Application Security in Cloud CCSE Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the primary purpose of centralized logging in a cloud application?

   • ATo replace the need for application performance monitoring
   • BTo encrypt all application data automatically
   • CTo provide a single source of truth for auditing and incident investigation
   • DTo reduce the storage cost of application logs
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company has a public-facing API and wants to detect a potential brute-force attack on the login endpoint. They have centralized logging in place. Which log-based detection strategy is most effective for identifying this attack pattern?

   • ASet up a dashboard that displays the total number of API requests per hour.
   • BEnable verbose logging for all API requests and store logs for 90 days.
   • CCreate an alert that triggers when the number of failed login attempts from a single IP address exceeds a threshold within a time window.
   • DUse a WAF to block requests that contain SQL injection patterns in the login parameter.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A team is adopting a DevSecOps approach for a cloud-native application. They want to integrate security testing into their CI/CD pipeline. The application is a set of microservices that communicate over a message queue. The team wants to identify vulnerabilities in the inter-service communication logic. Which testing approach is most appropriate?

   • ADeploy a WAF in front of the message queue to filter malicious messages.
   • BRun DAST against the message queue endpoint to test for injection vulnerabilities.
   • CUse IAST by instrumenting the message queue itself.
   • DPerform SAST on the source code of each microservice to identify flaws in the message-handling logic.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A team is developing a cloud-native application and wants to identify security vulnerabilities early in the development process. They have a CI/CD pipeline that builds container images and deploys to a Kubernetes cluster. The team wants to catch common coding flaws before the code is merged and also check the final container image for known vulnerabilities before deployment. Which two tools should be integrated into the pipeline?

   • AIAST tool in the build stage and a WAF in front of the application.
   • BDAST tool in the build stage and runtime application self-protection (RASP) in production.
   • CSAST tool in the build stage and container image scanning in the deployment stage.
   • DContainer image scanning in the build stage and a SAST tool in the deployment stage.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A company is implementing a DevSecOps pipeline for a cloud-native application. The security team wants to ensure that security checks are automated and do not slow down the development process. The team is considering integrating SAST, DAST, and container image scanning into the CI/CD pipeline. Which approach best balances security and speed?

   • ARun only DAST in the staging environment and skip SAST and image scanning to save time.
   • BRun all security checks (SAST, DAST, and image scanning) in the build stage to catch issues as early as possible.
   • CRun SAST and DAST in the build stage, and run container image scanning only in production.
   • DRun SAST and container image scanning in the build stage, and run DAST in a staging environment after deployment, with all checks failing the pipeline on critical findings.
   Reveal Solution Discussion Select an answer first