CCSP Cloud Application Security Practice Test 4 — 15 Questions

Question 1

A security architect is designing a CI/CD pipeline for a cloud-native application. The team wants to automatically scan container images for vulnerabilities before deployment. Which of the following is the most effective approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Integrate a container image scanner into the pipeline. Integrating a container image scanner into the CI/CD pipeline ensures that vulnerabilities are detected early, before the image is deployed to production. This approach automates security checks as part of the build process, aligning with DevSecOps principles by shifting security left. Tools like Trivy, Clair, or Anchore can be configured to fail the pipeline if critical vulnerabilities are found, preventing insecure images from reaching runtime.

Answer

Manually review images before each deployment

Answer

Perform vulnerability scanning at runtime using a host-based agent

Answer

Scan the network for open ports on the container hosts

Question 2

A SaaS provider uses a customer-managed encryption key (CMEK) model for data-at-rest. The provider's application runs in a multi-tenant cloud environment. Which attack surface is MOST directly mitigated by this approach?

Accepted Answer

Insider threats from cloud provider employees. A customer-managed encryption key (CMEK) model gives the customer control over the key used to encrypt data at rest. This directly mitigates the risk of a cloud provider employee accessing the plaintext data, because even if the employee has administrative access to the storage infrastructure, they cannot decrypt the data without the customer's key. The provider holds the encrypted data, but the decryption key is managed and controlled by the customer, creating a logical separation that protects against insider threats from the provider's personnel.

Answer

Misconfigured storage buckets exposing data

Answer

SQL injection vulnerabilities in the application

Answer

Side-channel attacks on shared physical hardware

Question 3

An organization is developing a mobile app that communicates with a cloud API. To ensure secure authentication, which of the following should be used?

Accepted Answer

OAuth 2.0 with OpenID Connect. OAuth 2.0 with OpenID Connect (OIDC) is the correct choice because it provides a delegated authorization framework (OAuth 2.0) combined with an identity layer (OIDC) that enables secure authentication and single sign-on (SSO) for mobile apps communicating with cloud APIs. This combination issues short-lived access tokens and ID tokens (typically JWTs) rather than exposing long-lived credentials, and supports token refresh, scoped permissions, and PKCE (Proof Key for Code Exchange) to prevent authorization code interception on mobile devices.

Answer

Session cookies for state management

Answer

Basic authentication with username and password

Answer

API keys sent in HTTP headers

Question 4

A cloud security team is implementing a Web Application Firewall (WAF) for a public-facing web application. The application uses a REST API with JSON payloads. Which of the following is the WAF's primary benefit?

Accepted Answer

Inspecting HTTP traffic for malicious payloads. A WAF operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic for malicious payloads such as SQL injection, cross-site scripting (XSS), and JSON-based attacks. For a REST API using JSON, the WAF can parse and validate the JSON structure, blocking malformed or malicious payloads before they reach the application server. This is the primary benefit because it directly protects the application logic from web-based exploits.

Answer

Scanning for data loss prevention (DLP) violations

Answer

Preventing network-layer DDoS attacks

Answer

Encrypting data in transit between client and server

Question 5

A company deploys microservices in Kubernetes. Each service communicates via gRPC with mutual TLS. A security assessment reveals that some services use self-signed certificates. What is the primary risk?

Accepted Answer

Man-in-the-middle (MITM) attacks between services. The primary risk of using self-signed certificates in a gRPC mutual TLS environment is that there is no trusted Certificate Authority (CA) to verify the identity of the communicating services. Without proper CA-signed certificates, an attacker can easily perform a man-in-the-middle (MITM) attack by presenting a forged self-signed certificate, intercepting and modifying gRPC traffic between microservices.

Answer

Inability to revoke certificates

Answer

Exposure of private keys in the container image

Answer

Increased latency due to certificate validation

Question 6

A developer is tasked with securely storing a session token in a browser-based web application. Which storage mechanism is most secure?

Accepted Answer

HTTP-only cookies with Secure and SameSite flags. HTTP-only cookies with Secure and SameSite flags are the most secure storage mechanism for session tokens because they prevent client-side script access (mitigating XSS-based token theft), ensure transmission only over HTTPS (mitigating network eavesdropping), and restrict cross-origin request inclusion (mitigating CSRF). This combination aligns with OWASP best practices for session management, as the token is never exposed to JavaScript or sent over unencrypted channels.

Answer

sessionStorage

Answer

URL query parameters

Answer

localStorage

Question 7

A company is implementing a serverless application using AWS Lambda. The function processes S3 events and writes to a DynamoDB table. Which of the following is the MOST secure way to grant the necessary permissions?

Accepted Answer

Create a custom IAM role with only the required actions on specific resources. AWS Lambda functions require an IAM role (execution role) to access other AWS services. By creating a custom IAM role with only the required actions (e.g., s3:GetObject for the specific S3 bucket and dynamodb:PutItem for the specific DynamoDB table), you adhere to the principle of least privilege, minimizing the attack surface and ensuring secure, auditable access.

Answer

Use resource-based policies on the Lambda function

Answer

Attach a managed policy that grants full access to S3 and DynamoDB

Answer

Use the root user credentials of the AWS account

Question 8

Which TWO of the following are common best practices for securing cloud application APIs? (Choose two.)

Accepted Answer

Implement rate limiting. Rate limiting is a critical best practice for securing cloud application APIs because it prevents abuse by limiting the number of requests a client can make within a specific time window. This mitigates brute-force attacks, denial-of-service (DoS) attacks, and resource exhaustion. By enforcing rate limits, the API maintains availability and protects backend services from being overwhelmed.

Answer

Disable HTTPS to reduce latency

Answer

Return detailed error messages for debugging

Answer

Allow all origins with CORS

Question 9

Which THREE of the following are essential components of a Secure Software Development Lifecycle (SSDLC) in the cloud? (Choose three.)

Accepted Answer

Static application security testing (SAST) in CI/CD. SAST tools scan source code, bytecode, or binaries for vulnerabilities like SQL injection or buffer overflows early in the development cycle. Integrating SAST into the CI/CD pipeline enables automated, continuous security checks on every commit or build, which is a core practice of a Secure Software Development Lifecycle (SSDLC) in the cloud. This shift-left approach catches flaws before they reach production, reducing remediation cost and risk.

Answer

Manual code reviews without automation

Answer

Annual penetration testing only

Question 10

Which TWO of the following are effective methods to protect against server-side request forgery (SSRF) in a cloud application? (Choose two.)

Accepted Answer

Whitelist allowed outbound destinations. Whitelisting allowed outbound destinations is a primary defense against SSRF. By explicitly permitting only trusted external hosts (e.g., specific API endpoints or internal services), the application cannot be tricked into making requests to arbitrary internal or external targets, even if an attacker controls the URL parameter.

Answer

Use SSL inspection to check for malicious payloads

Answer

Block all outbound network traffic from the application

Answer

Sanitize all user input for URL parameters

Question 11

Refer to the exhibit. A log entry shows a suspected SQL injection attack. Which security control would have prevented this attack?

Accepted Answer

Use parameterized SQL queries. SQL injection attacks exploit unsanitized user input that is concatenated into SQL queries. Parameterized queries (also known as prepared statements) separate SQL logic from data by using placeholders, ensuring that user input is always treated as data, not executable code. This prevents an attacker from injecting malicious SQL commands, regardless of the input content.

Answer

Encrypt the database connection

Answer

Implement rate limiting on the login endpoint

Answer

Enforce strong password policies

Question 12

A financial services company uses a multi-region cloud deployment for its trading application. The application consists of a web frontend, a REST API, and a relational database. Recently, a penetration test revealed that an attacker could perform a time-based blind SQL injection through the API's search functionality. The injection allows the attacker to enumerate database contents by observing response times. The development team was already aware of the issue but had prioritized other features. The security team now demands immediate remediation. The application is critical and cannot be taken offline. Which of the following is the most effective immediate action to mitigate the risk without modifying the application code?

Accepted Answer

Deploy a Web Application Firewall (WAF) with a rule to block SQL injection patterns. A WAF can inspect incoming HTTP requests and block those matching SQL injection patterns (e.g., SQL keywords, special characters) without modifying application code. Since the vulnerability is a time-based blind SQL injection, a WAF with a dedicated SQL injection rule set can immediately stop the attack vector by filtering malicious payloads at the edge, providing a virtual patch while the code fix is developed. This is the only option that directly addresses the injection vector without requiring code changes or downtime.

Answer

Implement rate limiting on the API endpoint

Answer

Enable DDoS protection on the cloud load balancer

Answer

Enable transparent data encryption (TDE) on the database

Question 13

A healthcare SaaS provider is deploying a new application that processes protected health information (PHI). The application uses a microservices architecture running on Kubernetes. Each microservice stores its data in a separate database. The compliance team requires that all data at rest be encrypted and that encryption keys be managed by the customer (CMEK). The cloud provider supports KMS with CMEK. However, the development team wants to use a single customer-managed key for all databases to simplify key management. The security architect is concerned about the blast radius if the key is compromised. Which of the following recommendations best balances security and operational efficiency?

Accepted Answer

Use a separate customer-managed key for each database, with automated key rotation. It minimizes the blast radius by ensuring that compromise of one key does not expose data in other databases, while automated key rotation reduces the window of vulnerability and operational overhead. This aligns with the principle of least privilege and the compliance requirement for customer-managed encryption keys (CMEK). Using separate keys per database is a standard security best practice for microservices architectures, especially when handling PHI.

Answer

Use the cloud provider's default encryption keys for all databases

Answer

Disable encryption to improve performance and use network segmentation instead

Answer

Use one customer-managed key for all databases, but enable automatic key rotation

Question 14

A cloud security architect is designing a CI/CD pipeline for a serverless application using AWS Lambda. The application processes sensitive user data and requires encryption at rest and in transit. Which of the following is the BEST approach to securely manage database credentials used by the Lambda function?

Accepted Answer

Use AWS Secrets Manager to store the credentials and retrieve them at runtime with least-privilege IAM roles.. AWS Secrets Manager is the best choice because it is purpose-built for securely storing, rotating, and retrieving secrets such as database credentials. It integrates natively with AWS Lambda via the Secrets Manager API, allowing the function to fetch credentials at runtime using a least-privilege IAM role. This approach avoids embedding secrets in code or configuration and supports automatic rotation, which is critical for compliance with encryption and access control requirements.

Answer

Store the credentials in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Store the credentials as encrypted environment variables in the Lambda function configuration.

Answer

Hardcode the credentials in the Lambda function code and encrypt the deployment package.

Question 15

A security team is implementing a web application firewall (WAF) for a cloud-based e-commerce application. The application is built on a microservices architecture and uses a RESTful API. Which of the following is the PRIMARY reason to deploy the WAF at the API gateway level rather than at the individual service level?

Accepted Answer

To provide centralized protection against common web exploits before traffic reaches the microservices.. Deploying the WAF at the API gateway provides a centralized security enforcement point that inspects and filters all incoming HTTP/HTTPS traffic before it is routed to any individual microservice. This ensures that common web exploits—such as SQL injection, cross-site scripting (XSS), and OWASP Top 10 attacks—are blocked at the perimeter, reducing the attack surface and preventing malicious payloads from ever reaching the internal services. It also simplifies policy management and avoids the need to configure and maintain separate WAF instances for each microservice, which would introduce operational complexity and potential gaps in coverage.

Answer

To reduce latency by caching responses at the API gateway.

Answer

To offload authentication from the microservices to the API gateway.

Answer

To monitor API usage and detect anomalies in traffic patterns.