CCSP Cloud Application Security — Timed 15 Questions

Question 1

During a code review, a developer discovers hardcoded AWS access keys in a configuration file that was committed to the repository. Which tool is specifically designed to detect such secrets in code repositories?

Accepted Answer

GitGuardian. GitGuardian is a tool that scans repositories for hardcoded secrets like API keys and credentials, helping prevent credential leakage.

Answer

tfsec

Answer

Checkov

Answer

Snyk

Question 2

Which cloud-specific vulnerability involves an attacker making a server-side request to the cloud metadata endpoint (e.g., 169.254.169.254) to retrieve temporary credentials?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) attacks can target cloud metadata endpoints to obtain IAM credentials.

Answer

Cross-Site Scripting (XSS)

Answer

Broken Object Level Authorization (BOLA)

Answer

SQL Injection

Question 3

An organization is implementing a DevSecOps pipeline for cloud-native applications. Which security testing method should be integrated early in the CI/CD pipeline to analyze source code for vulnerabilities without executing the application?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) scans source code early in the SDLC, aligning with shift-left security.

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Question 4

A security engineer is reviewing a Terraform configuration and wants to prevent deployment of an S3 bucket with public read access. Which IaC scanning tool is best suited for this task?

Accepted Answer

Checkov. Checkov is a popular tool for scanning Infrastructure as Code (e.g., Terraform) for misconfigurations before deployment.

Answer

GitGuardian

Answer

Snyk

Answer

Dependabot

Question 5

Which OWASP Top 10 vulnerability is most directly related to cloud API security when an attacker can modify parameters to access another user's data?

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization (BOLA) occurs when an API does not properly enforce user permissions on object access.

Answer

Security Misconfiguration

Answer

Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 6

A cloud application uses an IAM role with a policy that allows 's3:*' on all buckets. This is an example of which cloud security issue?

Accepted Answer

Over-permissive IAM. Over-permissive IAM roles with wildcard permissions grant excessive privileges, violating least privilege.

Answer

Exposed S3 bucket

Answer

Insecure API endpoint

Answer

Hardcoded credentials

Question 7

Which practice is essential for securing cloud application secrets such as database passwords and API tokens?

Accepted Answer

Use a secrets management service like Vault or cloud secret manager. Using a dedicated secrets manager like AWS Secrets Manager or HashiCorp Vault prevents hardcoding secrets in code.

Answer

Store secrets in environment variables in the source code

Answer

Encrypt secrets with a hardcoded key

Answer

Share secrets via encrypted email

Question 8

A security team wants to detect container image vulnerabilities before they are pushed to a registry. Which stage of the CI pipeline should container image scanning occur?

Accepted Answer

After build and before push to registry. Scanning container images after build but before push ensures vulnerabilities are caught early and not deployed.

Answer

During runtime in production

Answer

After deployment to production

Answer

After push to registry and before deployment

Question 9

An attacker publishes a malicious package to a public registry using the same name as an internal package used by a cloud application. This is known as:

Accepted Answer

Dependency confusion attack. Dependency confusion attacks exploit package managers that prioritize public registries over private ones, allowing malicious packages to be installed.

Answer

Cross-site scripting (XSS)

Answer

Man-in-the-middle attack

Answer

Supply chain poisoning

Question 10

What is a Software Bill of Materials (SBOM) primarily used for?

Accepted Answer

Documenting all open-source and third-party components in an application. An SBOM lists all components and dependencies in a software product, aiding in vulnerability management and supply chain security.

Answer

Tracking user access to cloud resources

Answer

Recording incident response procedures

Answer

Listing security controls implemented in the cloud environment

Question 11

An API endpoint returns user profile data including fields like 'credit_card_number' even when the client application does not need it. Which OWASP API security risk does this represent?

Accepted Answer

Excessive Data Exposure. Option D is correct because the API returns sensitive data (credit_card_number) that the client application does not need, violating the principle of least data exposure. This is a classic Excessive Data Exposure risk (OWASP API Security Top 10 #3), where the server trusts the client to filter the response rather than limiting the fields returned based on the client's actual authorization or need.

Answer

Injection

Answer

Broken Object Level Authorization

Answer

Mass Assignment

Question 12

A security engineer is reviewing an S3 bucket policy that grants 's3:GetObject' access to 'Principal: *' and 'Condition: {IpAddress: {aws:SourceIp: ["1.2.3.4/32"]}}'. Despite the IP restriction, why is this policy still considered risky?

Accepted Answer

The bucket is still exposed to anyone who can spoof that IP. The policy grants public access to a specific IP, but if that IP is compromised or the condition is misconfigured, it can lead to data exposure; additionally, the bucket policy may override other controls.

Answer

The policy uses 'GetObject' instead of 'ListBucket'

Answer

The IP address is not properly masked

Answer

The condition uses 'aws:SourceIp' which is deprecated

Question 13

A cloud security team is implementing a DevSecOps pipeline. Which TWO of the following are examples of shift-left security practices? (Select two.)

Accepted Answer

Scanning Infrastructure as Code with Checkov before deployment. Shift-left integrates security early in the SDLC. IaC scanning and SAST are performed before deployment, while DAST and RASP are later stages, and threat modeling is also early but not listed as a tool.

Answer

Conducting penetration testing after deployment

Answer

Performing Dynamic Application Security Testing (DAST) on a running application

Answer

Implementing Runtime Application Self-Protection (RASP) in production

Question 14

Which TWO of the following are effective measures to prevent dependency confusion attacks? (Select two.)

Accepted Answer

Using a private artifact registry with scoped package names. Using private registries with scoped packages and verifying package names help ensure only intended packages are used. Dependency pinning alone does not prevent confusion if the package is maliciously published with the same name.

Answer

Using a software composition analysis (SCA) tool only after deployment

Answer

Pinning dependency versions in the package manager

Answer

Regularly updating all dependencies to the latest version

Question 15

Which THREE of the following are recommended practices for securing cloud application APIs? (Select three.)

Accepted Answer

Validate and sanitize all user inputs. Rate limiting, input validation, and least privilege are key API security practices. Mass assignment is a vulnerability to avoid, not a practice, and exposing all endpoints is contrary to security.

Answer

Expose all API endpoints automatically for transparency

Answer

Allow mass assignment for ease of development