CCSP Cloud Application Security Practice Test 3 — 15 Questions

Question 1

A company uses a cloud-based CI/CD pipeline with GitLab. Developers push code to a repository, triggering a build. The security team notices that sensitive API keys are being logged in build output. Which practice best prevents this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a secrets detection tool in the pipeline. A secrets detection tool (e.g., GitLab Secret Detection, TruffleHog, or Gitleaks) scans code and build output for patterns matching API keys, tokens, or passwords before they are logged or stored. This directly prevents sensitive credentials from appearing in build logs, which is the specific issue described. Unlike other options, it actively identifies and blocks secrets at the point of exposure.

Answer

Use environment variables in the pipeline configuration

Answer

Use a separate build server

Answer

Encrypt the Git repository

Question 2

A cloud application uses AWS Lambda functions in a serverless architecture. The security team wants to enforce least privilege access for these functions. Which THREE practices should be implemented?

Accepted Answer

Use AWS Parameter Store or Secrets Manager for sensitive data. Option A is correct because storing sensitive data in AWS Systems Manager Parameter Store or AWS Secrets Manager keeps credentials out of the function code and environment, allowing controlled, auditable retrieval with fine-grained IAM permissions and automatic rotation (Secrets Manager), which supports least privilege. Option C is correct because assigning a dedicated IAM role to each Lambda function ensures each function has its own distinct set of permissions, so a compromise or misconfiguration in one function does not grant access to resources used by other functions. Option D is correct because granting only the minimal necessary access (least privilege) limits each function's permissions to exactly the actions and resources it requires, reducing the blast radius of any compromise. Option B is not ideal because Lambda environment variables, even when encrypted with KMS, are accessible to anyone who can read the function configuration and are exposed in the console/API, making them a weaker choice than a dedicated secrets service. Option E is incorrect because a single shared IAM role for all Lambda functions violates least privilege by giving every function the union of all permissions, increasing risk.

Answer

Store secrets in Lambda environment variables encrypted with KMS

Answer

Use a single IAM role for all Lambda functions for simplicity

Question 3

A fintech startup deploys a customer-facing web application on Azure App Service. The application uses OAuth 2.0 with Azure AD for authentication. Recently, users report being logged out unexpectedly during active sessions. Security logs show multiple token refresh attempts failing with 'invalid_grant' errors. The application uses a standard library for token management. What is the most likely cause and recommended action?

Accepted Answer

The access token and refresh token lifetimes are misconfigured; align token lifetimes. The 'invalid_grant' error during token refresh typically indicates that the refresh token has expired or been revoked. In Microsoft Entra ID, refresh token lifetimes are configurable and, if set too short or misaligned with the access token lifetime, users will be logged out unexpectedly when the refresh token expires before a new access token is requested. The standard library correctly handles the OAuth 2.0 flow, but the token lifetime configuration in the Microsoft Entra ID app registration is the root cause.

Answer

The Azure AD API is throttling requests; implement exponential backoff

Answer

The authorization code was reused; implement PKCE to prevent reuse

Answer

The user consent was revoked; advise users to re-consent

Question 4

A global e-commerce platform uses AWS API Gateway to expose REST APIs to third-party developers. The security team notices that a malicious user is repeatedly sending large payloads to a /submit endpoint, causing high CPU usage on backend Lambda functions. The API uses a simple API key for authentication. Which combination of controls should be implemented to mitigate this attack while preserving legitimate access?

Accepted Answer

Configure API Gateway throttling and request body size validation. It directly addresses the two attack vectors: large payloads causing CPU exhaustion and excessive request volume. API Gateway request body size validation (up to 10 MB by default, configurable) rejects oversized payloads before they reach the backend Lambda, while throttling (e.g., 10,000 requests per second with a burst limit) prevents a single user from overwhelming the system. Together, these controls preserve legitimate access by only limiting anomalous traffic, not blocking all users.

Answer

Subscribe to AWS Shield Advanced for DDoS protection

Answer

Change authentication to IAM roles with temporary credentials

Answer

Enable AWS WAF with a rate-based rule and block IP addresses

Question 5

A media streaming company uses a multi-cloud strategy with AWS and GCP. Their application uses a message queue (Amazon SQS and Google Pub/Sub) for asynchronous processing. The security team discovers that messages contain sensitive user data (e.g., email addresses) that are not encrypted at the broker level. The compliance team mandates encryption of data at rest and in transit for all sensitive data. However, the application already uses TLS for message delivery. What is the most secure and operationally efficient way to meet compliance?

Accepted Answer

Implement client-side encryption of message payloads before sending to the queue, using a centralized key management service. Client-side encryption ensures that sensitive data is encrypted before it ever leaves the application, meeting the compliance mandate for encryption at rest and in transit regardless of the broker's native encryption capabilities. Since TLS already protects data in transit, adding client-side encryption with a centralized key management service (e.g., AWS KMS or GCP Cloud KMS) provides end-to-end confidentiality: the message payload is encrypted by the producer, remains encrypted in the queue, and is decrypted only by the authorized consumer. This approach is operationally efficient because it avoids vendor lock-in and works uniformly across AWS SQS and GCP Pub/Sub without relying on broker-specific SSE features that may not cover all states (e.g., broker logs or backups).

Answer

Enable server-side encryption with SQS (SSE-SQS) and Pub/Sub (CSEK) and rely on TLS for in transit

Answer

Separate sensitive and non-sensitive messages into different queues with different retention policies

Answer

Use a third-party encryption gateway that wraps messages before they reach the queues

Question 6

A cloud application team is building a multi-tenant SaaS platform on AWS. They need to ensure that each tenant's data is isolated and that no tenant can access another tenant's data. The application uses a shared RDS database with a tenant_id column. Which security control should be implemented to enforce tenant isolation at the application layer?

Accepted Answer

Implement row-level security (RLS) in the database and set the tenant context per session.. Row-level security (RLS) enforces tenant isolation directly in the database, ensuring that queries only return rows belonging to the current tenant. By setting the tenant context per session, the application can rely on the database to filter data, reducing the risk of accidental or malicious cross-tenant access. This is a strong application-layer control when using a shared schema.

Answer

Use separate database schemas for each tenant and grant each tenant's application role access only to its schema.

Answer

Encrypt each tenant's data with a unique encryption key and store keys in AWS KMS.

Answer

Implement a web application firewall (WAF) with rules to block cross-tenant requests.

Question 7

A cloud security architect is designing a microservices application deployed on a Kubernetes cluster. The architect must ensure that inter-service communication is encrypted, authenticated, and authorized at the application layer. Which two mechanisms should be implemented? (Choose two.)

Accepted Answer

JSON Web Tokens (JWT) validated by each service for authorization.. The requirements are encryption, authentication, and authorization at the application layer. Mutual TLS via a service mesh encrypts traffic and authenticates both ends using certificates. JWTs validated by each service provide authorization based on claims. Together they satisfy all three requirements, while network policies and RBAC operate at different layers.

Answer

Role-Based Access Control (RBAC) for service accounts.

Answer

Network policies that allow traffic only between specific pods.

Answer

A web application firewall (WAF) in front of each service.

Question 8

A company is developing a cloud application that uses OAuth 2.0 for authorization. The application needs to access a user's resources on a third-party API. The security team wants to ensure that the application does not store the user's credentials. Which OAuth 2.0 flow should be used?

Accepted Answer

Authorization Code Grant with PKCE. The Authorization Code Grant with PKCE allows the application to redirect the user to the authorization server for authentication, so the application never sees the user's credentials. PKCE protects against authorization code interception. This flow is ideal for public clients like mobile or single-page applications, and it provides both access and refresh tokens securely.

Answer

Implicit Grant

Answer

Client Credentials Grant

Answer

Resource Owner Password Credentials Grant

Question 9

A cloud-native web application runs behind an Application Load Balancer (ALB) and uses Amazon Cognito for user authentication. The security team wants to enforce that all API calls carry a valid OAuth 2.0 access token and that token scopes are validated before granting access to specific endpoints. Which mechanism should be used to meet these requirements?

Accepted Answer

Implement an API Gateway with a Cognito user pool authorizer and configure scopes on methods.. The requirement is to validate OAuth 2.0 access tokens and enforce scopes for API calls. API Gateway with a Cognito user pool authorizer provides native JWT validation and scope enforcement at the API layer, ensuring that only requests with valid tokens and required scopes reach backend services. This managed solution reduces custom code and centralizes authorization, aligning with cloud security best practices for API protection.

Answer

Configure the ALB to perform JWT validation using a built-in Cognito authorizer.

Answer

Store the access token in a client-side cookie and validate it in the application code.

Answer

Use AWS IAM roles for service-to-service authentication and ignore OAuth scopes.

Question 10

A cloud security architect is designing a serverless application using AWS Lambda. The application processes sensitive data and must adhere to security best practices. Which two measures should be implemented to secure the Lambda functions? (Choose two.)

Accepted Answer

Configure the Lambda function to run in a VPC with private subnets and security groups.. Assigning least privilege IAM roles ensures that the Lambda function has only the necessary permissions, reducing risk. Configuring the function to run in a VPC with private subnets and security groups controls network access to sensitive resources and restricts outbound traffic. Together, these measures significantly enhance the security posture of serverless functions.

Answer

Set a longer timeout for the Lambda function to allow more time for security checks.

Answer

Enable AWS X-Ray tracing to monitor function execution.

Answer

Store sensitive data in environment variables encrypted with AWS KMS.

Question 11

A cloud application uses a third-party identity provider (IdP) for user authentication via OpenID Connect (OIDC). The security team wants to ensure that only users with a specific role can access a sensitive API. Which OIDC feature should be used to enforce this?

Accepted Answer

A custom claim in the ID token that contains the user's role.. To enforce role-based access with OIDC, the IdP should include a custom claim in the ID token that represents the user's role. The API validates the token and checks the claim before granting access. This ensures that only users with the required role can access the sensitive API.

Answer

The access token's scope parameter.

Answer

The ID token's audience (aud) claim.

Answer

The userinfo endpoint response.

Question 12

A company is deploying a containerized application on Amazon ECS with Fargate. The security team wants to ensure that secrets used by the application, such as database credentials, are securely managed and injected into containers without hardcoding. Which two AWS services should be used together to achieve this? (Choose two.)

Accepted Answer

AWS Secrets Manager. To securely manage and inject secrets into ECS Fargate containers, AWS Secrets Manager or Systems Manager Parameter Store (SecureString) are the appropriate services. Both integrate with ECS task definitions to inject secrets at runtime, avoiding hardcoded credentials. They also support IAM policies for access control and encryption, ensuring secrets are protected throughout their lifecycle. Using either service eliminates the need to embed secrets in code or images.

Answer

Amazon S3 with bucket policies

Answer

AWS IAM roles for tasks

Answer

AWS KMS customer managed keys

Question 13

A healthcare organization stores sensitive patient data in a cloud-based application. The security team must ensure that data is protected both at rest and in transit, and that encryption keys are managed securely. Which combination of controls best meets these requirements?

Accepted Answer

Use TLS for data in transit and client-side encryption with customer-managed keys for data at rest.. The most secure approach for sensitive patient data is to use TLS for data in transit and client-side encryption with customer-managed keys for data at rest. This ensures end-to-end protection and gives the organization full control over encryption keys, which is critical for regulatory compliance and data privacy. Server-side encryption, even with customer-managed keys, still involves the provider in the encryption process, which may not meet the highest security standards.

Answer

Use TLS for data in transit and server-side encryption with provider-managed keys for data at rest.

Answer

Use TLS for data in transit and server-side encryption with customer-managed keys for data at rest.

Answer

Use IPsec VPN for data in transit and server-side encryption with provider-managed keys for data at rest.

Question 14

A cloud security architect is designing a secure software development lifecycle (SDLC) for a new cloud-native application. The architect must ensure that security is integrated into the build and deployment processes. Which two practices should be implemented to achieve this? (Choose two.)

Accepted Answer

Perform static application security testing (SAST) on every code commit.. Threat modeling during design and static application security testing on every code commit are both practices that integrate security early and continuously into the SDLC. Threat modeling identifies risks before coding, while SAST provides automated feedback during development. Together, they embed security into the build and deployment processes, aligning with DevSecOps principles. Other options either occur too late or focus on production runtime rather than build-time integration.

Answer

Require manual security code review before each production release.

Answer

Implement runtime application self-protection (RASP) in production.

Answer

Use infrastructure as code (IaC) scanning to detect misconfigurations.

Question 15

A company is migrating a legacy application to the cloud. The application uses hardcoded database credentials. Which secure development practice should be implemented to address this?

Accepted Answer

Use a secrets management service. Hardcoded database credentials in application code create a severe security risk because they are exposed in version control, logs, and static analysis. Using a secrets management service (e.g., AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) allows credentials to be stored securely, rotated automatically, and accessed at runtime via API calls, eliminating the need to embed secrets in code. This aligns with the principle of least privilege and secure credential management in cloud application security.

Answer

Use code signing for all deployments

Answer

Implement input validation on all user inputs

Answer

Enable encryption at rest for the database