CCSP Cloud Application Security Practice Test 10 — 15 Questions

Question 1

A development team is building a web application that stores user passwords. The security architect recommends using a password hashing algorithm with a tunable work factor and a per-user random salt. Which approach best meets this recommendation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a memory-hard password hashing function such as Argon2id with a calibrated cost parameter and a unique salt per user.. Storing passwords securely requires a one-way function designed for the purpose, with a per-user salt and an adjustable cost that can be raised as hardware improves. Argon2id provides memory hardness and a calibrated cost parameter, satisfying both parts of the architect's recommendation. Fast hashes, reversible encryption, and keyed hashes with a shared secret each fail to make large-scale offline guessing economically impractical.

Answer

Hash each password with SHA-256 and store the resulting digest alongside a random salt generated per user.

Answer

Encrypt each password with AES-256 using a key stored in a hardware security module and store the ciphertext.

Answer

Apply HMAC-SHA-256 to each password using a global application secret as the key and store the resulting tag.

Question 2

A cloud application team is designing a multi-tenant SaaS platform on a public cloud. Tenant data is stored in a shared database, and the application uses a single service account to connect. During a threat modeling session, the security architect raises concerns that a coding error could allow one tenant to read another tenant's records. Which control should be implemented to provide defense in depth against this cross-tenant data access risk?

Accepted Answer

Enforce row-level security policies in the database that filter queries based on a tenant identifier derived from the authenticated session context.. Row-level security enforces tenant boundaries inside the database engine, independent of application query construction. By deriving the tenant identifier from the authenticated session, the policy cannot be bypassed by a forgotten WHERE clause or a manipulated parameter. This creates a reliable second layer of defense that complements application-level checks and encryption, directly mitigating the cross-tenant read risk identified during threat modeling.

Answer

Create a separate database schema for each tenant and grant the application service account access only to the schema corresponding to the current request.

Answer

Encrypt each tenant's data with a separate customer-managed key and store the key identifier in the application configuration.

Answer

Implement a Web Application Firewall rule that inspects request parameters for tenant identifiers and blocks requests where the identifier does not match the authenticated user.

Question 3

A media company uses a CI/CD pipeline to deploy a web application to a cloud platform. The security team wants to integrate security testing that can detect vulnerabilities in third-party libraries and base images before deployment, without significantly slowing the pipeline. Which practice should be implemented?

Accepted Answer

Software composition analysis (SCA) and container image scanning integrated into the pipeline.. Detecting vulnerabilities in third-party libraries and base images before deployment requires tools that inspect dependencies and image contents. SCA reads dependency manifests for known CVEs, and container image scanning checks layers for vulnerable packages. Both integrate into CI/CD with fast, automated feedback. DAST and IAST need running environments and target runtime behavior, while SAST covers only first-party code, so none of those alone meets the requirement.

Answer

Static application security testing (SAST) on the application source code only.

Answer

Dynamic application security testing (DAST) against the staging environment after each deployment.

Answer

Interactive application security testing (IAST) with agents in the staging environment.

Question 4

A cloud team is integrating a third-party analytics service into its application. The vendor requires access to data in the organization's object storage bucket. Security policy forbids sharing long-lived cloud credentials with third parties. Which approach best satisfies the policy while granting the vendor the required access?

Accepted Answer

Configure a cross-account IAM role in the organization's account that trusts the vendor's account, and have the vendor assume it to obtain temporary credentials scoped to the bucket.. The policy requires that third parties never hold long-lived cloud credentials. Cross-account role assumption issues temporary, scoped credentials through the cloud provider's token service, so the vendor authenticates to its own identity and receives access only to the designated bucket. Access keys, long-lived pre-signed URLs, and public buckets all create durable or unauthenticated access paths that the policy prohibits.

Answer

Create an IAM user for the vendor and issue an access key, then rotate the key every 90 days through a documented process.

Answer

Generate a pre-signed URL for the bucket with a long expiration and send it to the vendor so they can retrieve the objects.

Answer

Enable public read access on the bucket and rely on the vendor's network allowlist to restrict who can retrieve the objects.

Question 5

A healthcare company runs a containerized patient portal on a managed Kubernetes service. The security team needs to ensure that container images cannot be deployed if they contain known critical vulnerabilities. The build pipeline already produces an SBOM. Which control should be enforced at the admission layer to meet this requirement?

Accepted Answer

Configure the cluster's admission controller to reject pods whose images are not signed by the organization's trusted cosign key, and run a vulnerability scan as part of the CI pipeline before signing.. Preventing deployment of vulnerable images requires a preventive control at admission that verifies images were scanned and approved. Signing images after a CI vulnerability scan and enforcing signature verification in the admission controller creates a cryptographic gate. Detection, private registries, and network controls do not evaluate image contents before scheduling, so they cannot block vulnerable workloads.

Answer

Configure network policies to limit pod-to-pod traffic and enable mutual TLS between all services in the cluster.

Answer

Enable a runtime security agent that alerts when a container executes a known malicious binary, and route alerts to the SOC for manual triage.

Answer

Restrict the cluster's image registry to an internal private registry and require developers to push images only to that registry.

Question 6

A cloud application uses a managed API gateway to expose REST APIs. The security team wants to ensure that clients cannot bypass the gateway and call backend services directly. The backend services run on private subnets and are fronted by an internal load balancer. Which control should be implemented to enforce this requirement?

Accepted Answer

Configure the backend services to accept traffic only from the API gateway's security group or service account. The only way to prevent clients from bypassing the API gateway is to restrict backend ingress to the gateway's identity. This can be enforced through security groups, network policies, or IAM roles. mTLS, WAFs, and gateway-only API key validation add security but do not block direct network access, so they cannot guarantee that all traffic flows through the gateway.

Answer

Enable TLS mutual authentication between the API gateway and backend services

Answer

Use API keys validated at the API gateway only

Answer

Deploy a web application firewall (WAF) on the backend services

Question 7

A company is building a cloud-native API that uses OAuth 2.0 for delegated authorization. The security team wants to harden the authorization code flow against token interception and misuse. Which two measures should be implemented to protect the authorization code and tokens? (Choose two.)

Accepted Answer

Enable PKCE so the client sends a code challenge and later proves possession of the corresponding verifier when exchanging the code.. Hardening the authorization code flow focuses on preventing intercepted codes from being redeemed by an attacker. Binding the code to the client and redirect URI, combined with a short lifetime, limits replay. PKCE adds proof of possession so a stolen code is useless without the verifier. Together they address interception and misuse without exposing tokens to the browser or weakening transport protections.

Answer

Store refresh tokens in browser local storage to allow the client to silently renew access tokens without user interaction.

Answer

Configure the resource server to accept access tokens in query string parameters so that clients can easily include them in requests.

Answer

Use the implicit grant so that tokens are returned directly from the authorization endpoint without an intermediate code.

Question 8

A cloud security team is designing a secure software development lifecycle (SDLC) for a new microservices application deployed to a public cloud. They want to ensure that security is embedded throughout development and operations. Which two practices should be implemented to achieve this? (Choose two.)

Accepted Answer

Conduct threat modeling during the design phase for each microservice.. Embedding security throughout the SDLC requires proactive design-time analysis and automated enforcement in delivery. Threat modeling during design surfaces risks before code exists, while automated CI/CD security gates ensure every build meets policy and blocks critical findings. Together they shift security left and maintain it through deployment. Production-only testing, centralized ownership, and reduced logging all weaken or delay security rather than integrating it continuously.

Answer

Assign all security responsibilities exclusively to a centralized security team.

Answer

Disable detailed logging in production to reduce storage costs and improve performance.

Answer

Perform a full penetration test only after the application is deployed to production.

Question 9

A cloud-native SaaS provider uses OpenID Connect (OIDC) for user authentication. The security architect wants to reduce the impact of stolen authorization codes and ensure that tokens issued to a single-page application cannot be replayed by a different client. Which OIDC mechanism should be implemented?

Accepted Answer

Use PKCE with the S256 code challenge method and validate the redirect URI against a registered value.. PKCE with S256 ties the authorization code to the initiating client via the code verifier, so a stolen code cannot be redeemed by an attacker who does not possess the verifier. Strict redirect URI validation further constrains where codes and tokens can be delivered. Together they directly mitigate code interception and cross-client replay for public clients like SPAs.

Answer

Configure the authorization server to use the implicit flow so that no authorization code is ever issued.

Answer

Require the authorization server to issue sender-constrained access tokens using Demonstrating Proof of Possession (DPoP).

Answer

Enable refresh token rotation and bind refresh tokens to the client's IP address.

Question 10

A development team is building a cloud-native application that stores user session data in a managed Redis service. The security architect requires that session data be encrypted at rest and that the application authenticate to Redis without embedding static credentials in code. Which approach best meets these requirements?

Accepted Answer

Enable encryption at rest on the Redis service and use IAM authentication with short-lived tokens. The best approach combines native encryption at rest with IAM authentication using short-lived tokens. This removes static credentials from code and leverages the cloud provider's identity system. Storing passwords in environment variables, configuration files, or using long-lived shared secrets all violate the requirement to avoid static credentials, even if encryption at rest is enabled.

Answer

Rely on network isolation and Redis AUTH with a long-lived password rotated quarterly

Answer

Enable encryption at rest and store the Redis password in an environment variable

Answer

Use client-side encryption before writing to Redis and authenticate with a shared secret stored in a configuration file

Question 11

A security team is reviewing the software development lifecycle for a cloud-native application. They want to shift security left and reduce the cost of remediating defects. Which two practices best support this goal? (Choose two.)

Accepted Answer

Add infrastructure as code scanning that detects misconfigurations in templates before they are deployed to any environment.. Shifting security left means embedding automated checks into the earliest stages of development so defects are found and fixed while changes are small. Static analysis on every commit and infrastructure as code scanning before deployment both deliver immediate, low-cost feedback in the developer workflow. Late penetration tests, manual exception forms, and annual training do not detect defects at authoring time and therefore do not lower remediation cost.

Answer

Conduct annual security awareness training for all engineers and track completion in the learning management system.

Answer

Require developers to submit a written security exception form for every new cloud resource they provision.

Answer

Perform a full penetration test of the application only after it has been deployed to the production environment.

Question 12

A cloud operations team is deploying a web application that stores configuration files and application logs in an object storage bucket. The security policy requires that data be encrypted at rest, and the team wants the cloud provider to manage the encryption keys with minimal operational overhead. The bucket must remain accessible to the application without code changes. Which approach should the team use?

Accepted Answer

Enable server-side encryption with provider-managed keys on the bucket, which automatically encrypts objects at rest.. Provider-managed server-side encryption is the lowest-overhead way to meet an encryption-at-rest requirement because the cloud service handles key storage, rotation, and cryptographic operations automatically. The application's read and write operations remain unchanged, so no code modifications are needed. This satisfies both the security policy and the operational constraints described by the team.

Answer

Use server-side encryption with customer-provided keys, supplying the key in each request so the provider does not store it.

Answer

Rely on transport layer security for data in transit and document that encryption at rest is not required for configuration files.

Answer

Implement client-side encryption in the application so that objects are encrypted before upload, using keys stored in the application configuration.

Question 13

A security engineer is reviewing a cloud application that uses OAuth 2.0 to delegate access to a third-party API. The application is a single-page application (SPA) running in the browser. The engineer wants to prevent authorization code interception and ensure that the client cannot impersonate another client. Which OAuth 2.0 enhancement should be implemented?

Accepted Answer

Proof Key for Code Exchange (PKCE). PKCE is specifically designed to secure the authorization code flow for public clients like SPAs that cannot hold a client secret. It prevents code interception by binding the code to a dynamically generated verifier. The implicit flow, client credentials, and resource owner password credentials either expose tokens or require secrets that SPAs cannot protect, and none address code interception.

Answer

OpenID Connect (OIDC) with the implicit flow

Answer

Client credentials grant with a client secret

Answer

Resource owner password credentials grant

Question 14

A cloud security team is reviewing a CI/CD pipeline that builds and deploys a containerized application to a production cluster. The pipeline runs in a cloud build service and uses a long-lived service account key stored as a secret in the pipeline configuration to push images and update deployments. A recent audit flagged this as a risk. Which change best reduces the risk of credential compromise while maintaining automated deployments?

Accepted Answer

Replace the long-lived key with short-lived credentials obtained through workload identity federation between the build service and the cloud provider.. Storing long-lived service account keys in a pipeline creates a persistent credential that attackers can steal and reuse. Workload identity federation replaces that key with short-lived tokens bound to the build service's identity, so credentials expire automatically and are scoped to the workload. This maintains automation while removing the stored secret, which is the most effective way to reduce credential compromise risk.

Answer

Grant the service account broader permissions so that fewer distinct credentials are needed across pipeline stages.

Answer

Rotate the service account key on a weekly schedule and store the new key in the same pipeline secret store.

Answer

Encrypt the service account key with a customer-managed key and restrict access to the pipeline configuration to a small group of administrators.

Question 15

A development team is building a cloud application that stores sensitive customer data in a managed database service. The security policy requires that data be encrypted at rest with keys that the organization controls and can rotate independently of the cloud provider. Which approach meets this requirement?

Accepted Answer

Encrypt the database volume with a customer-managed key stored in the cloud provider's key management service, with key rotation and access policies defined by the organization.. The requirement is encryption at rest with organizational control over keys. Customer-managed keys in the cloud KMS allow the organization to define rotation, access policies, and revocation while integrating with the managed database. Provider-managed keys, keys in config files, and passphrase-derived keys do not provide the required control and lifecycle management.

Answer

Encrypt sensitive columns at the application layer using a key derived from a static passphrase embedded in the source code.

Answer

Enable transparent data encryption on the database and store the master key in the application's configuration file.

Answer

Use the cloud provider's default service-managed encryption keys and enable automatic key rotation in the provider console.