Cloud Application Security

A company is migrating a legacy application to the cloud. The application uses hardcoded database credentials. Which secure development practice should be implemented to address this?

A security architect is designing a CI/CD pipeline for a cloud-native application. The team wants to automatically scan container images for vulnerabilities before deployment. Which of the following is the most effective approach?

A SaaS provider uses a customer-managed encryption key (CMEK) model for data-at-rest. The provider's application runs in a multi-tenant cloud environment. Which attack surface is MOST directly mitigated by this approach?

An organization is developing a mobile app that communicates with a cloud API. To ensure secure authentication, which of the following should be used?

A cloud security team is implementing a Web Application Firewall (WAF) for a public-facing web application. The application uses a REST API with JSON payloads. Which of the following is the WAF's primary benefit?

A company deploys microservices in Kubernetes. Each service communicates via gRPC with mutual TLS. A security assessment reveals that some services use self-signed certificates. What is the primary risk?

A developer is tasked with securely storing a session token in a browser-based web application. Which storage mechanism is most secure?

A company is implementing a serverless application using AWS Lambda. The function processes S3 events and writes to a DynamoDB table. Which of the following is the MOST secure way to grant the necessary permissions?

Which TWO of the following are common best practices for securing cloud application APIs? (Choose two.)

Which THREE of the following are essential components of a Secure Software Development Lifecycle (SSDLC) in the cloud? (Choose three.)

Which TWO of the following are effective methods to protect against server-side request forgery (SSRF) in a cloud application? (Choose two.)

Refer to the exhibit. A log entry shows a suspected SQL injection attack. Which security control would have prevented this attack?

A financial services company uses a multi-region cloud deployment for its trading application. The application consists of a web frontend, a REST API, and a relational database. Recently, a penetration test revealed that an attacker could perform a time-based blind SQL injection through the API's search functionality. The injection allows the attacker to enumerate database contents by observing response times. The development team was already aware of the issue but had prioritized other features. The security team now demands immediate remediation. The application is critical and cannot be taken offline. Which of the following is the most effective immediate action to mitigate the risk without modifying the application code?

A healthcare SaaS provider is deploying a new application that processes protected health information (PHI). The application uses a microservices architecture running on Kubernetes. Each microservice stores its data in a separate database. The compliance team requires that all data at rest be encrypted and that encryption keys be managed by the customer (CMEK). The cloud provider supports KMS with CMEK. However, the development team wants to use a single customer-managed key for all databases to simplify key management. The security architect is concerned about the blast radius if the key is compromised. Which of the following recommendations best balances security and operational efficiency?

A cloud security architect is designing a CI/CD pipeline for a serverless application using AWS Lambda. The application processes sensitive user data and requires encryption at rest and in transit. Which of the following is the BEST approach to securely manage database credentials used by the Lambda function?

A security team is implementing a web application firewall (WAF) for a cloud-based e-commerce application. The application is built on a microservices architecture and uses a RESTful API. Which of the following is the PRIMARY reason to deploy the WAF at the API gateway level rather than at the individual service level?

A company is migrating a legacy monolithic application to a cloud-native microservices architecture. The security architect is concerned about securing inter-service communication. Which of the following should be implemented to ensure mutual authentication and encryption between services?

An AWS S3 bucket policy is configured as shown in the exhibit. The security team wants to ensure that only requests from the corporate IP range (203.0.113.0/24) can read objects in the bucket. However, they notice that a CloudFront distribution configured to serve content from this bucket is returning 403 Forbidden errors. What is the MOST likely cause?

A company is implementing a secure software development lifecycle (SSDLC) for its cloud-native applications. Which practice should be automated to detect vulnerabilities early in the development process?

Which TWO of the following are primary objectives of a cloud application security program?

Drag and drop the steps for conducting a cloud security risk assessment using the NIST CSF framework into the correct order.

A cloud security architect is designing a multi-tier application that processes sensitive customer data. To protect data in transit between the web tier and the application tier, which of the following is the MOST appropriate approach?

A DevSecOps team is integrating static application security testing (SAST) into their CI/CD pipeline. Which of the following is the PRIMARY benefit of performing SAST during the build phase rather than later in the pipeline?

A company is deploying a containerized application on Kubernetes. The security team requires that containers run with the least privilege, and that any attempt to escalate privileges within a container is blocked. Which Kubernetes security context setting should be applied to the pod specification?

A security analyst is reviewing application logs and notices that a large number of requests from a single IP address are attempting to access a REST API endpoint with invalid session tokens. Which cloud-based mitigation is MOST effective at blocking such automated attacks?

A financial services company is adopting a cloud-native microservices architecture. They want to ensure that only authorized services can communicate with each other, and that all inter-service communication is encrypted. Which of the following is the BEST approach?

An organization is migrating a legacy application to the cloud and plans to use a cloud access security broker (CASB). Which of the following is the PRIMARY function of a CASB in securing cloud applications?

A company is adopting DevSecOps and wants to incorporate security testing into their continuous integration pipeline. They have decided to run SAST (static analysis) and SCA (software composition analysis) tools. Which of the following is the PRIMARY reason for including SCA in addition to SAST?

Which TWO of the following are secure coding practices that help prevent injection attacks?

Which THREE of the following are common challenges in securing serverless applications?

Which THREE of the following are effective controls to secure a RESTful API in the cloud?

A security team is reviewing a cloud application's CI/CD pipeline. They want to ensure that only approved open-source libraries are used in production builds. Which approach best addresses this requirement?

An organization uses a multi-cloud architecture with applications running on both AWS and Azure. They need to implement a secrets management solution that works across both platforms and supports automated rotation. Which approach best meets these requirements?

A security engineer is investigating an incident where an attacker exploited a server-side request forgery (SSRF) vulnerability in a cloud application. The application runs in a cloud environment and uses internal metadata endpoints. Which mitigation should be prioritized to prevent future SSRF attacks?

A company is adopting a serverless architecture using AWS Lambda. The security team is concerned about potential injection attacks via event payloads. Which practice is most effective at mitigating such attacks?

A cloud application uses containers orchestrated by Kubernetes. The security team wants to enforce that containers cannot run as root and that file systems are read-only at runtime. Which Kubernetes security context configuration should be applied?

A cloud application uses a RESTful API that handles payment transactions. The security team identifies that the API is vulnerable to brute-force attacks on the authentication endpoint. Which control should be implemented to mitigate this?

An organization uses infrastructure as code (IaC) to deploy cloud resources. The security team wants to prevent misconfigurations such as open security groups from being deployed. Which two practices should be integrated into the IaC pipeline? (Select TWO)

A cloud application uses a service mesh for inter-service communication. The security team wants to enforce mutual TLS (mTLS) between all services and ensure that service identities are verified. What is the most effective way to achieve this?

A security architect is designing access controls for a cloud-based microservices application. Which approach best aligns with the principle of least privilege for service-to-service authentication?

A development team is migrating a legacy application to the cloud. Which security testing approach should be adopted early in the CI/CD pipeline to catch vulnerabilities as code is written?

A cloud security engineer needs to ensure that a containerized application running in a Kubernetes cluster securely stores and rotates database credentials. Which is the most appropriate solution?

During a code review, a developer identifies that an application uses input from an HTTP request to generate a SQL query string. What is the primary security concern?

An organization deploys a serverless application using AWS Lambda functions that access an RDS database. Which practice best ensures that the database credentials are protected?

Which of the following is a key benefit of using a software composition analysis (SCA) tool in a cloud application security program?

A company wants to enforce that all API calls to its cloud services are authenticated and authorized. Which design pattern should be implemented?

A DevOps team wants to prevent insecure code from being deployed to production. Which gate should be implemented in the CI/CD pipeline?

Which TWO measures are effective for securing container images in a cloud environment?

Which THREE are best practices for implementing secrets management in cloud applications?

Which TWO practices help protect against insecure deserialization attacks in cloud applications?

An IAM policy named S3ReadOnlyAccess has DefaultVersionId v3. What does this indicate?

A cloud security engineer reviews this Terraform configuration for a security group. Which change is necessary to improve security?

A company develops a microservices application and wants to ensure secrets such as API keys and database credentials are not exposed in container images. Which approach best meets this requirement?

A SaaS application allows users to upload profile pictures. The development team wants to prevent upload of malicious files that could compromise the server. Which control is most effective?

A cloud application uses OAuth 2.0 for authorization. What is the primary purpose of using a refresh token in this flow?

An organization uses a CI/CD pipeline that automatically builds and deploys container images to a Kubernetes cluster. A security scanner flags that the base image contains a critical vulnerability. What is the best course of action to prevent vulnerable images from being deployed?

A developer wants to ensure that sensitive data in a cloud database is protected even if the database backup files are stolen. Which best practice should be implemented?

A cloud security engineer is reviewing the authentication mechanism for a web application. The application currently uses API keys transmitted in the URL query string. What is the primary security concern with this approach?

Which of the following is the best way to protect a web application from cross-site scripting (XSS) attacks?

A company uses a serverless architecture with AWS Lambda to process user-uploaded files. The Lambda function is triggered by an S3 bucket event. While reviewing security, the architect wants to ensure that the Lambda function cannot be invoked by unauthorized S3 buckets or accounts. What is the most secure configuration?

Which TWO of the following are considered best practices for securing containerized applications in a cloud environment?

Which THREE of the following are valid techniques to protect application programming interfaces (APIs) from abuse?

A company is moving a legacy application to the cloud. The application uses hard-coded passwords for database connections. Which secure development practice should be implemented to address this issue?

A cloud application experiences intermittent failures during peak load. Logs show database connection timeouts. Which architecture change would best address this issue?

A software company develops an API for third-party integrations. They want to ensure that only authorized partners can access the API. Which authentication mechanism is most appropriate?

A team is adopting DevSecOps. Which practice best integrates security into the development lifecycle?

Which TWO best practices help secure a cloud application's runtime environment?

Which TWO are effective strategies for securing cloud application data at rest?

Which THREE are key considerations when designing a secure software development lifecycle (SSDLC) for cloud applications?

A company runs a multi-tier cloud application with a web frontend, an API layer, and a database. The application uses OAuth 2.0 for authentication. Recently, users have been experiencing session hijacking attacks. Upon investigation, the security team finds that session tokens are being intercepted in transit. The application uses HTTPS for all communications, but a developer discovers that the application is also accessible via HTTP due to a misconfiguration. The team wants to implement additional security controls to prevent token theft. Which course of action should be taken first?

A security architect is designing a cloud-native application using microservices. They decide to implement mutual TLS (mTLS) for service-to-service communication in a Kubernetes cluster with hundreds of services. What is the primary challenge in managing mTLS certificates in this dynamic environment?

A security team is reviewing controls for a cloud application that transmits personally identifiable information (PII) over the internet. Which TWO controls are essential for protecting data in transit?

A healthcare SaaS company runs containerized microservices on Google Kubernetes Engine (GKE). The security team scans containers with a vulnerability scanner and finds that base images have several critical vulnerabilities. The container build process uses a Dockerfile that pulls the latest Ubuntu image from Docker Hub. The team wants to reduce the attack surface without delaying feature releases. What is the best approach?

A large enterprise is migrating a legacy .NET application to Azure App Service. The application currently stores session state in-memory on the web server. During the migration, the team plans to horizontally scale the application across multiple instances. The security team requires that session data remain confidential and be available even if an instance fails. Which solution should the team implement?

A financial services company deploys a containerized application on Amazon ECS with Fargate. The application needs to access an encrypted RDS database. The security policy mandates that database credentials must never be stored in the application code or configuration files and must be rotated automatically every 90 days. Which solution should the DevOps team implement to satisfy these requirements?

A software company develops a mobile application that communicates with a cloud backend using REST APIs. The application uses OAuth 2.0 with the authorization code grant and PKCE for authentication. After a security audit, the team identifies that the backend API accepts both a client secret (from the authorization code grant) and a PKCE code verifier. The security team wants to remove unnecessary attack surface. Which change should be made?

A cloud security architect is designing a CI/CD pipeline for a containerized application. The requirement is that container images be cryptographically signed by the build system and that only images with valid signatures be admitted to the production Kubernetes cluster. Which combination of controls best achieves this?

A cloud team is building a web application that stores user session tokens in the browser. A security review recommends that the tokens be inaccessible to JavaScript to reduce the impact of cross-site scripting attacks. Which cookie attribute should be set on the session token?

A cloud-native application team is adopting a secrets management service to eliminate hardcoded credentials in source code and configuration files. Which two practices best align with secure secrets management in the cloud? (Choose two.)

A cloud security engineer is reviewing the security posture of a web application deployed on AWS. The application uses an Application Load Balancer (ALB) and EC2 instances. The engineer wants to ensure that all incoming traffic is encrypted in transit. Which action should the engineer take?

A cloud application uses an API gateway to expose backend microservices. The security team wants to ensure that clients cannot bypass the gateway and call backend services directly. Which control should be implemented to enforce this?

A cloud-native application uses a microservices architecture deployed on Kubernetes. The security team wants to ensure that only authorized services can communicate with each other, and that communication is encrypted. Which Kubernetes feature should be used to meet these requirements?

A healthcare SaaS provider exposes REST APIs to partner clinics. The security team must ensure that the API cannot be abused by replaying captured requests. The API already uses TLS 1.3 and OAuth 2.0 bearer tokens with short lifetimes. Which additional control best mitigates replay attacks against the API?

A cloud operations team is building a CI/CD pipeline that deploys container images to a managed Kubernetes cluster. Security policy requires that only images whose vulnerabilities have been scanned and approved can run. The team wants the cluster itself to refuse any pod that references an unapproved image, even if the pipeline is bypassed. Which mechanism should they implement?

A retail company is migrating its monolithic e-commerce application to containers on a managed Kubernetes service. The security architect wants to ensure that if a container is compromised, the attacker cannot use the container's credentials to access the underlying node's filesystem or other pods' volumes. Which Kubernetes feature should be configured to meet this requirement?

A cloud team is designing a new microservices application deployed on a managed Kubernetes service. The security architect requires that all service-to-service traffic be encrypted with mutual TLS (mTLS) without modifying application code. Which cloud-native component should be implemented to meet this requirement?

A healthcare organization runs a multi-tenant SaaS application on a public cloud. Each tenant's data is stored in a shared database with a tenant identifier column. A penetration test shows that a crafted API request can return records belonging to another tenant. The application already authenticates users and validates their tenant membership at login. Which control most directly addresses the root cause of this finding?

A healthcare company runs a containerized patient portal on a managed Kubernetes service. Security policy requires that every container image be cryptographically verified as coming from the company's internal build pipeline before any pod is admitted to the cluster. The images are stored in a private OCI registry, and each build produces a signature using a private key held in a cloud key management service. Which mechanism should be implemented to enforce this policy at admission time?

A cloud-native payroll application stores employee bank details in a managed database. The security team wants to ensure that even if the database storage is compromised, the data cannot be read without explicit decryption. They also need to minimize changes to the application code. Which approach best meets these requirements?

A company is migrating a legacy web application to the cloud. The application uses a relational database. The security team wants to ensure that database credentials are never hardcoded in the application and are automatically rotated. Which cloud-native approach should be used?

A cloud security engineer is reviewing the software development lifecycle for a team building a containerized application on a public cloud. The team wants to shift security left and reduce vulnerabilities in production images. Which two practices should be implemented to achieve this? (Choose two.)

A development team is building a web application that stores user passwords. The security architect recommends using a password hashing algorithm with a tunable work factor and a per-user random salt. Which approach best meets this recommendation?

A cloud application team is designing a multi-tenant SaaS platform on a public cloud. Tenant data is stored in a shared database, and the application uses a single service account to connect. During a threat modeling session, the security architect raises concerns that a coding error could allow one tenant to read another tenant's records. Which control should be implemented to provide defense in depth against this cross-tenant data access risk?

A media company uses a CI/CD pipeline to deploy a web application to a cloud platform. The security team wants to integrate security testing that can detect vulnerabilities in third-party libraries and base images before deployment, without significantly slowing the pipeline. Which practice should be implemented?

A cloud team is integrating a third-party analytics service into its application. The vendor requires access to data in the organization's object storage bucket. Security policy forbids sharing long-lived cloud credentials with third parties. Which approach best satisfies the policy while granting the vendor the required access?

A healthcare company runs a containerized patient portal on a managed Kubernetes service. The security team needs to ensure that container images cannot be deployed if they contain known critical vulnerabilities. The build pipeline already produces an SBOM. Which control should be enforced at the admission layer to meet this requirement?

A cloud application uses a managed API gateway to expose REST APIs. The security team wants to ensure that clients cannot bypass the gateway and call backend services directly. The backend services run on private subnets and are fronted by an internal load balancer. Which control should be implemented to enforce this requirement?

A company is building a cloud-native API that uses OAuth 2.0 for delegated authorization. The security team wants to harden the authorization code flow against token interception and misuse. Which two measures should be implemented to protect the authorization code and tokens? (Choose two.)

A cloud security team is designing a secure software development lifecycle (SDLC) for a new microservices application deployed to a public cloud. They want to ensure that security is embedded throughout development and operations. Which two practices should be implemented to achieve this? (Choose two.)

A cloud-native SaaS provider uses OpenID Connect (OIDC) for user authentication. The security architect wants to reduce the impact of stolen authorization codes and ensure that tokens issued to a single-page application cannot be replayed by a different client. Which OIDC mechanism should be implemented?

A development team is building a cloud-native application that stores user session data in a managed Redis service. The security architect requires that session data be encrypted at rest and that the application authenticate to Redis without embedding static credentials in code. Which approach best meets these requirements?

A security team is reviewing the software development lifecycle for a cloud-native application. They want to shift security left and reduce the cost of remediating defects. Which two practices best support this goal? (Choose two.)

A cloud operations team is deploying a web application that stores configuration files and application logs in an object storage bucket. The security policy requires that data be encrypted at rest, and the team wants the cloud provider to manage the encryption keys with minimal operational overhead. The bucket must remain accessible to the application without code changes. Which approach should the team use?

A security engineer is reviewing a cloud application that uses OAuth 2.0 to delegate access to a third-party API. The application is a single-page application (SPA) running in the browser. The engineer wants to prevent authorization code interception and ensure that the client cannot impersonate another client. Which OAuth 2.0 enhancement should be implemented?

A cloud security team is reviewing a CI/CD pipeline that builds and deploys a containerized application to a production cluster. The pipeline runs in a cloud build service and uses a long-lived service account key stored as a secret in the pipeline configuration to push images and update deployments. A recent audit flagged this as a risk. Which change best reduces the risk of credential compromise while maintaining automated deployments?

A development team is building a cloud application that stores sensitive customer data in a managed database service. The security policy requires that data be encrypted at rest with keys that the organization controls and can rotate independently of the cloud provider. Which approach meets this requirement?

A retail company migrates its customer-facing web application to a cloud environment. The security team wants to ensure that security testing is integrated throughout the software development lifecycle (SDLC) rather than only before production deployment. Which approach best aligns with this goal?

A cloud application team is adopting a DevSecOps pipeline for a containerized workload. They want to integrate security testing that can detect vulnerable dependencies and misconfigured infrastructure-as-code templates before deployment. Which two practices should be implemented to meet these goals? (Choose two.)

A cloud security engineer is reviewing a serverless application built with AWS Lambda. The function processes messages from an Amazon SQS queue and writes to an Amazon DynamoDB table. The engineer needs to ensure that the Lambda function has only the necessary permissions to perform its tasks. Which approach best follows the principle of least privilege?

A cloud provider's API is used by an application to retrieve secrets from a managed secrets store. The security team wants to ensure that if a secret is compromised, its use is limited to a short window and that all access is attributable to a specific workload identity. Which combination best meets these requirements?

A security architect is designing a multi-tenant SaaS application hosted on AWS. The application uses a shared Amazon RDS database with a tenant_id column to isolate data. The architect must ensure that tenants cannot access each other's data even if there is a vulnerability in the application layer. Which additional control should be implemented to enforce data isolation at the database level?

A development team is building a cloud application and needs to store API keys and database passwords securely. The team wants to minimize management overhead and ensure automatic rotation of secrets. Which AWS service should they use?

A cloud application uses a microservices architecture deployed on Kubernetes. The security team wants to enforce that only signed container images from a trusted registry can be deployed to the cluster. Which Kubernetes feature should be used to achieve this?

A cloud application development team is using a public API gateway to expose microservices. The security team wants to protect the APIs from common web vulnerabilities such as SQL injection and cross-site scripting (XSS). Which control should be implemented at the API gateway?