CCSP Cloud Application Security Practice Test 1 — 15 Questions

Question 1

A cloud application uses a third-party identity provider (IdP) for SSO. The security team notices that tokens are being reused across different applications. Which token binding mechanism should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Token binding to TLS session. Token binding cryptographically ties an access token to a specific TLS session, preventing token export and replay across different applications. This directly addresses the reuse of tokens across applications by binding the token to the TLS layer, so even if an attacker intercepts the token, it cannot be used with a different TLS connection. RFC 8471 defines token binding for OAuth 2.0, ensuring the token is only valid when presented over the same TLS channel that was established during issuance.

Answer

Use of bearer tokens without additional protection

Answer

Short token expiration times

Answer

Audience restriction

Question 2

Refer to the exhibit. A security administrator is reviewing an S3 bucket policy. What is the primary security concern with this policy?

Accepted Answer

The policy allows delete access from a trusted IP range without additional controls. The policy grants s3:DeleteObject permission to a trusted IP range without requiring additional controls like MFA or versioning. This means an attacker who compromises a machine within that IP range can permanently delete objects without secondary authentication, leading to potential data loss. While MFA enforcement is a valid control, the primary concern is the policy's complete lack of safeguards for delete operations from that IP range. Option D is not the primary concern because the policy could address multiple deficiencies; the critical flaw is the absence of any secondary authorization, not solely MFA.

Answer

The policy does not enforce server-side encryption

Answer

The bucket is publicly accessible from any IP

Answer

The policy does not require MFA for delete operations

Question 3

Refer to the exhibit. A Kubernetes pod is configured as shown. Which security enhancement should be added to follow cloud security best practices?

Accepted Answer

Set readOnlyRootFilesystem to true. Setting `readOnlyRootFilesystem` to true ensures the container's root filesystem is mounted as read-only, preventing attackers from modifying binaries, libraries, or configuration files at runtime. This is a key container hardening practice that limits the blast radius of a compromise, aligning with the CIS Benchmark for Kubernetes and cloud security best practices.

Answer

Set allowPrivilegeEscalation to true

Answer

Use a more restrictive runAsUser value like 2000

Answer

Use a trusted image from a private registry

Question 4

A cloud application developer is using a containerized application with Docker. The security team requires that the application runs with the least privilege possible. Which of the following is the BEST practice to ensure the container does not run as root?

Accepted Answer

Include a USER directive in the Dockerfile to specify a non-root user.. The USER directive in a Dockerfile sets the user for any subsequent RUN, CMD, or ENTRYPOINT instructions, ensuring the container process runs as a non-root user by default. This is the most direct and persistent method to enforce least privilege at build time, as it becomes part of the image itself and applies regardless of runtime flags.

Answer

Use the --no-root flag when starting the container.

Answer

Set the securityContext.runAsNonRoot parameter in the container manifest.

Answer

Use the --cap-drop=ALL option when running the container.

Question 5

Which THREE of the following are essential components of a Secure Software Development Lifecycle (SSDLC) for cloud applications?

Accepted Answer

Security regression testing to validate that new code does not reintroduce vulnerabilities.. Option C is correct because security regression testing ensures that previously fixed vulnerabilities are not reintroduced by new code changes, which is essential in an SSDLC where iterative development and continuous integration can otherwise silently undo security fixes. Option D is correct because SAST integrated into the CI/CD pipeline analyzes source code or bytecode early in development, catching flaws such as injection patterns, insecure deserialization, or hardcoded secrets before they reach production. Option E is correct because DAST against staging environments tests the running application from the outside, detecting runtime and configuration issues like authentication flaws, misconfigured headers, or injection vulnerabilities that static analysis cannot see. Option A is not essential because manual penetration testing after every code commit is impractical and not a standard SSDLC requirement; penetration testing is typically periodic or milestone-based, while automated testing handles per-commit checks. Option B, while valuable, is not one of the three essential technical components tested here; security awareness training supports the SSDLC but is not the specific pipeline-integrated control the question targets.

Answer

Manual penetration testing after every code commit.

Answer

Security awareness training for all developers.

Question 6

You are a cloud security engineer for a financial services company. The company has developed a cloud-native application that processes credit card transactions and stores sensitive financial data. The application is deployed on a Kubernetes cluster in a public cloud provider. The compliance team requires that all data at rest be encrypted using a customer-managed key (CMK) with automatic rotation. The application uses a managed database service (e.g., Amazon RDS) and object storage (e.g., Amazon S3) for storing transaction logs. The current configuration uses cloud-provider-managed keys for both services. The development team is concerned that enabling CMK with automatic rotation might cause application downtime due to key rotation latency. Additionally, the security team wants to ensure that access to the keys is auditable. Which course of action BEST addresses the compliance requirement while minimizing risk?

Accepted Answer

Create a CMK with automatic rotation enabled, grant the database and storage service access via IAM roles, and validate the rotation process in a staging environment before production deployment.. It directly satisfies the compliance requirement for customer-managed keys (CMK) with automatic rotation, while mitigating the risk of downtime by validating the rotation process in a staging environment. Using IAM roles to grant the database and storage service access to the CMK ensures that key access is auditable via CloudTrail, meeting the security team's audit requirement. This approach allows the development team to test and confirm that key rotation latency does not cause application downtime before production deployment.

Answer

Continue using cloud-provider-managed keys and implement additional logging to meet audit requirements.

Answer

Use a CMK with manual rotation to have full control over the rotation schedule and avoid any potential downtime.

Answer

Implement client-side encryption with a key stored in a secure vault and disable server-side encryption.

Question 7

Refer to the exhibit. A security analyst reviews the S3 bucket policy shown. Which security issue should be flagged?

Accepted Answer

The policy allows unauthenticated write access to the bucket. The S3 bucket policy contains a Principal element set to "*" with an Effect of "Allow" on the s3:PutObject action, which grants unauthenticated write access to the bucket. This means anyone on the internet can upload objects without any authentication, leading to potential data corruption, storage cost abuse, or malware hosting. The policy does not include any condition (e.g., aws:SourceIp or aws:SecureTransport) to restrict the write operation, making it a critical security misconfiguration.

Answer

The policy restricts read access to a specific role, which is too permissive

Answer

The policy does not enable server-side encryption

Answer

The policy contains a syntax error in the JSON

Question 8

Drag and drop the steps for implementing a cloud data encryption strategy using a customer-managed key (CMK) in AWS KMS into the correct order.

Accepted Answer

Create the CMK, then enable automatic key rotation, then set IAM permissions and key policies, then configure application integration, then monitor usage and audit logs.. The correct order starts with creating the CMK, then enabling rotation, setting permissions, configuring application integration, and finally monitoring usage.

Answer

Create the CMK, then set IAM permissions and key policies, then enable automatic key rotation, then configure application integration, then monitor usage and audit logs.

Answer

Set IAM permissions and key policies, then create the CMK, then enable automatic key rotation, then configure application integration, then monitor usage and audit logs.

Answer

Create the CMK, then enable automatic key rotation, then configure application integration, then set IAM permissions and key policies, then monitor usage and audit logs.

Question 9

Match each cloud service model to its primary responsibility area according to the shared responsibility model.

Accepted Answer

SaaS: Provider manages all infrastructure, platform, and application software; customer manages data and access control.. The shared responsibility model delineates security obligations; SaaS offloads most to provider, on-premises retains all.

Answer

SaaS: Provider manages only physical security; customer manages all other aspects including applications and data.

Answer

IaaS: Provider manages operating system, applications, and data; customer manages physical servers.

Question 10

Match each compliance framework to its primary jurisdiction or industry.

Accepted Answer

GDPR: European Union. Compliance frameworks are often region- or industry-specific; cloud providers must support customer compliance.

Answer

ISO 27001: European Union

Answer

SOC 2: US healthcare

Question 11

A developer is writing code that will be deployed as a serverless function. The function needs to read data from a cloud storage bucket. According to the principle of least privilege, how should the developer grant access?

Accepted Answer

Create a role with a read policy for the bucket and assign it to the function. Serverless functions should assume a role that grants only the specific permissions needed—in this case, a read policy for the bucket. This follows the principle of least privilege by avoiding hardcoded credentials and instead using temporary, automatically rotated credentials provided by the cloud provider's security token service via the role. The role is attached to the function at deployment, ensuring the function can securely access the bucket without exposing long-term access keys.

Answer

Store the cloud provider access key and secret key in environment variables in the function

Answer

Use the root user credentials of the cloud account

Answer

Set the bucket policy to allow public read access

Question 12

A cloud security engineer is configuring a cloud function that processes messages from a message queue service. The function needs to write results to a NoSQL database. Which of the following is the SECUREST way to manage the function's credentials?

Accepted Answer

Attach a service-linked role to the function with fine-grained permissions for the queue and database. Cloud functions support service-linked roles that provide temporary, automatically rotated credentials via the cloud provider's security token service. By attaching a service-linked role with fine-grained permissions for the queue (e.g., ReceiveMessage) and the database (e.g., PutItem), the function never needs to manage long-lived secrets, eliminating the risk of credential leakage or rotation failures.

Answer

Use a secrets manager to store credentials and retrieve them at runtime

Answer

Store the database credentials as ciphertext in the function's environment variables

Answer

Create a service account with access keys and pass them to the function via encrypted environment variables

Question 13

A developer is implementing a cloud application that stores sensitive user data. To minimize the risk of data exposure during transit, which security control should be enforced as a baseline requirement?

Accepted Answer

Enforce TLS for all data in transit. TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, providing confidentiality, integrity, and authentication. Enforcing TLS for all communications ensures that sensitive user data is protected from eavesdropping and tampering during transmission, making it a baseline requirement for cloud application security.

Answer

Implement IPsec tunnels between components

Answer

Use HTTPS without additional controls

Answer

Require SSH for all connections

Question 14

A cloud application is being designed to handle highly sensitive financial data. The security architect wants to ensure that encryption keys are managed outside the application's memory space. Which service model should they use?

Accepted Answer

Hardware Security Module (HSM). A Hardware Security Module (HSM) is a dedicated hardware appliance that manages encryption keys in a physically and logically isolated environment, entirely separate from the application's memory space. For highly sensitive financial data, an HSM provides FIPS 140-2 Level 3 or higher certification, ensuring keys never leave the device and are protected against memory-scraping attacks. This aligns with the requirement to keep key management outside the application's memory.

Answer

Cloud Hardware Security Module (CloudHSM)

Answer

Key Management Service (KMS)

Answer

Trusted Platform Module (TPM)

Question 15

During a security audit, a cloud application is found to have numerous container images with critical vulnerabilities. The DevOps team wants to prevent vulnerable images from being deployed to production. Which two controls should be implemented? (Select TWO)

Accepted Answer

Implement image vulnerability scanning in the CI/CD pipeline. Integrating image vulnerability scanning into the CI/CD pipeline ensures that every container image is automatically checked for known Common Vulnerabilities and Exposures (CVEs) before it can be promoted to production. This shift-left approach blocks vulnerable images at build time, preventing them from ever reaching the production environment. Option C is correct because enforcing signed images from a trusted registry (e.g., using Docker Content Trust or Notary) cryptographically verifies the image's integrity and origin, ensuring only authorized, non-tampered images are deployed.

Answer

Regularly update base images

Answer

Use network segmentation to isolate production containers

Answer

Run all containers as non-root users