CCSP Cloud Application Security — 20 Questions

Question 1

Refer to the exhibit. A security administrator is reviewing an S3 bucket policy. What is the primary security concern with this policy?

Accepted Answer

The policy allows delete access from a trusted IP range without additional controls. The policy grants s3:DeleteObject permission to a trusted IP range without requiring additional controls like MFA or versioning. This means an attacker who compromises a machine within that IP range can permanently delete objects without secondary authentication, leading to potential data loss. While MFA enforcement is a valid control, the primary concern is the policy's complete lack of safeguards for delete operations from that IP range. Option D is not the primary concern because the policy could address multiple deficiencies; the critical flaw is the absence of any secondary authorization, not solely MFA.

Answer

The policy does not enforce server-side encryption

Answer

The bucket is publicly accessible from any IP

Answer

The policy does not require MFA for delete operations

Question 2

A developer is writing code that will be deployed as a serverless function. The function needs to read data from a cloud storage bucket. According to the principle of least privilege, how should the developer grant access?

Accepted Answer

Create a role with a read policy for the bucket and assign it to the function. Serverless functions should assume a role that grants only the specific permissions needed—in this case, a read policy for the bucket. This follows the principle of least privilege by avoiding hardcoded credentials and instead using temporary, automatically rotated credentials provided by the cloud provider's security token service via the role. The role is attached to the function at deployment, ensuring the function can securely access the bucket without exposing long-term access keys.

Answer

Store the cloud provider access key and secret key in environment variables in the function

Answer

Use the root user credentials of the cloud account

Answer

Set the bucket policy to allow public read access

Question 3

A cloud security engineer is configuring a cloud function that processes messages from a message queue service. The function needs to write results to a NoSQL database. Which of the following is the SECUREST way to manage the function's credentials?

Accepted Answer

Attach a service-linked role to the function with fine-grained permissions for the queue and database [CORRECT]. Cloud functions support service-linked roles that provide temporary, automatically rotated credentials via the cloud provider's security token service. By attaching a service-linked role with fine-grained permissions for the queue (e.g., ReceiveMessage) and the database (e.g., PutItem), the function never needs to manage long-lived secrets, eliminating the risk of credential leakage or rotation failures.

Answer

Use a secrets manager to store credentials and retrieve them at runtime [wrong]

Answer

Store the database credentials as ciphertext in the function's environment variables [wrong]

Answer

Create a service account with access keys and pass them to the function via encrypted environment variables [wrong]

Question 4

A developer receives the above error when trying to create a route in an API Gateway. Which action should the developer take to resolve the issue?

Accepted Answer

Delete the existing route or use a different route key. The most likely cause of such an error in API Gateway is a duplicate route key. API Gateway enforces unique route keys within an API; attempting to create a duplicate route key (e.g., the same HTTP method and path combination) will fail. Deleting the existing route or using a different route key resolves the conflict by ensuring each route key is unique.

Answer

Change the endpoint type to private

Answer

Add an authentication mechanism to the API

Answer

Verify that the API is deployed to the correct stage

Question 5

A security analyst is reviewing cloud audit logs and sees the above event. The analyst suspects that the machine image used may be outdated and vulnerable. Which action should the analyst take to verify the security posture of the launched instance?

Accepted Answer

Look up the machine image in the cloud console and review its description and security bulletins. The image ID in the audit log can be used to look up the machine image in the cloud provider's compute console, where its description, release notes, and associated security bulletins are available. This allows the analyst to determine if the image is outdated or has known vulnerabilities, directly addressing the suspicion about the image's security posture.

Answer

Verify that the instance is not assigned a public IP address

Answer

Check the security groups associated with the instance

Answer

Check the image ID for known vulnerabilities using the cloud provider's patch management service

Question 6

A company is migrating a legacy application to the cloud. The application uses hardcoded database credentials. Which secure development practice should be implemented to address this?

Accepted Answer

Use a secrets management service. Hardcoded database credentials in application code create a severe security risk because they are exposed in version control, logs, and static analysis. Using a secrets management service (e.g., AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) allows credentials to be stored securely, rotated automatically, and accessed at runtime via API calls, eliminating the need to embed secrets in code. This aligns with the principle of least privilege and secure credential management in cloud application security.

Answer

Use code signing for all deployments

Answer

Implement input validation on all user inputs

Answer

Enable encryption at rest for the database

Question 7

A security architect is designing a CI/CD pipeline for a cloud-native application. The team wants to automatically scan container images for vulnerabilities before deployment. Which of the following is the most effective approach?

Accepted Answer

Integrate a container image scanner into the pipeline. Integrating a container image scanner into the CI/CD pipeline ensures that vulnerabilities are detected early, before the image is deployed to production. This approach automates security checks as part of the build process, aligning with DevSecOps principles by shifting security left. Tools like Trivy, Clair, or Anchore can be configured to fail the pipeline if critical vulnerabilities are found, preventing insecure images from reaching runtime.

Answer

Manually review images before each deployment

Answer

Perform vulnerability scanning at runtime using a host-based agent

Answer

Scan the network for open ports on the container hosts

Question 8

A SaaS provider uses a customer-managed encryption key (CMEK) model for data-at-rest. The provider's application runs in a multi-tenant cloud environment. Which attack surface is MOST directly mitigated by this approach?

Accepted Answer

Insider threats from cloud provider employees. A customer-managed encryption key (CMEK) model gives the customer control over the key used to encrypt data at rest. This directly mitigates the risk of a cloud provider employee accessing the plaintext data, because even if the employee has administrative access to the storage infrastructure, they cannot decrypt the data without the customer's key. The provider holds the encrypted data, but the decryption key is managed and controlled by the customer, creating a logical separation that protects against insider threats from the provider's personnel.

Answer

Misconfigured storage buckets exposing data

Answer

SQL injection vulnerabilities in the application

Answer

Side-channel attacks on shared physical hardware

Question 9

An organization is developing a mobile app that communicates with a cloud API. To ensure secure authentication, which of the following should be used?

Accepted Answer

OAuth 2.0 with OpenID Connect. OAuth 2.0 with OpenID Connect (OIDC) is the correct choice because it provides a delegated authorization framework (OAuth 2.0) combined with an identity layer (OIDC) that enables secure authentication and single sign-on (SSO) for mobile apps communicating with cloud APIs. This combination issues short-lived access tokens and ID tokens (typically JWTs) rather than exposing long-lived credentials, and supports token refresh, scoped permissions, and PKCE (Proof Key for Code Exchange) to prevent authorization code interception on mobile devices.

Answer

Session cookies for state management

Answer

Basic authentication with username and password

Answer

API keys sent in HTTP headers

Question 10

A cloud security team is implementing a Web Application Firewall (WAF) for a public-facing web application. The application uses a REST API with JSON payloads. Which of the following is the WAF's primary benefit?

Accepted Answer

Inspecting HTTP traffic for malicious payloads. A WAF operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic for malicious payloads such as SQL injection, cross-site scripting (XSS), and JSON-based attacks. For a REST API using JSON, the WAF can parse and validate the JSON structure, blocking malformed or malicious payloads before they reach the application server. This is the primary benefit because it directly protects the application logic from web-based exploits.

Answer

Scanning for data loss prevention (DLP) violations

Answer

Preventing network-layer DDoS attacks

Answer

Encrypting data in transit between client and server

Question 11

A company deploys microservices in Kubernetes. Each service communicates via gRPC with mutual TLS. A security assessment reveals that some services use self-signed certificates. What is the primary risk?

Accepted Answer

Man-in-the-middle (MITM) attacks between services. The primary risk of using self-signed certificates in a gRPC mutual TLS environment is that there is no trusted Certificate Authority (CA) to verify the identity of the communicating services. Without proper CA-signed certificates, an attacker can easily perform a man-in-the-middle (MITM) attack by presenting a forged self-signed certificate, intercepting and modifying gRPC traffic between microservices.

Answer

Inability to revoke certificates

Answer

Exposure of private keys in the container image

Answer

Increased latency due to certificate validation

Question 12

A developer is tasked with securely storing a session token in a browser-based web application. Which storage mechanism is most secure?

Accepted Answer

HTTP-only cookies with Secure and SameSite flags. HTTP-only cookies with Secure and SameSite flags are the most secure storage mechanism for session tokens because they prevent client-side script access (mitigating XSS-based token theft), ensure transmission only over HTTPS (mitigating network eavesdropping), and restrict cross-origin request inclusion (mitigating CSRF). This combination aligns with OWASP best practices for session management, as the token is never exposed to JavaScript or sent over unencrypted channels.

Answer

sessionStorage

Answer

URL query parameters

Answer

localStorage

Question 13

A cloud application uses a third-party identity provider (IdP) for SSO. The security team notices that tokens are being reused across different applications. Which token binding mechanism should be implemented?

Accepted Answer

Token binding to TLS session. Token binding cryptographically ties an access token to a specific TLS session, preventing token export and replay across different applications. This directly addresses the reuse of tokens across applications by binding the token to the TLS layer, so even if an attacker intercepts the token, it cannot be used with a different TLS connection. RFC 8471 defines token binding for OAuth 2.0, ensuring the token is only valid when presented over the same TLS channel that was established during issuance.

Answer

Use of bearer tokens without additional protection

Answer

Short token expiration times

Answer

Audience restriction

Question 14

A company is implementing a serverless application using AWS Lambda. The function processes S3 events and writes to a DynamoDB table. Which of the following is the MOST secure way to grant the necessary permissions?

Accepted Answer

Create a custom IAM role with only the required actions on specific resources. AWS Lambda functions require an IAM role (execution role) to access other AWS services. By creating a custom IAM role with only the required actions (e.g., s3:GetObject for the specific S3 bucket and dynamodb:PutItem for the specific DynamoDB table), you adhere to the principle of least privilege, minimizing the attack surface and ensuring secure, auditable access.

Answer

Use resource-based policies on the Lambda function

Answer

Attach a managed policy that grants full access to S3 and DynamoDB

Answer

Use the root user credentials of the AWS account

Question 15

Which TWO of the following are common best practices for securing cloud application APIs? (Choose two.)

Accepted Answer

Implement rate limiting. Rate limiting is a critical best practice for securing cloud application APIs because it prevents abuse by limiting the number of requests a client can make within a specific time window. This mitigates brute-force attacks, denial-of-service (DoS) attacks, and resource exhaustion. By enforcing rate limits, the API maintains availability and protects backend services from being overwhelmed.

Answer

Disable HTTPS to reduce latency

Answer

Return detailed error messages for debugging

Answer

Allow all origins with CORS

Question 16

Which THREE of the following are essential components of a Secure Software Development Lifecycle (SSDLC) in the cloud? (Choose three.)

Accepted Answer

Static application security testing (SAST) in CI/CD. SAST tools scan source code, bytecode, or binaries for vulnerabilities like SQL injection or buffer overflows early in the development cycle. Integrating SAST into the CI/CD pipeline enables automated, continuous security checks on every commit or build, which is a core practice of a Secure Software Development Lifecycle (SSDLC) in the cloud. This shift-left approach catches flaws before they reach production, reducing remediation cost and risk.

Answer

Manual code reviews without automation

Answer

Annual penetration testing only

Question 17

Which TWO of the following are effective methods to protect against server-side request forgery (SSRF) in a cloud application? (Choose two.)

Accepted Answer

Whitelist allowed outbound destinations. Whitelisting allowed outbound destinations is a primary defense against SSRF. By explicitly permitting only trusted external hosts (e.g., specific API endpoints or internal services), the application cannot be tricked into making requests to arbitrary internal or external targets, even if an attacker controls the URL parameter.

Answer

Use SSL inspection to check for malicious payloads

Answer

Block all outbound network traffic from the application

Answer

Sanitize all user input for URL parameters

Question 18

Refer to the exhibit. A Kubernetes pod is configured as shown. Which security enhancement should be added to follow cloud security best practices?

Accepted Answer

Set readOnlyRootFilesystem to true. Setting `readOnlyRootFilesystem` to true ensures the container's root filesystem is mounted as read-only, preventing attackers from modifying binaries, libraries, or configuration files at runtime. This is a key container hardening practice that limits the blast radius of a compromise, aligning with the CIS Benchmark for Kubernetes and cloud security best practices.

Answer

Set allowPrivilegeEscalation to true

Answer

Use a more restrictive runAsUser value like 2000

Answer

Use a trusted image from a private registry

Question 19

Refer to the exhibit. A log entry shows a suspected SQL injection attack. Which security control would have prevented this attack?

Accepted Answer

Use parameterized SQL queries. SQL injection attacks exploit unsanitized user input that is concatenated into SQL queries. Parameterized queries (also known as prepared statements) separate SQL logic from data by using placeholders, ensuring that user input is always treated as data, not executable code. This prevents an attacker from injecting malicious SQL commands, regardless of the input content.

Answer

Encrypt the database connection

Answer

Implement rate limiting on the login endpoint

Answer

Enforce strong password policies

Question 20

A financial services company uses a multi-region cloud deployment for its trading application. The application consists of a web frontend, a REST API, and a relational database. Recently, a penetration test revealed that an attacker could perform a time-based blind SQL injection through the API's search functionality. The injection allows the attacker to enumerate database contents by observing response times. The development team was already aware of the issue but had prioritized other features. The security team now demands immediate remediation. The application is critical and cannot be taken offline. Which of the following is the most effective immediate action to mitigate the risk without modifying the application code?

Accepted Answer

Deploy a Web Application Firewall (WAF) with a rule to block SQL injection patterns. A WAF can inspect incoming HTTP requests and block those matching SQL injection patterns (e.g., SQL keywords, special characters) without modifying application code. Since the vulnerability is a time-based blind SQL injection, a WAF with a dedicated SQL injection rule set can immediately stop the attack vector by filtering malicious payloads at the edge, providing a virtual patch while the code fix is developed. This is the only option that directly addresses the injection vector without requiring code changes or downtime.

Answer

Implement rate limiting on the API endpoint

Answer

Enable DDoS protection on the cloud load balancer

Answer

Enable transparent data encryption (TDE) on the database