CCSP Cloud Application Security Practice Test 2 — 15 Questions

Question 1

A cloud application processes data subject to GDPR. The security team needs to ensure that all personally identifiable information (PII) is encrypted at rest and that access is logged. Which combination of controls should be implemented? (Select THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement strict least privilege access controls. Strict least privilege access controls ensure that only authorized users or services can access PII, minimizing the risk of unauthorized exposure. This is a fundamental security principle for GDPR compliance, as it directly supports the data minimization and access control requirements. By restricting access to only what is necessary for a role, the organization reduces the attack surface and ensures that any access is intentional and auditable.

Answer

Use TLS for all network connections

Answer

Implement a key management system

Question 2

A developer receives the above error when trying to create a route in an API Gateway. Which action should the developer take to resolve the issue?

Accepted Answer

Delete the existing route or use a different route key. The most likely cause of such an error in API Gateway is a duplicate route key. API Gateway enforces unique route keys within an API; attempting to create a duplicate route key (e.g., the same HTTP method and path combination) will fail. Deleting the existing route or using a different route key resolves the conflict by ensuring each route key is unique.

Answer

Change the endpoint type to private

Answer

Add an authentication mechanism to the API

Answer

Verify that the API is deployed to the correct stage

Question 3

A security analyst reviews the above cloud storage bucket policy. The bucket stores sensitive application data. What is the primary security issue with this policy?

Accepted Answer

The Deny statement will block all access, including from authorized IPs. The Deny statement with a condition that denies all requests not matching the specified IP range will block access from any IP address that is not in the listed range, including authorized IPs that the policy intended to allow. This creates a complete denial of service for legitimate users, making it the primary security issue.

Answer

The resource identifier should not include a wildcard

Answer

The policy should use a condition with source VPC instead of IP

Answer

The IP address range is too broad

Question 4

A security analyst is reviewing cloud audit logs and sees the above event. The analyst suspects that the machine image used may be outdated and vulnerable. Which action should the analyst take to verify the security posture of the launched instance?

Accepted Answer

Look up the machine image in the cloud console and review its description and security bulletins. The image ID in the audit log can be used to look up the machine image in the cloud provider's compute console, where its description, release notes, and associated security bulletins are available. This allows the analyst to determine if the image is outdated or has known vulnerabilities, directly addressing the suspicion about the image's security posture.

Answer

Verify that the instance is not assigned a public IP address

Answer

Check the security groups associated with the instance

Answer

Check the image ID for known vulnerabilities using the cloud provider's patch management service

Question 5

A security auditor is reviewing a cloud application's data encryption strategy. The application stores sensitive data in a cloud database. Which configuration would best ensure data confidentiality in the event of a database dump?

Accepted Answer

Column-level encryption using application-managed keys. Column-level encryption with application-managed keys ensures that even if the entire database is dumped, the sensitive columns remain encrypted and unreadable without the keys held by the application. This approach decouples key management from the cloud provider, preventing the provider from accessing the plaintext data and maintaining confidentiality during a breach or dump.

Answer

Tokenization of sensitive fields with a separate token vault

Answer

Entire database encryption at rest using cloud provider managed keys

Answer

Transport layer security for all connections

Question 6

An architect reviews this S3 bucket policy. What security concern should be raised?

Accepted Answer

The policy grants access to all users from the specified IP range.. The policy grants s3:GetObject access to all users (Principal: "*") from the specified IP range, which means any unauthenticated user on the internet within that IP range can read objects in the bucket. This violates the principle of least privilege and exposes data to potential unauthorized access, as the policy does not require authentication or additional authorization checks.

Answer

The policy allows s3:GetObject from any source.

Answer

The policy allows s3:GetObject only to the specific bucket.

Answer

The policy does not restrict access to authenticated users.

Question 7

During a security review, a cloud security architect discovers that a PaaS database service has public network access enabled. The application team claims they need it for external integrations. What is the most secure alternative to allow necessary access?

Accepted Answer

Use Azure Private Link or AWS PrivateLink to connect via private IP within the cloud network.. Azure Private Link or AWS PrivateLink creates a private endpoint within the cloud network, allowing the database to be accessed privately without public internet exposure. This is the most secure alternative as it eliminates the attack surface of a public IP. Option A is incorrect because encryption does not prevent public access; it only protects data confidentiality. Option C is incorrect because moving to a VM-hosted instance introduces additional management overhead and may still require public access depending on configuration. Option D is a less secure alternative because IP whitelisting still exposes the database to the public internet, and IP addresses can be spoofed or change.

Answer

Encrypt all data at rest and in transit to the database.

Answer

Move the database to a VM-hosted instance with a VPN connection.

Answer

Restrict public access using IP whitelisting to only required external IPs.

Question 8

Which TWO of the following are key components of a secure software development lifecycle (SSDLC) in a cloud environment?

Accepted Answer

Automated static application security testing (SAST) during code commit.. Option A is correct because automated SAST integrated at code commit (e.g., via CI/CD pipeline hooks) scans source code for vulnerabilities such as injection flaws and insecure coding patterns before the artifact is built or deployed, which is a foundational shift-left control in an SSDLC. Option B is correct because security-focused code reviews add human analysis that catches logic flaws, authorization gaps, and design-level weaknesses that automated tools often miss, making peer review a core SSDLC practice. Option C is not correct because performing security testing only after production deployment is a reactive, post-release approach that violates the shift-left principle and exposes live systems to avoidable risk. Option D is not correct because, while security awareness training is valuable, it is a general organizational control rather than a key technical component of the SSDLC itself. Option E is not correct because unit tests verify functional behavior and security functionality, but they are not a substitute for dedicated security testing activities such as SAST, DAST, or code review within the SSDLC.

Answer

Performing security testing only after deployment to production.

Answer

Mandatory security awareness training for developers.

Answer

Integration of unit tests that check for security functionality.

Question 9

A financial services company uses a CI/CD pipeline to deploy microservices to a Kubernetes cluster. The security team wants to ensure container images are scanned for vulnerabilities before deployment. Which integration point in the pipeline is most effective?

Accepted Answer

Post-build image scanning in registry. Post-build image scanning in the registry (Option C) is the most effective integration point because it automatically scans container images after they are built and pushed, catching vulnerabilities before the image is deployed to production. This ensures that only compliant images proceed through the pipeline, aligning with the principle of shift-left security without blocking developer velocity.

Answer

Runtime security monitoring

Answer

Pre-commit hook in source control

Answer

Admission controller in Kubernetes

Question 10

A developer needs to store session state for a cloud-based web application. Which of the following is the most secure approach?

Accepted Answer

Store session data in an encrypted server-side storage. Storing session state in encrypted server-side storage ensures that session data is never exposed to the client, mitigating risks of tampering, replay, or information disclosure. Encryption at rest (e.g., using AES-256) protects against unauthorized access to the storage layer, while server-side control prevents client-side manipulation of session tokens or data. This approach aligns with the principle of least privilege and is recommended by OWASP for secure session management in cloud applications.

Answer

Store session data in a database with SSL

Answer

Store session data in client-side cookies

Answer

Store session data in a distributed cache

Question 11

A company uses a cloud-based identity provider for single sign-on. An application needs to verify the user's identity without storing credentials. Which token type should the application validate?

Accepted Answer

SAML assertion. A SAML assertion is the correct choice because it is specifically designed for single sign-on (SSO) scenarios where an identity provider (IdP) authenticates a user and issues a signed XML token containing the user's identity and attributes. The application validates the assertion's signature and trust relationship with the IdP, verifying the user's identity without ever storing or handling credentials. This aligns with the cloud-based identity provider model described in the question.

Answer

JWT

Answer

Kerberos ticket

Answer

OAuth access token

Question 12

During a security audit, it is discovered that a cloud application's API endpoints are vulnerable to injection attacks. Which defense in depth measure would be most effective in preventing such attacks?

Accepted Answer

Prepared statements in code. Prepared statements (parameterized queries) are the most effective defense against injection attacks because they separate SQL logic from user input, ensuring that input is treated as data only, never as executable code. This prevents attackers from manipulating query syntax, regardless of the input content. In cloud applications, this is a foundational secure coding practice that addresses the root cause of injection vulnerabilities at the application layer.

Answer

Web application firewall (WAF)

Answer

Rate limiting

Answer

Regular expression input validation

Question 13

A cloud application uses customer-managed encryption keys (CMK) stored in a cloud HSM. The application needs to decrypt data on demand. How should the key be accessed?

Accepted Answer

Use a key management service with IAM permissions. Cloud key management services (e.g., AWS KMS, Azure Key Vault) allow you to use customer-managed keys (CMK) stored in a cloud HSM without ever exposing the plaintext key to the application. The application calls the KMS API with IAM permissions to request decryption, and the HSM performs the decryption inside its hardware boundary, returning only the decrypted data. This ensures the key material never leaves the HSM's secure enclave, maintaining the security posture required for CMK usage.

Answer

Use the HSM to decrypt without exposing the key

Answer

Store the key in application configuration

Answer

Copy the key to the application's memory

Question 14

Refer to the exhibit. A developer reports that users are being denied access to a cloud application. The error log shows the above. What is the most likely cause of the denial?

Accepted Answer

The token's expiration time has passed. The error log indicates that the token's expiration time has passed, which is a standard validation check in OAuth 2.0 and OpenID Connect (OIDC) flows. When a token's `exp` claim is less than the current server time, the authorization server or resource server rejects the request with an 'access denied' or similar error. This is the most direct cause of the denial shown in the exhibit.

Answer

The token was issued by an untrusted issuer

Answer

The token lacks required permissions

Answer

The token's signature is invalid

Question 15

A financial organization is migrating a critical application to a cloud environment. The application processes sensitive customer data and must comply with PCI DSS. The security architect proposes using serverless functions for the compute layer. Which security control is essential to protect the application from injection attacks?

Accepted Answer

Use parameterized queries in the functions' database calls. Injection attacks (e.g., SQL injection) exploit untrusted input that is concatenated into database queries. Parameterized queries (prepared statements) separate SQL logic from data, ensuring user input is treated as data only, not executable code. This is the foundational control for preventing injection in serverless functions that interact with databases, as required by PCI DSS Requirement 6.5.1.

Answer

Enable function-level logging for audit trails

Answer

Encrypt all data in transit between functions

Answer

Implement a web application firewall (WAF) in front of the functions