CCSP Cloud Application Security — 10 Questions

Question 1

During a code review, a developer discovers hardcoded AWS access keys in a configuration file that was committed to the repository. Which tool is specifically designed to detect such secrets in code repositories?

Accepted Answer

GitGuardian. GitGuardian is a tool that scans repositories for hardcoded secrets like API keys and credentials, helping prevent credential leakage.

Answer

tfsec

Answer

Checkov

Answer

Snyk

Question 2

Which cloud-specific vulnerability involves an attacker making a server-side request to the cloud metadata endpoint (e.g., 169.254.169.254) to retrieve temporary credentials?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) attacks can target cloud metadata endpoints to obtain IAM credentials.

Answer

Cross-Site Scripting (XSS)

Answer

Broken Object Level Authorization (BOLA)

Answer

SQL Injection

Question 3

An organization is implementing a DevSecOps pipeline for cloud-native applications. Which security testing method should be integrated early in the CI/CD pipeline to analyze source code for vulnerabilities without executing the application?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) scans source code early in the SDLC, aligning with shift-left security.

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Question 4

A security engineer is reviewing a Terraform configuration and wants to prevent deployment of an S3 bucket with public read access. Which IaC scanning tool is best suited for this task?

Accepted Answer

Checkov. Checkov is a popular tool for scanning Infrastructure as Code (e.g., Terraform) for misconfigurations before deployment.

Answer

GitGuardian

Answer

Snyk

Answer

Dependabot

Question 5

Which OWASP Top 10 vulnerability is most directly related to cloud API security when an attacker can modify parameters to access another user's data?

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization (BOLA) occurs when an API does not properly enforce user permissions on object access.

Answer

Security Misconfiguration

Answer

Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 6

A cloud application uses an IAM role with a policy that allows 's3:*' on all buckets. This is an example of which cloud security issue?

Accepted Answer

Over-permissive IAM. Over-permissive IAM roles with wildcard permissions grant excessive privileges, violating least privilege.

Answer

Exposed S3 bucket

Answer

Insecure API endpoint

Answer

Hardcoded credentials

Question 7

Which practice is essential for securing cloud application secrets such as database passwords and API tokens?

Accepted Answer

Use a secrets management service like Vault or cloud secret manager. Using a dedicated secrets manager like AWS Secrets Manager or HashiCorp Vault prevents hardcoding secrets in code.

Answer

Store secrets in environment variables in the source code

Answer

Encrypt secrets with a hardcoded key

Answer

Share secrets via encrypted email

Question 8

A security team wants to detect container image vulnerabilities before they are pushed to a registry. Which stage of the CI pipeline should container image scanning occur?

Accepted Answer

After build and before push to registry. Scanning container images after build but before push ensures vulnerabilities are caught early and not deployed.

Answer

During runtime in production

Answer

After deployment to production

Answer

After push to registry and before deployment

Question 9

An attacker publishes a malicious package to a public registry using the same name as an internal package used by a cloud application. This is known as:

Accepted Answer

Dependency confusion attack. Dependency confusion attacks exploit package managers that prioritize public registries over private ones, allowing malicious packages to be installed.

Answer

Cross-site scripting (XSS)

Answer

Man-in-the-middle attack

Answer

Supply chain poisoning

Question 10

What is a Software Bill of Materials (SBOM) primarily used for?

Accepted Answer

Documenting all open-source and third-party components in an application. An SBOM lists all components and dependencies in a software product, aiding in vulnerability management and supply chain security.

Answer

Tracking user access to cloud resources

Answer

Recording incident response procedures

Answer

Listing security controls implemented in the cloud environment