CCNA Cloud Application Security Questions

Why this answer

How to eliminate wrong answers

Option A is wrong because standard TLS with server-side certificates only authenticates the server to the client, but does not authenticate the client (web tier) to the application tier, leaving the application tier vulnerable to unauthorized or spoofed connections. Option B is wrong because SSH tunnels provide point-to-point encryption but are designed for interactive shell access or port forwarding, not for high-throughput, persistent inter-tier service communication; they introduce management overhead and lack the certificate-based identity verification that mTLS offers for service-to-service authentication. Option D is wrong because IPsec VPN operates at the network layer and encrypts all traffic between subnets, but it is overly complex for application-layer communication, adds latency, and does not provide application-level identity verification between specific services; it is more suited for site-to-site connectivity rather than fine-grained inter-tier authentication.

Why this answer

How to eliminate wrong answers

Option A is wrong because session cookies are designed for server-side web applications with browser-based state management; mobile apps lack a browser context for cookie handling and are vulnerable to CSRF and session hijacking, making cookies unsuitable for native mobile-to-API communication. Option B is wrong because Basic authentication transmits credentials (Base64-encoded username:password) in every request, exposing them to interception and replay attacks; it offers no token expiration, no scoping, and no support for multi-factor authentication, violating cloud security best practices. Option D is wrong because API keys sent in HTTP headers are static, long-lived secrets that are easily leaked in client-side code (e.g., mobile app binaries), provide no user authentication or delegation, and lack built-in revocation mechanisms beyond key rotation.

Why this answer

How to eliminate wrong answers

Option A is wrong because while the HSM can decrypt without exposing the key, the question asks how the application should access the key; directly calling the HSM API is not the standard cloud pattern—a key management service (KMS) abstracts HSM operations and provides IAM-based access control, auditing, and key rotation. Option C is wrong because storing the key in application configuration violates the fundamental principle of CMK security—keys must never be stored in plaintext outside the HSM or KMS, as configuration files are easily exposed via misconfigurations or breaches. Option D is wrong because copying the key to the application's memory exposes the plaintext key material, defeating the purpose of using a hardware security module (HSM) and violating the 'never export the key' rule that CMK policies enforce.

Why this answer

How to eliminate wrong answers

Option A is wrong because segmenting the build network to limit internet access only restricts network connectivity, but does not prevent developers from introducing unapproved libraries already cached or stored locally; it also breaks legitimate dependency resolution from approved repositories. Option B is wrong because static code analysis (SAST) focuses on source code flaws (e.g., SQL injection, buffer overflows) and does not inspect third-party library metadata, licenses, or known CVEs in dependencies. Option D is wrong because requiring manual approval for all library updates is an operational process that does not scale, lacks automated detection of unapproved libraries, and introduces human error and delay without providing a technical enforcement gate in the pipeline.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because refresh tokens do not grant indefinite access; they can be revoked, have their own expiration, and are used to obtain new access tokens, not to extend the life of the same token. Option C is wrong because refresh tokens are not used for authentication; they are an authorization grant that assumes prior authentication has already occurred. Option D is wrong because refresh tokens are stored on the client (or client's backend), not on the resource server, and they are never used to store user credentials.

Why this answer

How to eliminate wrong answers

Option A is wrong because setting `allowPrivilegeEscalation` to true allows processes within the container to gain more privileges than their parent (e.g., via setuid binaries), which directly violates the principle of least privilege and increases risk. Option B is wrong because while using a non-root user like 2000 is good practice, the question asks for a security enhancement to add; the pod already specifies `runAsUser: 1000`, which is already non-root, so changing the UID does not address the missing read-only filesystem or other hardening gaps. Option D is wrong because using a trusted image from a private registry is a supply chain security measure, but it does not mitigate runtime attacks that modify the container's filesystem; the pod configuration shown lacks filesystem-level protection, which is the immediate gap.

Why this answer

How to eliminate wrong answers

Option A is wrong because vulnerability scanning of cloud infrastructure is typically performed by a cloud security posture management (CSPM) tool or a vulnerability scanner, not a CASB, which focuses on application-level policy enforcement and user access control. Option B is wrong because while a CASB can apply encryption for data in transit or at rest via tokenization or proxy-based encryption, its primary function is not encrypting data at rest; that is a feature of cloud storage services or dedicated encryption tools. Option C is wrong because protecting against DDoS attacks is handled by web application firewalls (WAFs) or DDoS mitigation services, not a CASB, which is designed for visibility, compliance, and access control for cloud applications.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because shared API keys embedded in configuration do not provide mutual authentication (only one-way authentication) and are vulnerable to leakage, rotation issues, and replay attacks. Option C is wrong because TLS termination at the load balancer means traffic between services is decrypted and re-encrypted, leaving internal traffic potentially unencrypted and without mutual authentication between services themselves. Option D is wrong because placing services in the same VPC with security groups restricts network access but does not provide encryption or mutual authentication for inter-service communication; it relies on network perimeter controls rather than cryptographic identity.

Why this answer

How to eliminate wrong answers

Option A is wrong because tokenization replaces sensitive data with tokens, but if the token vault is compromised or the database dump includes the token mapping, confidentiality can be broken; it does not encrypt the data itself. Option B is wrong because encryption at rest using cloud provider managed keys protects data while stored on disk, but during a database dump (which extracts data in transit or in memory), the data is decrypted by the database engine and exposed in plaintext; the provider also has access to the keys. Option D is wrong because transport layer security (TLS) only protects data in transit between client and server, not data at rest or during a database dump, which occurs after the data has been stored.

Why this answer

How to eliminate wrong answers

Option A is wrong because DLP scanning is a function of data loss prevention tools, not a WAF; a WAF does not inspect data for policy violations like credit card numbers or PII. Option B is wrong because preventing network-layer DDoS attacks (e.g., SYN floods) is the role of a network firewall or DDoS mitigation appliance, not a WAF which focuses on application-layer attacks. Option C is wrong because encrypting data in transit is the job of TLS/SSL (e.g., HTTPS), not a WAF; a WAF inspects decrypted traffic after TLS termination or uses a reverse proxy model, but it does not perform encryption itself.

Why this answer

How to eliminate wrong answers

Option A is wrong because DAST tests the running application from the outside (black-box), which requires a deployed environment and cannot catch vulnerabilities at the code-writing stage. Option B is wrong because penetration testing is a manual or automated simulated attack on a live system, performed later in the SDLC, not during development. Option C is wrong because RASP is a runtime protection technology embedded in the application runtime environment that monitors and blocks attacks in production, not a testing tool for the CI/CD pipeline.

Why this answer

How to eliminate wrong answers

Option A is wrong because an untrusted issuer would trigger an 'invalid issuer' or 'untrusted issuer' error, not a token expiration error; the issuer is validated via the `iss` claim against a pre-configured trusted issuer list. Option B is wrong because missing permissions would result in a '403 Forbidden' or 'insufficient_scope' error, not a token expiration error; permissions are checked after token validity. Option D is wrong because an invalid signature would cause a 'signature verification failed' or 'invalid token' error, not a token expiration error; signature validation occurs before expiration checks.

Why this answer

How to eliminate wrong answers

Option A is wrong because a newly created policy would have DefaultVersionId v1, not v3, as the first version is always v1. Option C is wrong because DefaultVersionId v3 does not imply there are exactly three custom versions; there could be more versions (e.g., v1, v2, v3, v4) and only v3 is set as default, or some versions may be non-default. Option D is wrong because a policy with a default version can be attached to any entity; the DefaultVersionId simply indicates which version is active, and the policy remains attachable unless explicitly restricted.

Why this answer

How to eliminate wrong answers

Option B is wrong because AWS Shield Advanced provides protection against volumetric DDoS attacks (e.g., SYN floods, UDP amplification), but it does not filter application-layer attacks like oversized payloads or high-volume requests to a specific endpoint; it also incurs significant cost and is overkill for this scenario. Option C is wrong because switching to IAM roles with temporary credentials (e.g., using AWS Signature Version 4) improves authentication security but does not mitigate the attack—the malicious user could still send large payloads and high request volumes after obtaining valid credentials. Option D is wrong because AWS WAF with a rate-based rule can block IP addresses that exceed a request threshold, but this is a reactive measure that may block legitimate users sharing the same IP (e.g., via NAT) and does not prevent the CPU impact from large payloads; it also requires additional configuration and cost.

Why this answer

How to eliminate wrong answers

Option A is wrong because checking the source IP address is ineffective for S3 event notifications, as S3 invokes Lambda via AWS internal services, not from a fixed public IP; the source IP can vary and is not a reliable control for cross-account or cross-bucket invocation. Option B is wrong because placing the Lambda function inside a VPC with a VPC endpoint for S3 controls network traffic but does not restrict which S3 buckets or accounts can invoke the function; invocation permissions are governed by IAM and resource-based policies, not network placement. Option D is wrong because allowing any S3 bucket to invoke the function violates the principle of least privilege and would permit unauthorized buckets or accounts to trigger the Lambda, leading to potential data exfiltration or abuse.

Why this answer

How to eliminate wrong answers

Option A is wrong because CloudHSM is a cloud-based HSM service that still operates as a dedicated hardware appliance, but the question asks for the service model itself, not a specific cloud vendor implementation; the generic term 'HSM' is the correct model. Option B is wrong because Key Management Service (KMS) typically uses software-based key storage and may cache keys in memory, failing to guarantee that keys are managed entirely outside the application's memory space. Option C is wrong because Trusted Platform Module (TPM) is a hardware chip integrated into the motherboard for platform integrity and local key storage, but it is not designed for scalable, external key management for cloud applications and does not isolate keys from the application's memory in the same way a dedicated HSM does.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Azure SQL Database with column-level encryption does not provide the low-latency, in-memory performance needed for session state in a horizontally scaled web application, and it introduces unnecessary database overhead and cost. Option C is wrong because storing encrypted session data as a client-side cookie violates the requirement for availability after instance failure, as the data is tied to the client and not centrally managed, and cookies have size limits (typically 4 KB) that cannot accommodate large session states. Option D is wrong because Application Gateway with cookie-based affinity (sticky sessions) pins a client to a specific instance, which prevents true horizontal scaling and does not ensure session data availability if that instance fails, as the session remains in-memory on that single server.

Why this answer

How to eliminate wrong answers

Option B is wrong because the policy does not explicitly enforce server-side encryption, but that is not the primary security concern; the question focuses on the most critical risk, which is unauthorized deletion. Option C is wrong because the policy restricts access to a specific IP range (e.g., 'aws:SourceIp': '192.0.2.0/24'), so the bucket is not publicly accessible from any IP. Option D is wrong because while MFA for delete operations is a best practice, the policy does not require it, but the core issue is that delete access is granted to a trusted IP range without any additional controls—MFA is just one possible control, and the absence of any control is the primary concern.

Why this answer

How to eliminate wrong answers

Option A is wrong because runtime security monitoring detects threats during execution, not before deployment, so it cannot prevent vulnerable images from being deployed. Option B is wrong because pre-commit hooks scan source code, not container images, and cannot detect vulnerabilities in base layers or dependencies added during the build process. Option D is wrong because an admission controller in Kubernetes can block deployment based on image policies, but it acts after the image is already built and pushed, making it a reactive control rather than a proactive integration point in the CI/CD pipeline.

Why this answer

How to eliminate wrong answers

Option A is wrong because buffer overflow exploits typically target memory corruption in low-level languages like C/C++, not SQL query string generation in application code. Option B is wrong because insecure deserialization involves untrusted data being deserialized into objects, not the direct injection of SQL syntax into a query string. Option C is wrong because cross-site scripting (XSS) involves injecting client-side scripts into web pages viewed by other users, whereas this scenario directly manipulates a server-side SQL query.

Why this answer

How to eliminate wrong answers

Option B is wrong because rate limiting only restricts the number of requests per time window, which does not prevent a single crafted SQL injection payload from executing; it merely slows down enumeration but does not block the injection itself. Option C is wrong because DDoS protection mitigates volumetric attacks aimed at overwhelming resources, not application-layer attacks like SQL injection; it does not inspect payload content. Option D is wrong because transparent data encryption (TDE) protects data at rest in the database, but the SQL injection attack exploits the API to extract data in transit or via response timing, so encryption does not prevent the injection or the data exfiltration.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because manual review is not scalable, error-prone, and cannot keep pace with the frequency of deployments in a CI/CD pipeline, violating the automation principle of secure DevOps. Option C is wrong because runtime scanning with a host-based agent detects vulnerabilities only after the container is already running, missing the opportunity to block deployment of vulnerable images and potentially exposing the environment to exploitation. Option D is wrong because scanning the network for open ports on container hosts addresses network-level exposure, not the vulnerabilities within the container image itself, and is a reactive measure unrelated to image security.

Why this answer

How to eliminate wrong answers

Option A is wrong because mTLS encryption overhead is minimal with modern hardware and optimized libraries (e.g., AES-NI, TLS 1.3), and latency is not the primary challenge in a dynamic environment. Option C is wrong because mTLS is fully compatible with HTTP/2; in fact, gRPC (which uses HTTP/2) commonly relies on mTLS for secure service-to-service communication. Option D is wrong because mTLS does not inherently increase load balancer configuration complexity; load balancers can terminate or pass-through mTLS, and the challenge lies in certificate lifecycle management, not load balancer setup.

Why this answer

How to eliminate wrong answers

Option A is wrong because restricting read access to a specific role is a security best practice (least privilege), not too permissive; the issue is with write access, not read. Option B is wrong because server-side encryption is not enforced by the bucket policy itself—it is a separate bucket setting or can be enforced via a condition key (e.g., s3:x-amz-server-side-encryption) in the policy, but its absence is not the flagged security issue here. Option D is wrong because the JSON syntax appears valid (no missing commas, brackets, or quotes) based on the exhibit; the policy is syntactically correct but semantically flawed.

Why this answer

How to eliminate wrong answers

Option A is wrong because output encoding alone does not prevent XSS in all contexts (e.g., JavaScript event handlers, CSS, or URL contexts require context-specific encoding) and does not address stored XSS where the payload is executed before encoding is applied. Option B is wrong because implementing CSP as the sole defense is insufficient; CSP can be bypassed if the application has JSONP endpoints, unsafe-inline fallbacks, or misconfigured directives, and it does not remediate existing XSS vulnerabilities in the application code. Option D is wrong because server-side input validation alone cannot stop XSS; it can be bypassed with encoding variations (e.g., double URL encoding, Unicode escapes) and does not protect against reflected or DOM-based XSS where the payload is generated client-side without server validation.

Why this answer

How to eliminate wrong answers

Option A is wrong because storing credentials as environment variables in the pod manifest exposes them in plaintext in the cluster's etcd and in any logs or dumps that capture environment variables, violating security best practices for secret management. Option B is wrong because embedding credentials in the container image during build makes them immutable and accessible to anyone with image pull access, preventing rotation without rebuilding and redeploying the image. Option D is wrong because Kubernetes Secrets without encryption at rest store secrets in base64-encoded plaintext in etcd, which is not secure against unauthorized access to the underlying storage, and they lack native rotation capabilities.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Secrets Manager is designed for storing secrets like database passwords, but for AWS-native services (SQS, DynamoDB), IAM roles are the securest and simplest approach; using Secrets Manager adds unnecessary complexity and cost without improving security. Option B is wrong because storing credentials as ciphertext in Lambda environment variables still requires the function to have a decryption key (e.g., KMS key) and manage the decryption process, which is less secure than using an IAM role that never exposes static credentials. Option D is wrong because creating an IAM user with long-lived Access Key and Secret Key violates the principle of least privilege and introduces static credentials that must be rotated, encrypted, and managed, whereas an IAM execution role provides temporary credentials that are automatically rotated and scoped to the function's execution.

Why this answer

How to eliminate wrong answers

Option A is wrong because hardcoding secrets in application code, even with obfuscation, is insecure—encryption keys must still be stored somewhere, and obfuscation can be reversed, violating the core security principle of not embedding secrets in code. Option C is wrong because passing secrets as environment variables during deployment, while better than hardcoding, still exposes them in the container's process list, logs, and orchestration metadata, and they can be read from the host or via /proc. Option D is wrong because storing secrets in a separate configuration file within the image means the secrets are baked into the image layers, making them accessible to anyone who can pull the image, and they persist in registries and caches.

Why this answer

How to eliminate wrong answers

Option A is wrong because SAST analyzes source code statically and cannot identify runtime vulnerabilities like SQL injection that depend on dynamic input and database interaction; those are better detected by DAST or IAST. Option B is wrong because SAST often produces more false positives than dynamic analysis due to its lack of runtime context, not fewer. Option D is wrong because SAST does not scan running applications; it scans source code or binaries without execution, whereas configuration issues in running apps are found by tools like configuration scanning or DAST.