CCSP Cloud Application Security Practice Test 5 — 15 Questions

Question 1

A cloud security engineer needs to ensure that a containerized application running in a Kubernetes cluster securely stores and rotates database credentials. Which is the most appropriate solution?

Accepted Answer

Use a secrets management system integrated with Kubernetes, such as HashiCorp Vault with CSI driver. HashiCorp Vault integrated with the Kubernetes CSI (Container Storage Interface) driver allows dynamic, short-lived database credentials to be injected into pods as volumes, enabling automatic rotation without application changes. This approach ensures secrets are never stored in the cluster's etcd or exposed in environment variables, aligning with the principle of least privilege and compliance requirements for credential rotation.

Answer

Store credentials as environment variables in the pod manifest

Answer

Embed credentials in the container image during build

Answer

Use Kubernetes Secrets without encryption at rest

Question 2

During a code review, a developer identifies that an application uses input from an HTTP request to generate a SQL query string. What is the primary security concern?

Accepted Answer

SQL injection. Directly concatenating user-supplied input from an HTTP request into a SQL query string allows an attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, data manipulation, or even complete database compromise. The primary security concern is SQL injection, which violates the confidentiality and integrity of cloud-hosted databases.

Answer

Buffer overflow

Answer

Insecure deserialization

Answer

Cross-site scripting (XSS)

Question 3

An organization deploys a serverless application using AWS Lambda functions that access an RDS database. Which practice best ensures that the database credentials are protected?

Accepted Answer

Use AWS Systems Manager Parameter Store with KMS encryption and IAM roles. AWS Systems Manager Parameter Store, combined with AWS KMS for encryption and IAM roles for access control, provides a secure, auditable, and managed way to store and retrieve database credentials. This approach avoids embedding secrets in code or environment variables, and it integrates natively with AWS Lambda via the IAM execution role, ensuring that only authorized functions can decrypt and access the credentials.

Answer

Store credentials in the function code

Answer

Hardcode credentials in environment variables

Answer

Use database temporary tokens generated on the fly

Question 4

Which of the following is a key benefit of using a software composition analysis (SCA) tool in a cloud application security program?

Accepted Answer

Detects known vulnerabilities in open-source libraries. SCA tools automate the identification of open-source components within a codebase and cross-reference them against databases like the National Vulnerability Database (NVD) to detect known vulnerabilities (CVEs). This is a key benefit because cloud applications often heavily rely on open-source libraries, and SCA provides a scalable way to manage that risk without manual auditing.

Answer

Enforces runtime policies

Answer

Simulates attacks on running applications

Answer

Identifies vulnerabilities in proprietary code

Question 5

A company wants to enforce that all API calls to its cloud services are authenticated and authorized. Which design pattern should be implemented?

Accepted Answer

Implement OAuth 2.0 with scopes. OAuth 2.0 with scopes is the correct design pattern because it provides a standardized, token-based authorization framework that allows fine-grained access control to API resources. Scopes define specific permissions (e.g., read, write) and are validated by the resource server, ensuring that each API call is both authenticated (via the access token) and authorized (via the scopes). This aligns with the principle of least privilege and is widely adopted for securing cloud APIs.

Answer

Use API keys with IP whitelisting

Answer

Allow basic authentication over HTTPS

Answer

Use shared secrets with HMAC

Question 6

A security auditor is reviewing a cloud application's data encryption strategy. The application stores sensitive data in a cloud database. Which configuration would best ensure data confidentiality in the event of a database dump?

Accepted Answer

Column-level encryption using application-managed keys. Column-level encryption with application-managed keys ensures that even if the entire database is dumped, the sensitive columns remain encrypted and unreadable without the keys held by the application. This approach decouples key management from the cloud provider, preventing the provider from accessing the plaintext data and maintaining confidentiality during a breach or dump.

Answer

Tokenization of sensitive fields with a separate token vault

Answer

Entire database encryption at rest using cloud provider managed keys

Answer

Transport layer security for all connections

Question 7

A DevOps team wants to prevent insecure code from being deployed to production. Which gate should be implemented in the CI/CD pipeline?

Accepted Answer

Automated security scanning with failure conditions. Automated security scanning with failure conditions (option A) is the correct gate because it enforces security checks directly within the CI/CD pipeline, preventing any code that fails static application security testing (SAST) or software composition analysis (SCA) from progressing to production. This shift-left approach ensures that vulnerabilities are caught before deployment, aligning with DevSecOps principles and reducing risk.

Answer

Run penetration testing after release

Answer

Dependency scanning only on weekly basis

Answer

Manual code review after deployment

Question 8

Which TWO measures are effective for securing container images in a cloud environment?

Accepted Answer

Sign images to ensure integrity. Signing container images (e.g., using Docker Content Trust or Notary) ensures integrity and authenticity by cryptographically verifying that the image has not been tampered with since it was signed. This prevents man-in-the-middle attacks and the deployment of malicious images, which is a critical security measure in cloud environments where images are pulled from remote registries.

Answer

Store images in a public registry without scanning

Answer

Use latest tags without version pinning

Answer

Run containers with root privileges

Question 9

Which THREE are best practices for implementing secrets management in cloud applications?

Accepted Answer

Use a dedicated secrets management service. Dedicated secrets management services (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) provide centralized, auditable, and policy-controlled storage for secrets like API keys and database credentials. These services enforce encryption at rest (e.g., using envelope encryption with AWS KMS) and in transit (TLS 1.2+), and support automatic rotation, reducing the risk of exposure compared to ad-hoc methods.

Answer

Embed secrets in application logs for debugging

Answer

Store secrets in version control repositories

Question 10

Which TWO practices help protect against insecure deserialization attacks in cloud applications?

Accepted Answer

Validate serialized objects before deserialization. Validating serialized objects before deserialization ensures that the data conforms to expected schemas and constraints, preventing malicious payloads from triggering arbitrary code execution. This practice is critical in cloud applications where deserialization of user-supplied data (e.g., JSON or XML) can lead to remote code execution (RCE) or denial-of-service (DoS) attacks if not validated.

Answer

Allow deserialization from untrusted sources

Answer

Use strong encryption for all serialized data

Answer

Implement custom deserialization without validation

Question 11

An IAM policy named S3ReadOnlyAccess has DefaultVersionId v3. What does this indicate?

Accepted Answer

The policy is currently using version v3 as the default.. The DefaultVersionId of an IAM policy indicates which version is currently active and enforced when the policy is attached to an IAM user, group, or role. Since the policy is named S3ReadOnlyAccess and has DefaultVersionId v3, version v3 is the default and is being used for access control decisions. This is the standard behavior for IAM policies in AWS, where you can have multiple versions but only one is designated as the default.

Answer

The policy is newly created.

Answer

The policy has three custom versions.

Answer

The policy cannot be attached to any entity.

Question 12

An architect reviews this S3 bucket policy. What security concern should be raised?

Accepted Answer

The policy grants access to all users from the specified IP range.. The policy grants s3:GetObject access to all users (Principal: "*") from the specified IP range, which means any unauthenticated user on the internet within that IP range can read objects in the bucket. This violates the principle of least privilege and exposes data to potential unauthorized access, as the policy does not require authentication or additional authorization checks.

Answer

The policy allows s3:GetObject from any source.

Answer

The policy allows s3:GetObject only to the specific bucket.

Answer

The policy does not restrict access to authenticated users.

Question 13

A cloud security engineer reviews this Terraform configuration for a security group. Which change is necessary to improve security?

Accepted Answer

Restrict egress to specific ports.. The default egress rule in Terraform's AWS security group allows all outbound traffic (0.0.0.0/0, all ports, all protocols). This violates the principle of least privilege. Restricting egress to only specific ports and protocols (e.g., TCP/443 for HTTPS) reduces the attack surface and prevents data exfiltration or unintended outbound connections.

Answer

Use a broader CIDR for ingress.

Answer

Change protocol to UDP.

Answer

Remove the ingress rule.

Question 14

A company develops a microservices application and wants to ensure secrets such as API keys and database credentials are not exposed in container images. Which approach best meets this requirement?

Accepted Answer

Use a secrets management service such as HashiCorp Vault to inject secrets at runtime.. A secrets management service like HashiCorp Vault allows secrets to be dynamically injected into containers at runtime, ensuring they never reside in the image. This approach decouples secrets from the application artifact, adhering to the principle of least privilege and immutable infrastructure. Vault can inject secrets via sidecar containers, init containers, or API calls, preventing exposure in image layers or configuration files.

Answer

Hardcode secrets in the application code and obfuscate with encryption.

Answer

Pass secrets as environment variables during container deployment.

Answer

Store secrets in a separate configuration file within the image.

Question 15

During a security review, a cloud security architect discovers that a PaaS database service has public network access enabled. The application team claims they need it for external integrations. What is the most secure alternative to allow necessary access?

Accepted Answer

Use Azure Private Link or AWS PrivateLink to connect via private IP within the cloud network.. Azure Private Link or AWS PrivateLink creates a private endpoint within the cloud network, allowing the database to be accessed privately without public internet exposure. This is the most secure alternative as it eliminates the attack surface of a public IP. Option A is incorrect because encryption does not prevent public access; it only protects data confidentiality. Option C is incorrect because moving to a VM-hosted instance introduces additional management overhead and may still require public access depending on configuration. Option D is a less secure alternative because IP whitelisting still exposes the database to the public internet, and IP addresses can be spoofed or change.

Answer

Encrypt all data at rest and in transit to the database.

Answer

Move the database to a VM-hosted instance with a VPN connection.

Answer

Restrict public access using IP whitelisting to only required external IPs.