that identity is always a customer responsibility.