CCSP Cloud Application Security Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A security analyst reviews the S3 bucket policy shown. Which security issue should be flagged?

Accepted Answer

The policy allows unauthenticated write access to the bucket. The S3 bucket policy contains a Principal element set to "*" with an Effect of "Allow" on the s3:PutObject action, which grants unauthenticated write access to the bucket. This means anyone on the internet can upload objects without any authentication, leading to potential data corruption, storage cost abuse, or malware hosting. The policy does not include any condition (e.g., aws:SourceIp or aws:SecureTransport) to restrict the write operation, making it a critical security misconfiguration.

Answer

The policy restricts read access to a specific role, which is too permissive

Answer

The policy does not enable server-side encryption

Answer

The policy contains a syntax error in the JSON

Question 2

Drag and drop the steps for implementing a cloud data encryption strategy using a customer-managed key (CMK) in AWS KMS into the correct order.

Accepted Answer

Create the CMK, then enable automatic key rotation, then set IAM permissions and key policies, then configure application integration, then monitor usage and audit logs.. The correct order starts with creating the CMK, then enabling rotation, setting permissions, configuring application integration, and finally monitoring usage.

Answer

Create the CMK, then set IAM permissions and key policies, then enable automatic key rotation, then configure application integration, then monitor usage and audit logs.

Answer

Set IAM permissions and key policies, then create the CMK, then enable automatic key rotation, then configure application integration, then monitor usage and audit logs.

Answer

Create the CMK, then enable automatic key rotation, then configure application integration, then set IAM permissions and key policies, then monitor usage and audit logs.

Question 3

Drag and drop the steps for conducting a cloud security risk assessment using the NIST CSF framework into the correct order.

Accepted Answer

Identification, then threat/vulnerability assessment, then risk analysis, then treatment, then monitoring. Start with identification, then threat/vulnerability assessment, risk analysis, treatment, and monitoring.

Answer

Threat/vulnerability assessment, then identification, then risk analysis, then treatment, then monitoring

Answer

Identification, then risk analysis, then threat/vulnerability assessment, then treatment, then monitoring

Answer

Identification, then threat/vulnerability assessment, then treatment, then risk analysis, then monitoring

Question 4

Match each cloud service model to its primary responsibility area according to the shared responsibility model.

Accepted Answer

SaaS: Provider manages all infrastructure, platform, and application software; customer manages data and access control.. The shared responsibility model delineates security obligations; SaaS offloads most to provider, on-premises retains all.

Answer

SaaS: Provider manages only physical security; customer manages all other aspects including applications and data.

Answer

IaaS: Provider manages operating system, applications, and data; customer manages physical servers.

Question 5

Match each compliance framework to its primary jurisdiction or industry.

Accepted Answer

GDPR: European Union. Compliance frameworks are often region- or industry-specific; cloud providers must support customer compliance.

Answer

ISO 27001: European Union

Answer

SOC 2: US healthcare

Question 6

A cloud security architect is designing a multi-tier application that processes sensitive customer data. To protect data in transit between the web tier and the application tier, which of the following is the MOST appropriate approach?

Accepted Answer

Use mutual TLS (mTLS) between the tiers. Mutual TLS (mTLS) is the most appropriate approach because it provides bidirectional authentication and encryption between the web tier and application tier. In a multi-tier application processing sensitive customer data, mTLS ensures that both the client (web tier) and server (application tier) present valid certificates, preventing man-in-the-middle attacks and unauthorized inter-tier communication. This is critical for protecting data in transit in zero-trust or internal network segments where simple server-side TLS would not verify the identity of the calling service.

Answer

Use standard TLS with server-side certificates only

Answer

Establish SSH tunnels for all inter-tier communication

Answer

Implement IPsec VPN between the tiers

Question 7

A DevSecOps team is integrating static application security testing (SAST) into their CI/CD pipeline. Which of the following is the PRIMARY benefit of performing SAST during the build phase rather than later in the pipeline?

Accepted Answer

It enables early detection of vulnerabilities before deployment. Performing SAST during the build phase allows the team to identify security vulnerabilities in the source code before the application is compiled, packaged, or deployed. This early detection reduces the cost and effort of remediation because issues are found at the point of code creation, not after deployment. The primary benefit is shifting security left to catch defects before they reach production.

Answer

It identifies runtime vulnerabilities such as SQL injection

Answer

It reduces false positives compared to dynamic analysis

Answer

It scans running applications to find configuration issues

Question 8

A company is deploying a containerized application on Kubernetes. The security team requires that containers run with the least privilege, and that any attempt to escalate privileges within a container is blocked. Which Kubernetes security context setting should be applied to the pod specification?

Accepted Answer

allowPrivilegeEscalation: false. Setting `allowPrivilegeEscalation: false` in the pod's security context directly blocks any attempt by a container process to gain more privileges than its parent process, such as through setuid binaries or syscalls like `setuid()`. This satisfies the requirement to prevent privilege escalation within the container, aligning with the least privilege principle.

Answer

runAsNonRoot: true

Answer

capabilities: drop: ['ALL']

Answer

readOnlyRootFilesystem: true

Question 9

A security analyst is reviewing application logs and notices that a large number of requests from a single IP address are attempting to access a REST API endpoint with invalid session tokens. Which cloud-based mitigation is MOST effective at blocking such automated attacks?

Accepted Answer

Configure a web application firewall (WAF) with rate limiting and IP blacklisting. A Web Application Firewall (WAF) with rate limiting and IP blacklisting directly addresses the described attack: a single IP flooding a REST API with invalid session tokens. Rate limiting throttles the number of requests from that IP, while IP blacklisting blocks it entirely, preventing automated brute-force or credential-stuffing attempts at the cloud edge before they reach the application.

Answer

Rotate API keys more frequently

Answer

Implement cross-origin resource sharing (CORS) policies

Answer

Require encryption of session tokens

Question 10

A financial services company is adopting a cloud-native microservices architecture. They want to ensure that only authorized services can communicate with each other, and that all inter-service communication is encrypted. Which of the following is the BEST approach?

Accepted Answer

Implement a service mesh with mutual TLS (mTLS) and fine-grained access policies. A service mesh with mutual TLS (mTLS) provides both encryption and identity-based authorization for inter-service communication. mTLS ensures that each service presents a valid certificate, proving its identity, and the mesh's control plane enforces fine-grained access policies (e.g., which services can call which endpoints). This directly meets the requirement for authorized, encrypted communication in a cloud-native microservices architecture.

Answer

Use network security groups to restrict traffic between service subnets

Answer

Connect services using VPC peering and enable encryption in transit

Answer

Deploy an API gateway and route all internal traffic through it

Question 11

An organization is migrating a legacy application to the cloud and plans to use a cloud access security broker (CASB). Which of the following is the PRIMARY function of a CASB in securing cloud applications?

Accepted Answer

Enforcing security policies across cloud applications and controlling access. The primary function of a CASB is to enforce security policies and control access across cloud applications, acting as an intermediary between users and cloud providers. It provides visibility into cloud usage, applies data loss prevention (DLP) rules, and enforces authentication and authorization policies, which directly addresses the need to secure a legacy application migrated to the cloud.

Answer

Performing vulnerability scans on cloud infrastructure

Answer

Encrypting data at rest in cloud storage

Answer

Protecting against distributed denial-of-service (DDoS) attacks

Question 12

A company is adopting DevSecOps and wants to incorporate security testing into their continuous integration pipeline. They have decided to run SAST (static analysis) and SCA (software composition analysis) tools. Which of the following is the PRIMARY reason for including SCA in addition to SAST?

Accepted Answer

To identify known vulnerabilities in third-party libraries and dependencies. SCA (Software Composition Analysis) is specifically designed to identify known vulnerabilities in third-party libraries and dependencies by comparing their versions against public vulnerability databases like the National Vulnerability Database (NVD) or OWASP Dependency-Check. SAST (Static Application Security Testing) analyzes custom source code for security flaws but cannot inspect external libraries that are often pulled in via package managers (e.g., npm, Maven, pip). Including SCA ensures that the organization addresses supply chain risks, which is a primary goal in DevSecOps pipelines.

Answer

To detect insecure runtime behavior

Answer

To reduce false positives identified by SAST

Answer

To scan for vulnerabilities in custom APIs

Question 13

Which TWO of the following are secure coding practices that help prevent injection attacks?

Accepted Answer

Using parameterized queries for database calls. Parameterized queries (also known as prepared statements) separate SQL logic from data by using placeholders (e.g., `?` in MySQLi or `:param` in PDO). The database driver treats the user-supplied values strictly as data, never as executable code, which prevents an attacker from injecting malicious SQL commands even if the input contains special characters like `' OR 1=1 --`.

Answer

Printing stack traces in production error messages

Answer

Using stored procedures exclusively

Answer

Storing user passwords in plaintext

Question 14

Which THREE of the following are common challenges in securing serverless applications?

Accepted Answer

Insecure handling of event source inputs. Serverless functions rely on event-driven architectures where inputs from sources like HTTP requests, database changes, or message queues are processed directly. If these inputs are not properly validated and sanitized, attackers can inject malicious payloads (e.g., SQL injection, command injection) that execute within the function's runtime, leading to data breaches or unauthorized actions. This is a primary attack vector unique to serverless, as the function code directly consumes untrusted data without traditional perimeter defenses.

Answer

Lack of control over the underlying kernel and OS

Answer

Difficulty in applying stateful firewall rules

Question 15

Which THREE of the following are effective controls to secure a RESTful API in the cloud?

Accepted Answer

Implementing rate limiting and throttling. Rate limiting and throttling are effective controls for RESTful APIs because they prevent abuse by limiting the number of requests a client can make within a specified time window, mitigating denial-of-service (DoS) attacks and brute-force attempts. In cloud environments, these controls are often implemented at the API gateway or load balancer level using token bucket or leaky bucket algorithms, ensuring fair resource usage and protecting backend services from overload.

Answer

Enabling CORS (Cross-Origin Resource Sharing) for all domains

Answer

Using HTTP basic authentication over plain HTTP