Application Security in Cloud CCSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which security control is most directly applicable to securing container images in a cloud-native application?

   • APerforming regular backups of the container registry
   • BScanning images for known vulnerabilities before deployment
   • CEnabling multi-factor authentication for all users
   • DConfiguring a web application firewall (WAF)
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company's CI/CD pipeline builds a container image and pushes it to a registry. The security team wants to ensure that the image is scanned for vulnerabilities before it is deployed to production. They also want to prevent a known-vulnerable image from being deployed if it was built from a branch that is not the main branch. What is the most effective way to enforce this?

   • ARequire a manual approval step in the pipeline before the image is deployed.
   • BAdd a pipeline stage that scans the image and fails the build if vulnerabilities are found or if the image was built from a non-main branch.
   • CUse a container registry that automatically scans images on push and blocks the pull if vulnerabilities are found.
   • DDeploy the image to a staging environment first and run DAST against it.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is evaluating testing tools for a cloud application that has a complex user authentication flow. The team wants to identify vulnerabilities that require knowledge of the application's internal state, such as whether a user is logged in or has specific roles. Which testing approach is most suitable?

   • AUse SAST, which analyzes the source code and can trace all possible execution paths.
   • BUse DAST, which sends requests to the running application and observes the responses.
   • CUse a manual penetration test that focuses on the authentication flow.
   • DUse IAST, which instruments the application and can observe internal state and data flow during testing.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the shared responsibility model for cloud-hosted applications, which security control is typically the responsibility of the cloud customer rather than the cloud provider?

   • APatching the operating system of a managed database service
   • BPhysical security of the data center that hosts the application
   • CSecuring the hypervisor that hosts the application's virtual machines
   • DConfiguring application-level authentication and authorization
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team is investigating a potential breach of a cloud-hosted web application. The application logs are stored in a centralized log management service. The team needs to determine if an attacker attempted to exploit a SQL injection vulnerability in the login form. Which log data would be most useful for this investigation?

   • AAuthentication logs that show successful and failed login attempts.
   • BDatabase query logs that show the exact SQL statements executed.
   • CNetwork flow logs that show source and destination IP addresses and ports.
   • DWeb server access logs that include the full URI and query string for each request.
   Reveal Solution Discussion Select an answer first