Chapter 3 of 6 · Cisco CCNP 350-701 SCOR
Cloud Security
Shared responsibility, cloud models and CASB, Multicloud Defense, Splunk, eBPF workload security, DevSecOps.
- 6topics
- 26 minfast track
- 2diagrams and exhibits
- 15%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Shared Responsibility, Security Frameworks and Policy ManagementLearn the cloud shared responsibility model for IaaS, PaaS and SaaS, security capabilities such as CSPM, security frameworks and…4 min
- 2Cloud Models, NIST 800-145 and Cloud Access Security BrokerLearn the NIST 800-145 cloud definitions, public, private, hybrid and community models, IaaS, PaaS and SaaS, and how a CASB…4 min
- 3Cloud Network, Application and Data Security with Multicloud Defense and Secure WorkloadDescribe cloud network, application and data security, and how Cisco Multicloud Defense and Cisco Secure Workload give inspection…Diagram5 min
- 4Ingesting Cloud Logging and Monitoring Data into SplunkConfigure Splunk to ingest cloud and security logs using add-ons, the HTTP Event Collector, syslog and streaming services, then…Diagram5 min
- 5Application and Workload Security Concepts Including eBPFLearn application and workload security for VMs, containers and serverless, including runtime protection, microsegmentation and…4 min
- 6DevSecOps, Infrastructure as Code and Container SecurityLearn DevSecOps: shift left security in the CI/CD pipeline, Infrastructure as Code scanning, Kubernetes and container security…4 min
About this chapter
What this chapter covers
Cloud Security explains how to protect systems and data that run on someone else's infrastructure.
It starts with who is responsible for what, then moves to cloud models, Cisco cloud security products, log collection with Splunk, workload protection and secure software delivery.
The pages follow the seven topics that the question bank uses for this chapter. They stay at the level of concepts and products that the exam describes, and avoid detail that changes from release to release.
How the topics fit together
Responsibility comes first, because it decides which controls you have to supply yourself.
The first two pages set the vocabulary. Shared responsibility and frameworks show what the customer must secure, and cloud models and CASB define the service and deployment types and the control point for cloud application use.
The next two pages are product and operations focused. Multicloud Defense and Secure Workload show how network, application and data security are delivered, and Splunk ingestion shows how the logs from all these controls reach one place.
The last two pages look at the workload and the way it is built. Workload security and eBPF covers runtime protection, and DevSecOps covers the pipeline, Infrastructure as Code and containers.
Responsibility is the thread through the chapter. When you read a scenario, first decide whether the provider or the customer owns the control.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and examples.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
If you can, try a free cloud account or a lab to see security groups, audit logs and a small Kubernetes cluster. Seeing the settings makes the concepts much easier to recall.
Ready for more practice?
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.