CCSP Cloud Application Security — 20 Questions

Question 1

During a code review, a developer discovers hardcoded AWS access keys in a configuration file that was committed to the repository. Which tool is specifically designed to detect such secrets in code repositories?

Accepted Answer

GitGuardian. GitGuardian is a tool that scans repositories for hardcoded secrets like API keys and credentials, helping prevent credential leakage.

Answer

tfsec

Answer

Checkov

Answer

Snyk

Question 2

Which cloud-specific vulnerability involves an attacker making a server-side request to the cloud metadata endpoint (e.g., 169.254.169.254) to retrieve temporary credentials?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) attacks can target cloud metadata endpoints to obtain IAM credentials.

Answer

Cross-Site Scripting (XSS)

Answer

Broken Object Level Authorization (BOLA)

Answer

SQL Injection

Question 3

An organization is implementing a DevSecOps pipeline for cloud-native applications. Which security testing method should be integrated early in the CI/CD pipeline to analyze source code for vulnerabilities without executing the application?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) scans source code early in the SDLC, aligning with shift-left security.

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Question 4

A security engineer is reviewing a Terraform configuration and wants to prevent deployment of an S3 bucket with public read access. Which IaC scanning tool is best suited for this task?

Accepted Answer

Checkov. Checkov is a popular tool for scanning Infrastructure as Code (e.g., Terraform) for misconfigurations before deployment.

Answer

GitGuardian

Answer

Snyk

Answer

Dependabot

Question 5

Which OWASP Top 10 vulnerability is most directly related to cloud API security when an attacker can modify parameters to access another user's data?

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization (BOLA) occurs when an API does not properly enforce user permissions on object access.

Answer

Security Misconfiguration

Answer

Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 6

A cloud application uses an IAM role with a policy that allows 's3:*' on all buckets. This is an example of which cloud security issue?

Accepted Answer

Over-permissive IAM. Over-permissive IAM roles with wildcard permissions grant excessive privileges, violating least privilege.

Answer

Exposed S3 bucket

Answer

Insecure API endpoint

Answer

Hardcoded credentials

Question 7

Which practice is essential for securing cloud application secrets such as database passwords and API tokens?

Accepted Answer

Use a secrets management service like Vault or cloud secret manager. Using a dedicated secrets manager like AWS Secrets Manager or HashiCorp Vault prevents hardcoding secrets in code.

Answer

Store secrets in environment variables in the source code

Answer

Encrypt secrets with a hardcoded key

Answer

Share secrets via encrypted email

Question 8

A security team wants to detect container image vulnerabilities before they are pushed to a registry. Which stage of the CI pipeline should container image scanning occur?

Accepted Answer

After build and before push to registry. Scanning container images after build but before push ensures vulnerabilities are caught early and not deployed.

Answer

During runtime in production

Answer

After deployment to production

Answer

After push to registry and before deployment

Question 9

An attacker publishes a malicious package to a public registry using the same name as an internal package used by a cloud application. This is known as:

Accepted Answer

Dependency confusion attack. Dependency confusion attacks exploit package managers that prioritize public registries over private ones, allowing malicious packages to be installed.

Answer

Cross-site scripting (XSS)

Answer

Man-in-the-middle attack

Answer

Supply chain poisoning

Question 10

What is a Software Bill of Materials (SBOM) primarily used for?

Accepted Answer

Documenting all open-source and third-party components in an application. An SBOM lists all components and dependencies in a software product, aiding in vulnerability management and supply chain security.

Answer

Tracking user access to cloud resources

Answer

Recording incident response procedures

Answer

Listing security controls implemented in the cloud environment

Question 11

An API endpoint returns user profile data including fields like 'credit_card_number' even when the client application does not need it. Which OWASP API security risk does this represent?

Accepted Answer

Excessive Data Exposure. Option D is correct because the API returns sensitive data (credit_card_number) that the client application does not need, violating the principle of least data exposure. This is a classic Excessive Data Exposure risk (OWASP API Security Top 10 #3), where the server trusts the client to filter the response rather than limiting the fields returned based on the client's actual authorization or need.

Answer

Injection

Answer

Broken Object Level Authorization

Answer

Mass Assignment

Question 12

A security engineer is reviewing an S3 bucket policy that grants 's3:GetObject' access to 'Principal: *' and 'Condition: {IpAddress: {aws:SourceIp: ["1.2.3.4/32"]}}'. Despite the IP restriction, why is this policy still considered risky?

Accepted Answer

The bucket is still exposed to anyone who can spoof that IP. The policy grants public access to a specific IP, but if that IP is compromised or the condition is misconfigured, it can lead to data exposure; additionally, the bucket policy may override other controls.

Answer

The policy uses 'GetObject' instead of 'ListBucket'

Answer

The IP address is not properly masked

Answer

The condition uses 'aws:SourceIp' which is deprecated

Question 13

A cloud security team is implementing a DevSecOps pipeline. Which TWO of the following are examples of shift-left security practices? (Select two.)

Accepted Answer

Scanning Infrastructure as Code with Checkov before deployment. Shift-left integrates security early in the SDLC. IaC scanning and SAST are performed before deployment, while DAST and RASP are later stages, and threat modeling is also early but not listed as a tool.

Answer

Conducting penetration testing after deployment

Answer

Performing Dynamic Application Security Testing (DAST) on a running application

Answer

Implementing Runtime Application Self-Protection (RASP) in production

Question 14

Which TWO of the following are effective measures to prevent dependency confusion attacks? (Select two.)

Accepted Answer

Using a private artifact registry with scoped package names. Using private registries with scoped packages and verifying package names help ensure only intended packages are used. Dependency pinning alone does not prevent confusion if the package is maliciously published with the same name.

Answer

Using a software composition analysis (SCA) tool only after deployment

Answer

Pinning dependency versions in the package manager

Answer

Regularly updating all dependencies to the latest version

Question 15

Which THREE of the following are recommended practices for securing cloud application APIs? (Select three.)

Accepted Answer

Validate and sanitize all user inputs. Rate limiting, input validation, and least privilege are key API security practices. Mass assignment is a vulnerability to avoid, not a practice, and exposing all endpoints is contrary to security.

Answer

Expose all API endpoints automatically for transparency

Answer

Allow mass assignment for ease of development

Question 16

A cloud security team wants to integrate security testing early in the development lifecycle to reduce vulnerabilities. Which approach best describes this concept?

Accepted Answer

Shift-left security. Shift-left security is the practice of integrating security testing and controls early in the software development lifecycle (SDLC), such as during design and coding phases, rather than waiting until deployment. This proactive approach reduces vulnerabilities by catching flaws when they are cheaper and easier to fix, aligning with DevSecOps principles.

Answer

Runtime application self-protection (RASP)

Answer

Software bill of materials (SBOM)

Answer

Web application firewall (WAF)

Question 17

A cloud-native application is deployed on AWS. During a security review, the team discovers that if an attacker can send a crafted request to the application, the application will make an HTTP request to http://169.254.169.254/latest/meta-data/iam/security-credentials/. Which vulnerability is being exploited?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) targeting the cloud metadata endpoint can expose IAM credentials. The IP 169.254.169.254 is the link-local address for cloud metadata services.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Insecure deserialization

Question 18

A DevOps team is implementing a CI/CD pipeline for a cloud application. They want to automatically scan source code for security vulnerabilities before building the application. Which type of scanning should they integrate?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) analyzes source code or binaries for security vulnerabilities without executing the application, making it suitable for early integration in CI/CD.

Answer

Interactive Application Security Testing (IAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Runtime Application Self-Protection (RASP)

Question 19

During a security audit of a Kubernetes deployment, a team finds that containers are allowed to run as root with full privilege escalation. Which IaC scanning tool would have detected this misconfiguration before deployment?

Accepted Answer

KICS. KICS (Keeping Infrastructure as Code Secure) is a tool that scans IaC files for security misconfigurations, including Kubernetes manifests. It can detect containers running as root with privilege escalation.

Answer

Snyk

Answer

Checkov

Answer

Dependabot

Question 20

Which practice helps prevent hardcoded cloud credentials from being committed to source code repositories?

Accepted Answer

Implementing secrets management with a vault service. Using secrets management tools like AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault to dynamically retrieve credentials at runtime avoids hardcoding them in code.

Answer

Using environment variables for all configuration

Answer

Storing credentials in a configuration file with restricted permissions

Answer

Using a .gitignore file to exclude credential files