CCSP Cloud Application Security Practice Test 5 — 15 Questions

Question 1

Which security testing approach is most effective at identifying vulnerabilities early in the cloud software development lifecycle (SDLC) by analyzing source code without executing the application?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) is the correct approach because it analyzes source code, bytecode, or binary code without executing the application, making it ideal for identifying vulnerabilities early in the SDLC (shift-left). Unlike dynamic or runtime tools, SAST scans the codebase statically, catching issues like SQL injection, buffer overflows, and insecure cryptographic implementations before compilation or deployment.

Answer

Interactive Application Security Testing (IAST)

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Question 2

A cloud-native application stores sensitive user files in an Amazon S3 bucket. Which misconfiguration poses the greatest risk of data exposure?

Accepted Answer

Bucket ACL set to public read. Setting the S3 bucket ACL to public read allows anyone on the internet to access files, leading to data exposure.

Answer

Bucket versioning enabled

Answer

Default encryption enabled

Answer

Bucket policy with a condition for source IP

Question 3

A developer accidentally hardcodes AWS access keys in a public GitHub repository. Which tool is specifically designed to detect such secrets in code repositories?

Accepted Answer

GitGuardian. GitGuardian is a purpose-built tool for detecting secrets (e.g., AWS access keys, API tokens) in code repositories, including public GitHub repos. It scans commit history and uses pattern matching to identify hardcoded credentials, alerting developers in real time. This directly addresses the scenario of accidental exposure in a public repository.

Answer

Checkov

Answer

Snyk

Answer

tfsec

Question 4

In a DevSecOps pipeline for a cloud application, which practice best ensures that only approved open-source components are used?

Accepted Answer

Using a private artifact registry with allow-lists. Option C is correct because a private artifact registry with allow-lists enforces a whitelist of approved open-source components, preventing developers from pulling unvetted dependencies directly from public repositories. This ensures that only components that have passed security and compliance reviews are used in the pipeline, directly addressing the requirement for 'approved' open-source components.

Answer

Signing container images

Answer

Implementing dependency scanning with Snyk

Answer

Running SAST scans on all source code

Question 5

A cloud application allows users to upload profile pictures that are stored in Azure Blob Storage. Which vulnerability is most likely if the application does not validate the content type or size of uploaded files?

Accepted Answer

Unrestricted File Upload. Without validation, an attacker could upload a malicious file (e.g., a web shell) that could be executed on the server, leading to remote code execution.

Answer

Server-Side Request Forgery (SSRF)

Answer

Mass Assignment

Answer

Broken Object Level Authorization (BOLA)

Question 6

Which cloud-specific attack involves an application making HTTP requests to internal metadata endpoints such as 169.254.169.254 to retrieve cloud instance credentials?

Accepted Answer

Server-Side Request Forgery (SSRF). The attack described is Server-Side Request Forgery (SSRF), where an attacker exploits a vulnerable application to make HTTP requests to internal metadata endpoints like 169.254.169.254 (the link-local address for cloud instance metadata services). This allows the attacker to retrieve cloud instance credentials (e.g., AWS IAM role temporary credentials) that are normally accessible only from within the instance, leading to privilege escalation and lateral movement.

Answer

Dependency Confusion

Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection

Question 7

A cloud security team wants to automatically block malicious requests to a web application before they reach the application servers. Which solution should they implement?

Accepted Answer

Cloud Web Application Firewall (WAF). A Cloud Web Application Firewall (WAF) is the correct solution because it operates at the application layer (Layer 7) to inspect HTTP/HTTPS traffic and block malicious requests—such as SQL injection, cross-site scripting (XSS), and OWASP Top 10 attacks—before they reach the application servers. Unlike an IDS, a WAF can actively block traffic in real time, and it is deployed at the network edge or cloud gateway, providing inline prevention without requiring changes to the application code.

Answer

Intrusion Detection System (IDS)

Answer

Runtime Application Self-Protection (RASP)

Answer

Static Application Security Testing (SAST)

Question 8

A company uses Terraform to manage cloud infrastructure. Which infrastructure-as-code (IaC) security scanner can detect misconfigurations such as overly permissive security group rules before deployment?

Accepted Answer

Checkov. Checkov is an open-source static analysis tool specifically designed to scan Infrastructure as Code (IaC) templates, including Terraform, for security misconfigurations such as overly permissive security group rules (e.g., 0.0.0.0/0 ingress on port 22). It uses a policy-as-code framework with hundreds of built-in checks (e.g., CKV_AWS_24 for unrestricted SSH) and can be integrated into CI/CD pipelines to catch issues before deployment, making it the correct choice for pre-deployment IaC scanning.

Answer

Snyk

Answer

Dependabot

Answer

GitGuardian

Question 9

An API endpoint returns user profile details including email, phone, and address. The response includes fields that are not needed for the client application. Which OWASP API Security risk does this represent?

Accepted Answer

Excessive Data Exposure. Excessive data exposure occurs when an API returns more data than necessary, increasing the risk of sensitive information leakage.

Answer

Mass Assignment

Answer

Broken Object Level Authorization

Answer

Lack of Rate Limiting

Question 10

Which of the following is a best practice for managing secrets in a cloud-native application?

Accepted Answer

Using a cloud secrets manager to retrieve secrets at runtime. Using a cloud secrets manager (e.g., AWS Secrets Manager) allows applications to retrieve secrets dynamically, avoiding hardcoded credentials.

Answer

Encrypting secrets and storing them in a configuration file

Answer

Storing secrets in environment variables inside container images

Answer

Hardcoding secrets in the application source code

Question 11

A container image is built and scanned in a CI pipeline. Which practice should be implemented to ensure that the image has not been tampered with before deployment?

Accepted Answer

Signing the image with a private key and verifying the signature. Signing container images provides cryptographic verification of image integrity, ensuring they have not been altered since signing.

Answer

Using a minimal base image

Answer

Scanning the image with a vulnerability scanner

Answer

Storing the image in a private registry

Question 12

An attacker publishes a malicious package to a public registry using the same name as an internal package used by a cloud application. This attack is known as:

Accepted Answer

Dependency confusion. Dependency confusion occurs when an attacker publishes a malicious package to a public registry (e.g., npm, PyPI, Maven Central) using the same name as an internal, private package. When a cloud application's build system is configured to fetch dependencies from both public and private registries, the package manager may prioritize the public registry (often due to higher version numbers or default resolution order), causing the malicious package to be installed instead of the legitimate internal one. This exploits the trust in package resolution algorithms and is a specific form of supply chain attack targeting cloud-native CI/CD pipelines.

Answer

Supply chain poisoning

Answer

Man-in-the-middle attack

Answer

Typosquatting

Question 13

A cloud application is deployed on Kubernetes and uses an IAM role for service accounts. Which TWO practices should be implemented to ensure least privilege?

Accepted Answer

Grant only the specific permissions required for the application. Least privilege for IAM roles means granting only necessary permissions and using specific resource ARNs to limit scope.

Answer

Hardcode the role's access key in the application code

Answer

Grant the role the 'iam:*' wildcard permission

Answer

Use a single role for all services in the cluster

Question 14

A DevSecOps team is implementing security scanning in the CI/CD pipeline for a cloud application. Which THREE tools or practices should be included to shift security left?

Accepted Answer

Infrastructure-as-Code (IaC) security scanning. Shift-left security involves integrating security early. SAST scans source code, IaC scanning detects misconfigurations before deployment, and dependency scanning identifies vulnerable libraries.

Answer

Web Application Firewall (WAF) deployment

Answer

Runtime Application Self-Protection (RASP)

Question 15

A cloud application exposes an API that allows users to view their own orders. Which TWO vulnerabilities could allow an attacker to view another user's orders?

Accepted Answer

Insecure Direct Object Reference (IDOR). Broken Object Level Authorization (BOLA) occurs when the API does not verify that the user owns the object, and IDOR (Insecure Direct Object Reference) allows access by manipulating object IDs.

Answer

Excessive Data Exposure

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)