CCSP Cloud Application Security Practice Test 9 — 15 Questions

Question 1

A cloud security architect is designing a CI/CD pipeline for a containerized application. The requirement is that container images be cryptographically signed by the build system and that only images with valid signatures be admitted to the production Kubernetes cluster. Which combination of controls best achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sign images with a key managed by the build system and enforce signature verification with an admission controller that rejects unsigned images.. Meeting the requirement needs two complementary controls: cryptographic signing at build time to prove provenance, and admission-time verification to reject unsigned or tampered images. Scanning, registry access controls, and caching address different concerns and cannot enforce signature validity when pods are scheduled.

Answer

Store images in a private registry and restrict registry access using IAM policies.

Answer

Scan images for vulnerabilities during the build and block the pipeline if critical findings are detected.

Answer

Enable image layer caching in the build system to speed up builds and reduce exposure to tampering.

Question 2

A cloud team is building a web application that stores user session tokens in the browser. A security review recommends that the tokens be inaccessible to JavaScript to reduce the impact of cross-site scripting attacks. Which cookie attribute should be set on the session token?

Accepted Answer

HttpOnly. HttpOnly instructs the browser to hide the cookie from client-side scripts, so a cross-site scripting vulnerability cannot directly exfiltrate the session token. Secure, SameSite, and Domain attributes address transport, cross-site request behaviour, and scope respectively, but none prevents script access.

Answer

Secure

Answer

SameSite=Strict

Answer

Domain

Question 3

A cloud-native application team is adopting a secrets management service to eliminate hardcoded credentials in source code and configuration files. Which two practices best align with secure secrets management in the cloud? (Choose two.)

Accepted Answer

Enable automatic rotation of secrets on a defined schedule and update dependent applications through the secrets manager.. Secure secrets management favours dynamic, identity-based retrieval and routine rotation over static storage. Workload identity removes static credentials, and automatic rotation limits exposure windows; environment variables, encrypted secrets in repositories, and embedded secrets all retain long-lived or broadly accessible copies.

Answer

Commit encrypted secrets to the source repository so they are version-controlled alongside application code.

Answer

Store secrets in environment variables injected at container start to keep them out of the image.

Answer

Embed secrets in the container image and rely on image scanning to detect accidental exposure.

Question 4

A cloud security engineer is reviewing the security posture of a web application deployed on AWS. The application uses an Application Load Balancer (ALB) and EC2 instances. The engineer wants to ensure that all incoming traffic is encrypted in transit. Which action should the engineer take?

Accepted Answer

Configure the ALB to use an HTTPS listener with an ACM certificate and redirect HTTP to HTTPS.. To encrypt incoming traffic, the Application Load Balancer must terminate TLS using an HTTPS listener with a valid certificate from AWS Certificate Manager. Redirecting HTTP to HTTPS ensures all clients use encryption. This secures data in transit from clients to the ALB, meeting the requirement.

Answer

Use AWS Shield Advanced to protect the application from DDoS attacks.

Answer

Enable encryption at rest on the EC2 instance volumes using AWS KMS.

Answer

Configure a security group on the EC2 instances to allow only HTTPS traffic from the ALB.

Question 5

A cloud application uses an API gateway to expose backend microservices. The security team wants to ensure that clients cannot bypass the gateway and call backend services directly. Which control should be implemented to enforce this?

Accepted Answer

Place the backend services in a private subnet and restrict inbound traffic to only the API gateway's security group or identity.. Enforcing that backend services accept traffic only from the API gateway requires network-level restriction, such as private subnets combined with security group or identity-based rules. Authentication, rate limiting, and logging at the gateway improve security but do not prevent a client from reaching a backend endpoint that remains exposed.

Answer

Configure rate limiting on the API gateway to prevent clients from sending excessive requests.

Answer

Enable mutual TLS on the API gateway so clients must present certificates to connect.

Answer

Enable access logging on the API gateway and forward logs to a central monitoring service.

Question 6

A cloud-native application uses a microservices architecture deployed on Kubernetes. The security team wants to ensure that only authorized services can communicate with each other, and that communication is encrypted. Which Kubernetes feature should be used to meet these requirements?

Accepted Answer

Network Policies with a service mesh like Istio for mutual TLS.. Network Policies provide segmentation by allowing or denying traffic between pods based on labels and namespaces. However, they do not encrypt traffic. A service mesh like Istio adds mutual TLS (mTLS) to encrypt all service-to-service communication and can enforce fine-grained authorization policies. Using both together ensures that only authorized services communicate and that the traffic is encrypted.

Answer

Role-Based Access Control (RBAC) to restrict which services can access the Kubernetes API.

Answer

Kubernetes Secrets to store service credentials and TLS certificates.

Answer

Pod Security Policies to enforce security contexts and prevent privileged containers.

Question 7

A healthcare SaaS provider exposes REST APIs to partner clinics. The security team must ensure that the API cannot be abused by replaying captured requests. The API already uses TLS 1.3 and OAuth 2.0 bearer tokens with short lifetimes. Which additional control best mitigates replay attacks against the API?

Accepted Answer

Require a unique nonce and timestamp in each request, validated server-side against a replay cache.. Replay attacks occur when a valid request is captured and resent. Defenses must make each request unique and single-use. A server-validated nonce plus timestamp achieves this by rejecting duplicates and expired requests. Transport security such as TLS or mTLS does not stop replay of already-authenticated application requests, and longer token lifetimes worsen exposure. HSTS is browser-focused and irrelevant to server-to-server API replay.

Answer

Enable HTTP Strict Transport Security (HSTS) with a long max-age on the API domain.

Answer

Increase the OAuth 2.0 token lifetime to reduce the frequency of token refresh calls.

Answer

Enforce mutual TLS between partner clinics and the API gateway.

Question 8

A cloud operations team is building a CI/CD pipeline that deploys container images to a managed Kubernetes cluster. Security policy requires that only images whose vulnerabilities have been scanned and approved can run. The team wants the cluster itself to refuse any pod that references an unapproved image, even if the pipeline is bypassed. Which mechanism should they implement?

Accepted Answer

Configure a Kubernetes admission controller with a policy engine, such as Open Policy Agent Gatekeeper, to reject pods referencing images that lack the approved scan attestation.. The requirement is preventive enforcement at the cluster level, independent of the deployment channel. A Kubernetes admission controller backed by a policy engine intercepts pod creation and rejects any manifest that does not carry the approved scan attestation. Registry scanning, pipeline gates, and audit alerts each leave a path for an unapproved pod to run, so they cannot satisfy the policy as written.

Answer

Enable image vulnerability scanning in the container registry and configure the registry to block pulls of images that exceed the severity threshold.

Answer

Enable Kubernetes audit logging and forward events to a SIEM so that alerts fire when pods with unapproved images are created.

Answer

Add a policy check stage to the CI/CD pipeline that fails the build when the scanned image contains vulnerabilities above the threshold.

Question 9

A retail company is migrating its monolithic e-commerce application to containers on a managed Kubernetes service. The security architect wants to ensure that if a container is compromised, the attacker cannot use the container's credentials to access the underlying node's filesystem or other pods' volumes. Which Kubernetes feature should be configured to meet this requirement?

Accepted Answer

Runtime sandboxing with gVisor or Kata Containers. The requirement is strong runtime isolation so a compromised container cannot reach the node or other pods' data. Runtime sandboxing with gVisor or Kata Containers creates a boundary beyond standard Linux namespaces and cgroups. Pod Security Admission, NetworkPolicy, and RBAC are valuable but address configuration hardening, network traffic, and API authorization respectively, not filesystem and volume isolation from the host.

Answer

Role-Based Access Control (RBAC) to limit service account permissions

Answer

NetworkPolicy to restrict pod-to-pod traffic

Answer

Pod Security Admission with the restricted profile

Question 10

A cloud team is designing a new microservices application deployed on a managed Kubernetes service. The security architect requires that all service-to-service traffic be encrypted with mutual TLS (mTLS) without modifying application code. Which cloud-native component should be implemented to meet this requirement?

Accepted Answer

A service mesh such as Istio or Linkerd. A service mesh is the correct cloud-native solution because it provides transparent mTLS between services through sidecar proxies, requiring no application code changes. It also enables fine-grained authorization and observability. Other options address perimeter security or network segmentation but do not deliver encrypted, mutually authenticated service-to-service communication inside the cluster.

Answer

An API gateway with TLS termination at the ingress

Answer

Kubernetes NetworkPolicy objects with default deny rules

Answer

A web application firewall (WAF) in front of each service

Question 11

A healthcare organization runs a multi-tenant SaaS application on a public cloud. Each tenant's data is stored in a shared database with a tenant identifier column. A penetration test shows that a crafted API request can return records belonging to another tenant. The application already authenticates users and validates their tenant membership at login. Which control most directly addresses the root cause of this finding?

Accepted Answer

Enforce tenant scoping in the data access layer by deriving the tenant identifier from the authenticated session and applying it to every query, ignoring any tenant value supplied by the client.. The penetration test demonstrates broken object-level authorization, where the API accepts a client-controlled tenant identifier and uses it to scope queries. The durable fix is to derive the tenant from the authenticated session and enforce that scope in the data access layer so client input can never widen it. WAF rules, schema separation, and mutual TLS each add defense in depth but do not correct the authorization flaw that allows cross-tenant reads.

Answer

Move each tenant's data into a separate database schema and grant the application role access only to the schema matching the authenticated tenant.

Answer

Require tenants to authenticate with mutual TLS and bind each client certificate to a tenant identifier that the API validates on every request.

Answer

Add a web application firewall rule that inspects API request bodies for tenant identifier values that differ from the authenticated user's tenant.

Question 12

A healthcare company runs a containerized patient portal on a managed Kubernetes service. Security policy requires that every container image be cryptographically verified as coming from the company's internal build pipeline before any pod is admitted to the cluster. The images are stored in a private OCI registry, and each build produces a signature using a private key held in a cloud key management service. Which mechanism should be implemented to enforce this policy at admission time?

Accepted Answer

Configure an admission controller that validates image signatures against a trusted public key and rejects pods whose images are unsigned or signed by an untrusted key.. Enforcing image provenance requires cryptographic verification at admission time, not merely scanning or network controls. An admission controller that checks signatures against a trusted public key ensures that only images signed by the internal pipeline's private key are admitted. This directly ties the cluster's admission decision to the build pipeline's signing authority, satisfying the policy while leveraging the existing KMS key infrastructure.

Answer

Enable image vulnerability scanning in the registry and configure the cluster to pull only images with a CVSS score below a defined threshold.

Answer

Use a mutating admission webhook to inject an init container that runs a checksum comparison of the image layers against a manifest stored in the registry.

Answer

Apply a network policy that restricts pod egress to only the private registry, preventing images from being pulled from any other source.

Question 13

A cloud-native payroll application stores employee bank details in a managed database. The security team wants to ensure that even if the database storage is compromised, the data cannot be read without explicit decryption. They also need to minimize changes to the application code. Which approach best meets these requirements?

Accepted Answer

Implement client-side field-level encryption using a customer-managed key (CMK) in a cloud KMS.. The team needs encryption where keys are controlled by the organization and decryption is explicit, not automatic. Client-side field-level encryption with a customer-managed key in a cloud KMS achieves this: ciphertext is stored in the database, and only holders of the CMK can decrypt. TDE, provider-managed keys, and database-native encryption with locally stored keys all leave decryption capability with the database or provider, failing the threat model.

Answer

Use database-native column encryption with keys stored in the database configuration.

Answer

Enable transparent data encryption (TDE) at the database storage layer using provider-managed keys.

Answer

Rely on the cloud provider's default encryption at rest with provider-managed keys.

Question 14

A company is migrating a legacy web application to the cloud. The application uses a relational database. The security team wants to ensure that database credentials are never hardcoded in the application and are automatically rotated. Which cloud-native approach should be used?

Accepted Answer

Use a managed secrets management service that integrates with the database to rotate credentials.. A managed secrets management service provides secure storage and automatic rotation of database credentials. The application retrieves credentials dynamically, so they are never hardcoded. This is the cloud-native best practice for secret management and meets both requirements.

Answer

Store credentials in environment variables on the application server.

Answer

Encrypt the database connection string in a configuration file.

Answer

Use a database user with a long, complex password that is changed manually every 90 days.

Question 15

A cloud security engineer is reviewing the software development lifecycle for a team building a containerized application on a public cloud. The team wants to shift security left and reduce vulnerabilities in production images. Which two practices should be implemented to achieve this? (Choose two.)

Accepted Answer

Integrate static application security testing (SAST) into the CI pipeline. Shifting security left means embedding security checks early in the development lifecycle. SAST finds code-level flaws at commit time, and container image scanning finds vulnerable packages at build time. Both prevent vulnerable artifacts from reaching production. Runtime detection, annual penetration tests, and private registries are valuable but operate after deployment or only control access, not vulnerability reduction.

Answer

Store container images in a private registry with access controls

Answer

Perform a penetration test of the production environment annually

Answer

Enable runtime threat detection in the production Kubernetes cluster