CCSP Cloud Application Security Practice Test 6 — 15 Questions

Question 1

A security team is reviewing a cloud application's CI/CD pipeline. They want to ensure that only approved open-source libraries are used in production builds. Which approach best addresses this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a software composition analysis (SCA) tool in the pipeline. A Software Composition Analysis (SCA) tool is specifically designed to automatically scan open-source libraries for known vulnerabilities, licensing issues, and version compliance. By integrating SCA into the CI/CD pipeline, the team can enforce a policy that only approved libraries (e.g., those passing a security and license review) are allowed in production builds, blocking unapproved or vulnerable components before deployment.

Answer

Segment the build network to limit internet access

Answer

Perform static code analysis after each build

Answer

Require manual approval for all library updates

Question 2

An organization uses a multi-cloud architecture with applications running on both AWS and Azure. They need to implement a secrets management solution that works across both platforms and supports automated rotation. Which approach best meets these requirements?

Accepted Answer

Deploy HashiCorp Vault as a centralized secrets manager. HashiCorp Vault is a platform-agnostic secrets management solution that runs on any cloud or on-premises environment, supports dynamic secrets, and provides automated secret rotation via leases and rotation policies. It is the only option that natively spans AWS and Azure with consistent APIs and automated rotation.

Answer

Store secrets as encrypted environment variables in each environment

Answer

Use Azure Key Vault with a federation bridge to AWS

Answer

Use AWS Secrets Manager for all secrets

Question 3

A security engineer is investigating an incident where an attacker exploited a server-side request forgery (SSRF) vulnerability in a cloud application. The application runs in a cloud environment and uses internal metadata endpoints. Which mitigation should be prioritized to prevent future SSRF attacks?

Accepted Answer

Restrict outbound network access from the application instances using network security controls. Restricting outbound network access from application instances using security groups directly prevents the application from reaching internal metadata endpoints and other internal services. This is a fundamental network-layer control that stops SSRF attacks at the source, regardless of input validation or request inspection, by blocking the outbound traffic that the attacker would exploit.

Answer

Implement input validation to block malicious URLs

Answer

Deploy a web application firewall (WAF) to inspect outgoing requests

Answer

Require token-based authentication for metadata service access

Question 4

A company is adopting a serverless architecture using AWS Lambda. The security team is concerned about potential injection attacks via event payloads. Which practice is most effective at mitigating such attacks?

Accepted Answer

Validate and sanitize all input data from event sources. Serverless functions like AWS Lambda are directly invoked by event payloads, and without input validation and sanitization, an attacker can inject malicious code (e.g., SQL, NoSQL, OS commands) that the function executes. This is the most effective mitigation as it addresses the root cause at the application layer, regardless of any perimeter controls.

Answer

Use a web application firewall (WAF) in front of the API Gateway

Answer

Assign the least privilege IAM role to each Lambda function

Answer

Encrypt environment variables containing sensitive configuration

Question 5

A cloud application uses containers orchestrated by Kubernetes. The security team wants to enforce that containers cannot run as root and that file systems are read-only at runtime. Which Kubernetes security context configuration should be applied?

Accepted Answer

Configure a SecurityContext with runAsNonRoot: true and readOnlyRootFilesystem: true. Kubernetes SecurityContext allows fine-grained control over container permissions at the pod or container level. Setting `runAsNonRoot: true` ensures the container cannot run as UID 0, and `readOnlyRootFilesystem: true` mounts the container's root filesystem as read-only, preventing unauthorized writes at runtime. This directly satisfies the security team's requirements without relying on external policies or image-level configurations.

Answer

Use a RuntimeClass that disables root capabilities

Answer

Set the container's user to a non-root user in the Dockerfile

Answer

Apply a PodSecurityPolicy that blocks privileged containers

Question 6

A cloud application uses a RESTful API that handles payment transactions. The security team identifies that the API is vulnerable to brute-force attacks on the authentication endpoint. Which control should be implemented to mitigate this?

Accepted Answer

Implement rate limiting on the authentication endpoint. Rate limiting restricts the number of authentication requests from a single source within a given time window, directly mitigating brute-force attacks by making it infeasible to guess credentials at high speed. This control is specifically designed for authentication endpoints where repeated failed attempts are the primary attack vector, and it is a standard recommendation in OWASP and NIST guidelines for API security.

Answer

Require API keys for all requests

Answer

Use TLS to encrypt the communication channel

Answer

Add input validation for all parameters

Question 7

An organization uses infrastructure as code (IaC) to deploy cloud resources. The security team wants to prevent misconfigurations such as open security groups from being deployed. Which two practices should be integrated into the IaC pipeline? (Select TWO)

Accepted Answer

Implement policy-as-code to enforce security rules. Policy-as-code (D) allows security rules to be defined in a machine-readable format (e.g., using Open Policy Agent or HashiCorp Sentinel) and automatically evaluated during the IaC pipeline, preventing non-compliant configurations from being deployed. Automated security scanning tools (E) analyze IaC templates (e.g., Terraform, CloudFormation) for known misconfigurations, such as overly permissive security group rules, before they reach production. Together, these practices enforce security guardrails early in the development lifecycle.

Answer

Limit access to the cloud management console

Answer

Perform manual code reviews for every change

Answer

Segment the network using security groups

Question 8

A cloud application uses a service mesh for inter-service communication. The security team wants to enforce mutual TLS (mTLS) between all services and ensure that service identities are verified. What is the most effective way to achieve this?

Accepted Answer

Use the service mesh's built-in mTLS and certificate management. The service mesh's built-in mTLS and certificate management is the most effective approach because it provides automatic, transparent mutual TLS encryption and identity verification at the application layer, using X.509 certificates issued by the mesh's certificate authority (e.g., Istio's Citadel or Linkerd's identity controller). This ensures that every inter-service communication is authenticated and encrypted without requiring changes to application code, and it integrates directly with the service mesh's identity model (e.g., Kubernetes service accounts).

Answer

Set up Kerberos authentication between services

Answer

Configure a VPN between all service subnets

Answer

Implement IPsec in the network layer

Question 9

A security architect is designing access controls for a cloud-based microservices application. Which approach best aligns with the principle of least privilege for service-to-service authentication?

Accepted Answer

Implement mutual TLS with unique certificates per service. Mutual TLS (mTLS) with unique certificates per service enforces least privilege by ensuring each microservice authenticates with a distinct identity, and access can be scoped to specific certificates. This prevents a compromised service from impersonating others, as each service has its own private key and certificate, and the TLS handshake requires both sides to present and validate certificates.

Answer

Use long-lived bearer tokens

Answer

Assign IAM roles with broad permissions

Answer

Use a shared API key across all services

Question 10

A development team is migrating a legacy application to the cloud. Which security testing approach should be adopted early in the CI/CD pipeline to catch vulnerabilities as code is written?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) analyzes source code, bytecode, or binary code without executing the application, making it ideal for integration early in the CI/CD pipeline to catch vulnerabilities like SQL injection, buffer overflows, and XSS as code is written. This 'white-box' approach provides immediate feedback to developers, aligning with the shift-left security principle for cloud-native development.

Answer

Dynamic application security testing (DAST)

Answer

Penetration testing

Answer

Runtime application self-protection (RASP)

Question 11

A cloud security engineer needs to ensure that a containerized application running in a Kubernetes cluster securely stores and rotates database credentials. Which is the most appropriate solution?

Accepted Answer

Use a secrets management system integrated with Kubernetes, such as HashiCorp Vault with CSI driver. HashiCorp Vault integrated with the Kubernetes CSI (Container Storage Interface) driver allows dynamic, short-lived database credentials to be injected into pods as volumes, enabling automatic rotation without application changes. This approach ensures secrets are never stored in the cluster's etcd or exposed in environment variables, aligning with the principle of least privilege and compliance requirements for credential rotation.

Answer

Store credentials as environment variables in the pod manifest

Answer

Embed credentials in the container image during build

Answer

Use Kubernetes Secrets without encryption at rest

Question 12

During a code review, a developer identifies that an application uses input from an HTTP request to generate a SQL query string. What is the primary security concern?

Accepted Answer

SQL injection. Directly concatenating user-supplied input from an HTTP request into a SQL query string allows an attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, data manipulation, or even complete database compromise. The primary security concern is SQL injection, which violates the confidentiality and integrity of cloud-hosted databases.

Answer

Buffer overflow

Answer

Insecure deserialization

Answer

Cross-site scripting (XSS)

Question 13

An organization deploys a serverless application using AWS Lambda functions that access an RDS database. Which practice best ensures that the database credentials are protected?

Accepted Answer

Use AWS Systems Manager Parameter Store with KMS encryption and IAM roles. AWS Systems Manager Parameter Store, combined with AWS KMS for encryption and IAM roles for access control, provides a secure, auditable, and managed way to store and retrieve database credentials. This approach avoids embedding secrets in code or environment variables, and it integrates natively with AWS Lambda via the IAM execution role, ensuring that only authorized functions can decrypt and access the credentials.

Answer

Store credentials in the function code

Answer

Hardcode credentials in environment variables

Answer

Use database temporary tokens generated on the fly

Question 14

Which of the following is a key benefit of using a software composition analysis (SCA) tool in a cloud application security program?

Accepted Answer

Detects known vulnerabilities in open-source libraries. SCA tools automate the identification of open-source components within a codebase and cross-reference them against databases like the National Vulnerability Database (NVD) to detect known vulnerabilities (CVEs). This is a key benefit because cloud applications often heavily rely on open-source libraries, and SCA provides a scalable way to manage that risk without manual auditing.

Answer

Enforces runtime policies

Answer

Simulates attacks on running applications

Answer

Identifies vulnerabilities in proprietary code

Question 15

A company wants to enforce that all API calls to its cloud services are authenticated and authorized. Which design pattern should be implemented?

Accepted Answer

Implement OAuth 2.0 with scopes. OAuth 2.0 with scopes is the correct design pattern because it provides a standardized, token-based authorization framework that allows fine-grained access control to API resources. Scopes define specific permissions (e.g., read, write) and are validated by the resource server, ensuring that each API call is both authenticated (via the access token) and authorized (via the scopes). This aligns with the principle of least privilege and is widely adopted for securing cloud APIs.

Answer

Use API keys with IP whitelisting

Answer

Allow basic authentication over HTTPS

Answer

Use shared secrets with HMAC