CCSP Cloud Application Security Practice Test 7 — 15 Questions

Question 1

A DevOps team wants to prevent insecure code from being deployed to production. Which gate should be implemented in the CI/CD pipeline?

Accepted Answer

Automated security scanning with failure conditions. Automated security scanning with failure conditions (option A) is the correct gate because it enforces security checks directly within the CI/CD pipeline, preventing any code that fails static application security testing (SAST) or software composition analysis (SCA) from progressing to production. This shift-left approach ensures that vulnerabilities are caught before deployment, aligning with DevSecOps principles and reducing risk.

Answer

Run penetration testing after release

Answer

Dependency scanning only on weekly basis

Answer

Manual code review after deployment

Question 2

Which TWO measures are effective for securing container images in a cloud environment?

Accepted Answer

Sign images to ensure integrity. Option B is correct because cryptographically signing container images (e.g., with Docker Content Trust/Notary or Sigstore Cosign) lets the orchestrator verify image integrity and provenance, ensuring only trusted, untampered images are deployed. Option E is correct because scanning images for known CVEs in OS packages and application dependencies before deployment (using tools like Trivy, Clair, or Grype) catches vulnerabilities early and prevents shipping flawed images into production. Option A is wrong because a public registry without scanning exposes images to tampering and untracked vulnerabilities, undermining supply-chain security. Option C is wrong because relying on mutable 'latest' tags without version pinning prevents reproducibility and integrity verification, making it easy to deploy unexpected or compromised images. Option D is wrong because running containers as root violates least privilege and dramatically increases the impact of a container escape or compromise.

Answer

Store images in a public registry without scanning

Answer

Use latest tags without version pinning

Answer

Run containers with root privileges

Question 3

Which THREE are best practices for implementing secrets management in cloud applications?

Accepted Answer

Use a dedicated secrets management service. Option C is correct because a dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) centralizes storage, enforces access control via IAM policies, and provides audit logging and programmatic retrieval, which is the recommended pattern for cloud applications. Option D is correct because regularly rotating secrets limits the blast radius of a leaked credential and is a core requirement of standards like PCI DSS and NIST SP 800-57; managed services can automate rotation via Lambda or native rotation policies. Option E is correct because secrets must be encrypted at rest (e.g., AES-256 via KMS) and in transit (TLS 1.2+) to prevent exposure from compromised storage or network interception. Option A is not a best practice because embedding secrets in application logs exposes them to anyone with log access and defeats the purpose of secret confidentiality. Option B is not a best practice because storing secrets in version control repositories persists them in history, making them retrievable even after deletion and widely accessible to anyone with repo access.

Answer

Embed secrets in application logs for debugging

Answer

Store secrets in version control repositories

Question 4

Which TWO practices help protect against insecure deserialization attacks in cloud applications?

Accepted Answer

Validate serialized objects before deserialization. Option D is correct because validating serialized objects before deserialization ensures that the data being processed matches expected types, structures, and values, which prevents attackers from injecting malicious payloads that exploit deserialization logic. Option E is correct because restricting deserialization to a whitelist of allowed classes ensures that only pre-approved, safe classes can be instantiated, blocking gadget-chain attacks that rely on unexpected or dangerous classes. Option A is incorrect because allowing deserialization from untrusted sources directly enables insecure deserialization attacks. Option B is incorrect because strong encryption protects data confidentiality in transit or at rest but does not prevent malicious payloads from being deserialized after decryption. Option C is incorrect because implementing custom deserialization without validation removes the safety checks needed to reject malicious or unexpected objects.

Answer

Allow deserialization from untrusted sources

Answer

Use strong encryption for all serialized data

Answer

Implement custom deserialization without validation

Question 5

An IAM policy named S3ReadOnlyAccess has DefaultVersionId v3. What does this indicate?

Accepted Answer

The policy is currently using version v3 as the default.. The DefaultVersionId of an IAM policy indicates which version is currently active and enforced when the policy is attached to an IAM user, group, or role. Since the policy is named S3ReadOnlyAccess and has DefaultVersionId v3, version v3 is the default and is being used for access control decisions. This is the standard behavior for IAM policies in AWS, where you can have multiple versions but only one is designated as the default.

Answer

The policy is newly created.

Answer

The policy has three custom versions.

Answer

The policy cannot be attached to any entity.

Question 6

A cloud security engineer reviews this Terraform configuration for a security group. Which change is necessary to improve security?

Accepted Answer

Restrict egress to specific ports.. The default egress rule in Terraform's AWS security group allows all outbound traffic (0.0.0.0/0, all ports, all protocols). This violates the principle of least privilege. Restricting egress to only specific ports and protocols (e.g., TCP/443 for HTTPS) reduces the attack surface and prevents data exfiltration or unintended outbound connections.

Answer

Use a broader CIDR for ingress.

Answer

Change protocol to UDP.

Answer

Remove the ingress rule.

Question 7

A company develops a microservices application and wants to ensure secrets such as API keys and database credentials are not exposed in container images. Which approach best meets this requirement?

Accepted Answer

Use a secrets management service such as HashiCorp Vault to inject secrets at runtime.. A secrets management service like HashiCorp Vault allows secrets to be dynamically injected into containers at runtime, ensuring they never reside in the image. This approach decouples secrets from the application artifact, adhering to the principle of least privilege and immutable infrastructure. Vault can inject secrets via sidecar containers, init containers, or API calls, preventing exposure in image layers or configuration files.

Answer

Hardcode secrets in the application code and obfuscate with encryption.

Answer

Pass secrets as environment variables during container deployment.

Answer

Store secrets in a separate configuration file within the image.

Question 8

A SaaS application allows users to upload profile pictures. The development team wants to prevent upload of malicious files that could compromise the server. Which control is most effective?

Accepted Answer

Implement server-side antivirus scanning on all uploaded files before saving.. Server-side antivirus scanning inspects the actual file content after upload and before it is persisted or served, which is the only control here that detects malicious payloads regardless of file type or extension. It catches malware embedded in files that pass superficial checks, including polyglot files and weaponized images. Because scanning happens on the server, attackers cannot bypass it by manipulating client-side validation.

Answer

Store files in a CDN that only serves static content.

Answer

Set a maximum file size limit to 2 MB.

Answer

Restrict file uploads to only image file types by checking the file extension.

Question 9

A cloud application uses OAuth 2.0 for authorization. What is the primary purpose of using a refresh token in this flow?

Accepted Answer

To obtain a new access token when the current one expires without user interaction.. In OAuth 2.0, access tokens are short-lived by design to limit the window of compromise. A refresh token is a long-lived credential that allows the client to obtain a new access token from the authorization server without requiring the user to re-authenticate or re-consent. This enables seamless, ongoing access to protected resources while maintaining security through short-lived access tokens.

Answer

To grant the same access token indefinitely.

Answer

To authenticate the user without a password.

Answer

To store user credentials on the resource server for later use.

Question 10

An organization uses a CI/CD pipeline that automatically builds and deploys container images to a Kubernetes cluster. A security scanner flags that the base image contains a critical vulnerability. What is the best course of action to prevent vulnerable images from being deployed?

Accepted Answer

Integrate a container image scanning tool into the CI/CD pipeline that blocks builds if critical vulnerabilities are found.. Integrating a container image scanning tool directly into the CI/CD pipeline and configuring it to block the build when critical vulnerabilities are found ensures that vulnerable images never reach the Kubernetes cluster. This shift-left approach enforces security gates automatically, preventing deployment of non-compliant images without relying on manual intervention or post-deployment alerts.

Answer

Replace the base image with a minimal image like Alpine.

Answer

Manually review and patch the base image before each build.

Answer

Configure the scanner to send alerts after deployment.

Question 11

A developer wants to ensure that sensitive data in a cloud database is protected even if the database backup files are stolen. Which best practice should be implemented?

Accepted Answer

Enable transparent data encryption (TDE) with customer-managed keys for the database and its backups.. Transparent Data Encryption (TDE) with customer-managed keys encrypts the database at rest and, when properly configured, also encrypts backup files. This ensures that even if backup files are stolen, the data remains unreadable without the decryption keys, providing a strong defense against data breaches involving physical or logical theft of backups.

Answer

Restrict access to the backup files using IAM roles.

Answer

Use a virtual private cloud (VPC) to isolate the database from the internet.

Answer

Implement data tokenization for all sensitive fields.

Question 12

A cloud security engineer is reviewing the authentication mechanism for a web application. The application currently uses API keys transmitted in the URL query string. What is the primary security concern with this approach?

Accepted Answer

API keys in URLs are often logged in plaintext in server logs and browser history.. The primary security concern with transmitting API keys in URL query strings is that URLs are frequently logged in plaintext by web servers, proxies, and browsers. This means the API key can be inadvertently exposed in server access logs, browser history, and referrer headers, making it accessible to anyone with access to those logs. Even with HTTPS encrypting the data in transit, the URL itself is often logged before decryption or after encryption at the termination point, so the key remains visible in log files.

Answer

API keys in query strings are not encrypted, even with HTTPS.

Answer

API keys provide weak authentication because they are not tied to a user session.

Answer

API keys are not valid for use in query strings; they require a certificate.

Question 13

Which of the following is the best way to protect a web application from cross-site scripting (XSS) attacks?

Accepted Answer

Use a combination of input validation, output encoding, and Content Security Policy.. Cross-site scripting (XSS) attacks exploit multiple vectors, and no single defense is sufficient. Input validation prevents malicious payloads from being stored or processed, output encoding ensures that any residual dangerous characters are rendered inert in the HTML context, and Content Security Policy (CSP) provides a robust, browser-enforced layer that can block inline scripts and restrict script sources even if other defenses fail. This defense-in-depth approach aligns with the OWASP XSS prevention cheat sheet and is the recommended strategy for cloud-hosted web applications.

Answer

Encode all output that is rendered in HTML.

Answer

Implement a Content Security Policy (CSP) as the sole defense.

Answer

Validate all user input on the server side.

Question 14

A company uses a serverless architecture with AWS Lambda to process user-uploaded files. The Lambda function is triggered by an S3 bucket event. While reviewing security, the architect wants to ensure that the Lambda function cannot be invoked by unauthorized S3 buckets or accounts. What is the most secure configuration?

Accepted Answer

Configure the Lambda function's resource-based policy to grant permission only to the specific S3 bucket ARN and its owner account.. The most secure way to restrict Lambda invocation to a specific S3 bucket is to use a resource-based policy that explicitly grants the `lambda:InvokeFunction` permission only to the trusted bucket's ARN and the owning AWS account. This ensures that even if another S3 bucket or account attempts to trigger the function, the invocation is denied by the Lambda permission model, which evaluates both the resource-based policy and the caller's identity.

Answer

Use a condition in the policy that checks the source IP address.

Answer

Place the Lambda function inside a VPC with a VPC endpoint for S3.

Answer

Attach a resource-based policy that allows any S3 bucket to invoke the function.

Question 15

Which TWO of the following are considered best practices for securing containerized applications in a cloud environment?

Accepted Answer

Run containers with a non-root user.. Option A is correct because running containers with a non-root user (via the USER directive in the Dockerfile or runAsNonRoot/runAsUser in a Kubernetes securityContext) enforces least privilege, so a container breakout or compromised process cannot gain root-level access to the host or mounted resources. Option E is correct because mounting the container's root filesystem as read-only (docker run --read-only or readOnlyRootFilesystem: true in Kubernetes) prevents attackers from modifying binaries, writing malware, or persisting changes, and any needed writable paths can be explicitly mounted as tmpfs or volumes. Option B is not a best practice: enabling SSH inside a container increases the attack surface, bloats the image, and contradicts the immutable, single-process container model; administration should use docker exec, kubectl exec, or orchestration APIs instead. Option C is wrong because the 'latest' tag is mutable and non-deterministic, breaking reproducibility and potentially pulling in unvetted or vulnerable base images; images should be pinned to specific immutable digests or version tags. Option D is also wrong because bundling debugging tools enlarges the attack surface and image size; troubleshooting should be done with ephemeral debug containers or sidecars rather than shipping tools in production images.

Answer

Enable SSH inside the container for remote administration.

Answer

Use the 'latest' tag for base images to get the newest features.

Answer

Include debugging tools inside the container for troubleshooting.