CCSP Cloud Application Security Practice Test 7 — 15 Questions

Question 1

A company uses a cloud-based identity provider for single sign-on. An application needs to verify the user's identity without storing credentials. Which token type should the application validate?

Accepted Answer

SAML assertion. A SAML assertion is the correct choice because it is specifically designed for single sign-on (SSO) scenarios where an identity provider (IdP) authenticates a user and issues a signed XML token containing the user's identity and attributes. The application validates the assertion's signature and trust relationship with the IdP, verifying the user's identity without ever storing or handling credentials. This aligns with the cloud-based identity provider model described in the question.

Answer

JWT

Answer

Kerberos ticket

Answer

OAuth access token

Question 2

During a security audit, it is discovered that a cloud application's API endpoints are vulnerable to injection attacks. Which defense in depth measure would be most effective in preventing such attacks?

Accepted Answer

Prepared statements in code. Prepared statements (parameterized queries) are the most effective defense against injection attacks because they separate SQL logic from user input, ensuring that input is treated as data only, never as executable code. This prevents attackers from manipulating query syntax, regardless of the input content. In cloud applications, this is a foundational secure coding practice that addresses the root cause of injection vulnerabilities at the application layer.

Answer

Web application firewall (WAF)

Answer

Rate limiting

Answer

Regular expression input validation

Question 3

A team is adopting DevSecOps. Which practice best integrates security into the development lifecycle?

Accepted Answer

Automated security testing in CI/CD pipeline. Automated security testing in the CI/CD pipeline (Option C) is the correct practice because it embeds security checks—such as static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA)—directly into the build and deployment process. This ensures that vulnerabilities are detected and remediated early, aligning with the DevSecOps principle of 'shifting left' and enabling continuous security validation without slowing down development velocity.

Answer

Security awareness training

Answer

Annual penetration testing

Answer

Manual code review before release

Question 4

A cloud application uses customer-managed encryption keys (CMK) stored in a cloud HSM. The application needs to decrypt data on demand. How should the key be accessed?

Accepted Answer

Use a key management service with IAM permissions. Option B is correct because cloud key management services (e.g., AWS KMS, Azure Key Vault) allow you to use customer-managed keys (CMK) stored in a cloud HSM without ever exposing the plaintext key to the application. The application calls the KMS API with IAM permissions to request decryption, and the HSM performs the decryption inside its hardware boundary, returning only the decrypted data. This ensures the key material never leaves the HSM's secure enclave, maintaining the security posture required for CMK usage.

Answer

Use the HSM to decrypt without exposing the key

Answer

Store the key in application configuration

Answer

Copy the key to the application's memory

Question 5

Which TWO best practices help secure a cloud application's runtime environment?

Accepted Answer

Use immutable infrastructure. Immutable infrastructure ensures that once a cloud application's runtime environment is deployed, it is never modified in place. Any change requires building a new image and redeploying, which eliminates configuration drift, reduces the attack surface, and prevents unauthorized modifications from persisting. This directly secures the runtime environment by enforcing a known-good state at all times.

Answer

Implement host-based intrusion detection

Answer

Enable automatic patching of dependencies

Answer

Use container orchestration platform

Question 6

Which TWO are effective strategies for securing cloud application data at rest?

Accepted Answer

File-level encryption. File-level encryption (C) encrypts individual files or directories, ensuring that data at rest remains protected even if the underlying storage is compromised. This is a direct data-at-rest security control because it applies cryptographic protection to the data itself, independent of the storage layer. Transparent data encryption (D) encrypts data at the database level, typically at the page or file level, without requiring changes to the application, making it another effective strategy for securing data at rest.

Answer

Role-based access control

Answer

Database activity monitoring

Answer

Network segmentation

Question 7

Which THREE are key considerations when designing a secure software development lifecycle (SSDLC) for cloud applications?

Accepted Answer

Static code analysis during development. Static code analysis (SAST) is a key SSDLC practice because it automatically scans source code for security vulnerabilities (e.g., SQL injection, buffer overflows) during the development phase, enabling early remediation before code is deployed. This aligns with the 'shift left' principle, reducing the cost and effort of fixing flaws later in the lifecycle.

Answer

Security testing in production

Answer

Using a single cloud provider

Question 8

Refer to the exhibit. A developer reports that users are being denied access to a cloud application. The error log shows the above. What is the most likely cause of the denial?

Accepted Answer

The token's expiration time has passed. The error log indicates that the token's expiration time has passed, which is a standard validation check in OAuth 2.0 and OpenID Connect (OIDC) flows. When a token's `exp` claim is less than the current server time, the authorization server or resource server rejects the request with an 'access denied' or similar error. This is the most direct cause of the denial shown in the exhibit.

Answer

The token was issued by an untrusted issuer

Answer

The token lacks required permissions

Answer

The token's signature is invalid

Question 9

A company runs a multi-tier cloud application with a web frontend, an API layer, and a database. The application uses OAuth 2.0 for authentication. Recently, users have been experiencing session hijacking attacks. Upon investigation, the security team finds that session tokens are being intercepted in transit. The application uses HTTPS for all communications, but a developer discovers that the application is also accessible via HTTP due to a misconfiguration. The team wants to implement additional security controls to prevent token theft. Which course of action should be taken first?

Accepted Answer

Implement HTTP Strict Transport Security (HSTS) to enforce HTTPS connections. The root cause is that the application is accessible via HTTP due to a misconfiguration, allowing session tokens to be intercepted in transit despite HTTPS being available. Implementing HTTP Strict Transport Security (HSTS) forces the browser to always use HTTPS, preventing any HTTP connections and thus eliminating the interception vector. This directly addresses the misconfiguration before other controls, which would only mitigate but not prevent the theft.

Answer

Use IP address binding for session tokens

Answer

Switch from OAuth to SAML for authentication

Answer

Shorten the session token expiration time

Question 10

A financial organization is migrating a critical application to a cloud environment. The application processes sensitive customer data and must comply with PCI DSS. The security architect proposes using serverless functions for the compute layer. Which security control is essential to protect the application from injection attacks?

Accepted Answer

Use parameterized queries in the functions' database calls. Injection attacks (e.g., SQL injection) exploit untrusted input that is concatenated into database queries. Parameterized queries (prepared statements) separate SQL logic from data, ensuring user input is treated as data only, not executable code. This is the foundational control for preventing injection in serverless functions that interact with databases, as required by PCI DSS Requirement 6.5.1.

Answer

Enable function-level logging for audit trails

Answer

Encrypt all data in transit between functions

Answer

Implement a web application firewall (WAF) in front of the functions

Question 11

A company uses a cloud-based CI/CD pipeline with GitLab. Developers push code to a repository, triggering a build. The security team notices that sensitive API keys are being logged in build output. Which practice best prevents this?

Accepted Answer

Implement a secrets detection tool in the pipeline. A secrets detection tool (e.g., GitLab Secret Detection, TruffleHog, or Gitleaks) scans code and build output for patterns matching API keys, tokens, or passwords before they are logged or stored. This directly prevents sensitive credentials from appearing in build logs, which is the specific issue described. Unlike other options, it actively identifies and blocks secrets at the point of exposure.

Answer

Use environment variables in the pipeline configuration

Answer

Use a separate build server

Answer

Encrypt the Git repository

Question 12

A security architect is designing a cloud-native application using microservices. They decide to implement mutual TLS (mTLS) for service-to-service communication in a Kubernetes cluster with hundreds of services. What is the primary challenge in managing mTLS certificates in this dynamic environment?

Accepted Answer

Certificate revocation and rotation. In a dynamic Kubernetes environment with hundreds of microservices, mTLS certificates must be frequently rotated and revoked to maintain security, especially as services scale up/down and pods are replaced. Manual certificate management is impractical, so automated solutions like SPIFFE/SPIRE or Istio’s Citadel are required to handle the lifecycle at scale. The primary challenge is not the encryption overhead but the operational complexity of ensuring every service has a valid, non-expired certificate and that compromised certificates can be promptly revoked across the mesh.

Answer

High latency due to encryption overhead

Answer

Incompatibility with HTTP/2

Answer

Increased complexity in load balancer configuration

Question 13

A security team is reviewing controls for a cloud application that transmits personally identifiable information (PII) over the internet. Which TWO controls are essential for protecting data in transit?

Accepted Answer

Use of signed certificates from a trusted CA. Signed certificates from a trusted Certificate Authority (CA) are essential for authenticating the server's identity and establishing a chain of trust. Without them, a client cannot verify that it is communicating with the legitimate server, making the connection vulnerable to man-in-the-middle (MITM) attacks. This is a foundational requirement for any secure communication channel over the internet.

Answer

Regular penetration testing

Answer

Implementation of IPsec VPNs

Answer

Encryption at rest using AES-256

Question 14

A cloud application uses AWS Lambda functions in a serverless architecture. The security team wants to enforce least privilege access for these functions. Which THREE practices should be implemented?

Accepted Answer

Use AWS Parameter Store or Secrets Manager for sensitive data. AWS Parameter Store or Secrets Manager are correct because they provide secure, auditable storage for sensitive data like database credentials and API keys. Lambda functions can retrieve these values at runtime via the AWS SDK, avoiding hard-coded secrets in code or environment variables. This aligns with the principle of least privilege by granting the Lambda IAM role only the specific permissions needed to access the secret, not the secret value itself in plaintext.

Answer

Store secrets in Lambda environment variables encrypted with KMS

Answer

Use a single IAM role for all Lambda functions for simplicity

Question 15

A fintech startup deploys a customer-facing web application on Azure App Service. The application uses OAuth 2.0 with Azure AD for authentication. Recently, users report being logged out unexpectedly during active sessions. Security logs show multiple token refresh attempts failing with 'invalid_grant' errors. The application uses a standard library for token management. What is the most likely cause and recommended action?

Accepted Answer

The access token and refresh token lifetimes are misconfigured; align token lifetimes. The 'invalid_grant' error during token refresh typically indicates that the refresh token has expired or been revoked. In Azure AD, refresh token lifetimes are configurable and, if set too short or misaligned with the access token lifetime, users will be logged out unexpectedly when the refresh token expires before a new access token is requested. The standard library correctly handles the OAuth 2.0 flow, but the token lifetime configuration in the Azure AD app registration is the root cause.

Answer

The Azure AD API is throttling requests; implement exponential backoff

Answer

The authorization code was reused; implement PKCE to prevent reuse

Answer

The user consent was revoked; advise users to re-consent