CCSP Cloud Application Security Practice Question
Which TWO best practices help secure a cloud application's runtime environment?
⚠ Common exam trap
ISC2 often tests the distinction between security controls that are preventive (like immutable infrastructure and least privilege) versus detective or reactive controls (like HIDS), leading candidates to mistakenly select host-based intrusion detection as a runtime security best practice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use immutable infrastructure
Immutable infrastructure ensures that once a cloud application's runtime environment is deployed, it is never modified in place. Any change requires building a new image and redeploying, which eliminates configuration drift, reduces the attack surface, and prevents unauthorized modifications from persisting. This directly secures the runtime environment by enforcing a known-good state at all times.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use immutable infrastructure
Why this is correct
Immutable infrastructure ensures that runtime environments are not modified after deployment, reducing drift and attack surface.
- ✗
Implement host-based intrusion detection
Why it's wrong here
Host-based IDS is a security control at the host level, not specifically for application runtime.
- ✓
Run applications with least privilege
Why this is correct
Running with minimal privileges limits the impact of a compromise.
- ✗
Enable automatic patching of dependencies
Why it's wrong here
Automatic patching is important but more related to maintenance than runtime security.
- ✗
Use container orchestration platform
Why it's wrong here
Container orchestration helps manage containers but is not a specific security practice for runtime environment.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.