Application Security in Cloud CCSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A development team deploys a microservices application on Kubernetes. Each microservice runs in its own namespace and needs to communicate with a central authentication service. The security team wants to ensure that a compromised pod cannot access other namespaces' services and that all inter-service traffic is encrypted. What is the most effective control combination?

   • AUse Kubernetes Secrets to store service account tokens and rely on the default namespace isolation.
   • BEnable TLS termination at the ingress controller and use role-based access control (RBAC) for service accounts.
   • CDeploy a sidecar container in each pod that logs all traffic and use a central audit policy.
   • DApply NetworkPolicies that allow only required egress/ingress and enable a service mesh with mutual TLS (mTLS).
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which API security measure is most effective at preventing SQL injection attacks?

   • AAPI key rotation
   • BEnabling CORS
   • CInput validation and parameterized queries
   • DRate limiting
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of an IAM role in a cloud application?

   • ATo monitor API calls for suspicious activity
   • BTo encrypt data at rest in cloud storage
   • CTo store user passwords in an encrypted format
   • DTo provide a set of permissions that can be assumed by an entity or service
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which application security testing method analyzes source code without executing the application?

   • AInteractive Application Security Testing (IAST)
   • BRuntime analysis
   • CDynamic Application Security Testing (DAST)
   • DStatic Application Security Testing (SAST)
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company exposes a customer-facing REST API that processes financial transactions. The security team wants to prevent attackers from enumerating valid customer IDs through the API's GET /customers/{id} endpoint. They also need to ensure that a compromised API key from one partner cannot be used to access another partner's customer data. Which combination of controls best addresses both requirements?

   • AAdd a Web Application Firewall (WAF) rule to block requests with sequential IDs and use shared API keys for all partners.
   • BLog all API requests and implement a SIEM alert for multiple 404 responses from the same IP address.
   • CUse UUIDs instead of sequential IDs and require mutual TLS (mTLS) for all API connections.
   • DImplement rate limiting on the endpoint and use scoped OAuth 2.0 tokens with per-partner claims.
   Reveal Solution Discussion Select an answer first