CCSP Cloud Application Security — 50 Questions

Question 1

A cloud application uses a third-party identity provider (IdP) for SSO. The security team notices that tokens are being reused across different applications. Which token binding mechanism should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Token binding to TLS session. Token binding cryptographically ties an access token to a specific TLS session, preventing token export and replay across different applications. This directly addresses the reuse of tokens across applications by binding the token to the TLS layer, so even if an attacker intercepts the token, it cannot be used with a different TLS connection. RFC 8471 defines token binding for OAuth 2.0, ensuring the token is only valid when presented over the same TLS channel that was established during issuance.

Answer

Use of bearer tokens without additional protection

Answer

Short token expiration times

Answer

Audience restriction

Question 2

Refer to the exhibit. A security administrator is reviewing an S3 bucket policy. What is the primary security concern with this policy?

Accepted Answer

The policy allows delete access from a trusted IP range without additional controls. The policy grants s3:DeleteObject permission to a trusted IP range without requiring additional controls like MFA or versioning. This means an attacker who compromises a machine within that IP range can permanently delete objects without secondary authentication, leading to potential data loss. While MFA enforcement is a valid control, the primary concern is the policy's complete lack of safeguards for delete operations from that IP range. Option D is not the primary concern because the policy could address multiple deficiencies; the critical flaw is the absence of any secondary authorization, not solely MFA.

Answer

The policy does not enforce server-side encryption

Answer

The bucket is publicly accessible from any IP

Answer

The policy does not require MFA for delete operations

Question 3

Refer to the exhibit. A Kubernetes pod is configured as shown. Which security enhancement should be added to follow cloud security best practices?

Accepted Answer

Set readOnlyRootFilesystem to true. Setting `readOnlyRootFilesystem` to true ensures the container's root filesystem is mounted as read-only, preventing attackers from modifying binaries, libraries, or configuration files at runtime. This is a key container hardening practice that limits the blast radius of a compromise, aligning with the CIS Benchmark for Kubernetes and cloud security best practices.

Answer

Set allowPrivilegeEscalation to true

Answer

Use a more restrictive runAsUser value like 2000

Answer

Use a trusted image from a private registry

Question 4

A cloud application developer is using a containerized application with Docker. The security team requires that the application runs with the least privilege possible. Which of the following is the BEST practice to ensure the container does not run as root?

Accepted Answer

Include a USER directive in the Dockerfile to specify a non-root user.. The USER directive in a Dockerfile sets the user for any subsequent RUN, CMD, or ENTRYPOINT instructions, ensuring the container process runs as a non-root user by default. This is the most direct and persistent method to enforce least privilege at build time, as it becomes part of the image itself and applies regardless of runtime flags.

Answer

Use the --no-root flag when starting the container.

Answer

Set the securityContext.runAsNonRoot parameter in the container manifest.

Answer

Use the --cap-drop=ALL option when running the container.

Question 5

Which THREE of the following are essential components of a Secure Software Development Lifecycle (SSDLC) for cloud applications?

Accepted Answer

Security regression testing to validate that new code does not reintroduce vulnerabilities.. Option C is correct because security regression testing ensures that previously fixed vulnerabilities are not reintroduced by new code changes, which is essential in an SSDLC where iterative development and continuous integration can otherwise silently undo security fixes. Option D is correct because SAST integrated into the CI/CD pipeline analyzes source code or bytecode early in development, catching flaws such as injection patterns, insecure deserialization, or hardcoded secrets before they reach production. Option E is correct because DAST against staging environments tests the running application from the outside, detecting runtime and configuration issues like authentication flaws, misconfigured headers, or injection vulnerabilities that static analysis cannot see. Option A is not essential because manual penetration testing after every code commit is impractical and not a standard SSDLC requirement; penetration testing is typically periodic or milestone-based, while automated testing handles per-commit checks. Option B, while valuable, is not one of the three essential technical components tested here; security awareness training supports the SSDLC but is not the specific pipeline-integrated control the question targets.

Answer

Manual penetration testing after every code commit.

Answer

Security awareness training for all developers.

Question 6

You are a cloud security engineer for a financial services company. The company has developed a cloud-native application that processes credit card transactions and stores sensitive financial data. The application is deployed on a Kubernetes cluster in a public cloud provider. The compliance team requires that all data at rest be encrypted using a customer-managed key (CMK) with automatic rotation. The application uses a managed database service (e.g., Amazon RDS) and object storage (e.g., Amazon S3) for storing transaction logs. The current configuration uses cloud-provider-managed keys for both services. The development team is concerned that enabling CMK with automatic rotation might cause application downtime due to key rotation latency. Additionally, the security team wants to ensure that access to the keys is auditable. Which course of action BEST addresses the compliance requirement while minimizing risk?

Accepted Answer

Create a CMK with automatic rotation enabled, grant the database and storage service access via IAM roles, and validate the rotation process in a staging environment before production deployment.. It directly satisfies the compliance requirement for customer-managed keys (CMK) with automatic rotation, while mitigating the risk of downtime by validating the rotation process in a staging environment. Using IAM roles to grant the database and storage service access to the CMK ensures that key access is auditable via CloudTrail, meeting the security team's audit requirement. This approach allows the development team to test and confirm that key rotation latency does not cause application downtime before production deployment.

Answer

Continue using cloud-provider-managed keys and implement additional logging to meet audit requirements.

Answer

Use a CMK with manual rotation to have full control over the rotation schedule and avoid any potential downtime.

Answer

Implement client-side encryption with a key stored in a secure vault and disable server-side encryption.

Question 7

Refer to the exhibit. A security analyst reviews the S3 bucket policy shown. Which security issue should be flagged?

Accepted Answer

The policy allows unauthenticated write access to the bucket. The S3 bucket policy contains a Principal element set to "*" with an Effect of "Allow" on the s3:PutObject action, which grants unauthenticated write access to the bucket. This means anyone on the internet can upload objects without any authentication, leading to potential data corruption, storage cost abuse, or malware hosting. The policy does not include any condition (e.g., aws:SourceIp or aws:SecureTransport) to restrict the write operation, making it a critical security misconfiguration.

Answer

The policy restricts read access to a specific role, which is too permissive

Answer

The policy does not enable server-side encryption

Answer

The policy contains a syntax error in the JSON

Question 8

Drag and drop the steps for implementing a cloud data encryption strategy using a customer-managed key (CMK) in AWS KMS into the correct order.

Accepted Answer

Create the CMK, then enable automatic key rotation, then set IAM permissions and key policies, then configure application integration, then monitor usage and audit logs.. The correct order starts with creating the CMK, then enabling rotation, setting permissions, configuring application integration, and finally monitoring usage.

Answer

Create the CMK, then set IAM permissions and key policies, then enable automatic key rotation, then configure application integration, then monitor usage and audit logs.

Answer

Set IAM permissions and key policies, then create the CMK, then enable automatic key rotation, then configure application integration, then monitor usage and audit logs.

Answer

Create the CMK, then enable automatic key rotation, then configure application integration, then set IAM permissions and key policies, then monitor usage and audit logs.

Question 9

Match each cloud service model to its primary responsibility area according to the shared responsibility model.

Accepted Answer

SaaS: Provider manages all infrastructure, platform, and application software; customer manages data and access control.. The shared responsibility model delineates security obligations; SaaS offloads most to provider, on-premises retains all.

Answer

SaaS: Provider manages only physical security; customer manages all other aspects including applications and data.

Answer

IaaS: Provider manages operating system, applications, and data; customer manages physical servers.

Question 10

Match each compliance framework to its primary jurisdiction or industry.

Accepted Answer

GDPR: European Union. Compliance frameworks are often region- or industry-specific; cloud providers must support customer compliance.

Answer

ISO 27001: European Union

Answer

SOC 2: US healthcare

Question 11

A developer is writing code that will be deployed as a serverless function. The function needs to read data from a cloud storage bucket. According to the principle of least privilege, how should the developer grant access?

Accepted Answer

Create a role with a read policy for the bucket and assign it to the function. Serverless functions should assume a role that grants only the specific permissions needed—in this case, a read policy for the bucket. This follows the principle of least privilege by avoiding hardcoded credentials and instead using temporary, automatically rotated credentials provided by the cloud provider's security token service via the role. The role is attached to the function at deployment, ensuring the function can securely access the bucket without exposing long-term access keys.

Answer

Store the cloud provider access key and secret key in environment variables in the function

Answer

Use the root user credentials of the cloud account

Answer

Set the bucket policy to allow public read access

Question 12

A cloud security engineer is configuring a cloud function that processes messages from a message queue service. The function needs to write results to a NoSQL database. Which of the following is the SECUREST way to manage the function's credentials?

Accepted Answer

Attach a service-linked role to the function with fine-grained permissions for the queue and database. Cloud functions support service-linked roles that provide temporary, automatically rotated credentials via the cloud provider's security token service. By attaching a service-linked role with fine-grained permissions for the queue (e.g., ReceiveMessage) and the database (e.g., PutItem), the function never needs to manage long-lived secrets, eliminating the risk of credential leakage or rotation failures.

Answer

Use a secrets manager to store credentials and retrieve them at runtime

Answer

Store the database credentials as ciphertext in the function's environment variables

Answer

Create a service account with access keys and pass them to the function via encrypted environment variables

Question 13

A developer is implementing a cloud application that stores sensitive user data. To minimize the risk of data exposure during transit, which security control should be enforced as a baseline requirement?

Accepted Answer

Enforce TLS for all data in transit. TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, providing confidentiality, integrity, and authentication. Enforcing TLS for all communications ensures that sensitive user data is protected from eavesdropping and tampering during transmission, making it a baseline requirement for cloud application security.

Answer

Implement IPsec tunnels between components

Answer

Use HTTPS without additional controls

Answer

Require SSH for all connections

Question 14

A cloud application is being designed to handle highly sensitive financial data. The security architect wants to ensure that encryption keys are managed outside the application's memory space. Which service model should they use?

Accepted Answer

Hardware Security Module (HSM). A Hardware Security Module (HSM) is a dedicated hardware appliance that manages encryption keys in a physically and logically isolated environment, entirely separate from the application's memory space. For highly sensitive financial data, an HSM provides FIPS 140-2 Level 3 or higher certification, ensuring keys never leave the device and are protected against memory-scraping attacks. This aligns with the requirement to keep key management outside the application's memory.

Answer

Cloud Hardware Security Module (CloudHSM)

Answer

Key Management Service (KMS)

Answer

Trusted Platform Module (TPM)

Question 15

During a security audit, a cloud application is found to have numerous container images with critical vulnerabilities. The DevOps team wants to prevent vulnerable images from being deployed to production. Which two controls should be implemented? (Select TWO)

Accepted Answer

Implement image vulnerability scanning in the CI/CD pipeline. Integrating image vulnerability scanning into the CI/CD pipeline ensures that every container image is automatically checked for known Common Vulnerabilities and Exposures (CVEs) before it can be promoted to production. This shift-left approach blocks vulnerable images at build time, preventing them from ever reaching the production environment. Option C is correct because enforcing signed images from a trusted registry (e.g., using Docker Content Trust or Notary) cryptographically verifies the image's integrity and origin, ensuring only authorized, non-tampered images are deployed.

Answer

Regularly update base images

Answer

Use network segmentation to isolate production containers

Answer

Run all containers as non-root users

Question 16

A cloud application processes data subject to GDPR. The security team needs to ensure that all personally identifiable information (PII) is encrypted at rest and that access is logged. Which combination of controls should be implemented? (Select THREE)

Accepted Answer

Implement strict least privilege access controls. Strict least privilege access controls ensure that only authorized users or services can access PII, minimizing the risk of unauthorized exposure. This is a fundamental security principle for GDPR compliance, as it directly supports the data minimization and access control requirements. By restricting access to only what is necessary for a role, the organization reduces the attack surface and ensures that any access is intentional and auditable.

Answer

Use TLS for all network connections

Answer

Implement a key management system

Question 17

A developer receives the above error when trying to create a route in an API Gateway. Which action should the developer take to resolve the issue?

Accepted Answer

Delete the existing route or use a different route key. The most likely cause of such an error in API Gateway is a duplicate route key. API Gateway enforces unique route keys within an API; attempting to create a duplicate route key (e.g., the same HTTP method and path combination) will fail. Deleting the existing route or using a different route key resolves the conflict by ensuring each route key is unique.

Answer

Change the endpoint type to private

Answer

Add an authentication mechanism to the API

Answer

Verify that the API is deployed to the correct stage

Question 18

A security analyst reviews the above cloud storage bucket policy. The bucket stores sensitive application data. What is the primary security issue with this policy?

Accepted Answer

The Deny statement will block all access, including from authorized IPs. The Deny statement with a condition that denies all requests not matching the specified IP range will block access from any IP address that is not in the listed range, including authorized IPs that the policy intended to allow. This creates a complete denial of service for legitimate users, making it the primary security issue.

Answer

The resource identifier should not include a wildcard

Answer

The policy should use a condition with source VPC instead of IP

Answer

The IP address range is too broad

Question 19

A security analyst is reviewing cloud audit logs and sees the above event. The analyst suspects that the machine image used may be outdated and vulnerable. Which action should the analyst take to verify the security posture of the launched instance?

Accepted Answer

Look up the machine image in the cloud console and review its description and security bulletins. The image ID in the audit log can be used to look up the machine image in the cloud provider's compute console, where its description, release notes, and associated security bulletins are available. This allows the analyst to determine if the image is outdated or has known vulnerabilities, directly addressing the suspicion about the image's security posture.

Answer

Verify that the instance is not assigned a public IP address

Answer

Check the security groups associated with the instance

Answer

Check the image ID for known vulnerabilities using the cloud provider's patch management service

Question 20

A security auditor is reviewing a cloud application's data encryption strategy. The application stores sensitive data in a cloud database. Which configuration would best ensure data confidentiality in the event of a database dump?

Accepted Answer

Column-level encryption using application-managed keys. Column-level encryption with application-managed keys ensures that even if the entire database is dumped, the sensitive columns remain encrypted and unreadable without the keys held by the application. This approach decouples key management from the cloud provider, preventing the provider from accessing the plaintext data and maintaining confidentiality during a breach or dump.

Answer

Tokenization of sensitive fields with a separate token vault

Answer

Entire database encryption at rest using cloud provider managed keys

Answer

Transport layer security for all connections