Application Security in Cloud CCSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is running a containerized application on a Kubernetes cluster. The security team has identified that containers are running as root and have access to the host's Docker socket. The team wants to remediate these issues without breaking the application's functionality. Which set of actions should be taken?

   • ARun the containers as root but use a read-only root filesystem to prevent writes.
   • BRemove the Docker socket mount but keep the containers running as root.
   • CConfigure the containers to run as a non-root user, remove the Docker socket mount, and implement a Pod Security Policy or admission controller to enforce these settings.
   • DKeep the containers running as root but add a network policy to restrict communication between pods.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary goal of integrating security tools into a CI/CD pipeline?

   • ATo replace the need for manual security reviews entirely
   • BTo reduce the number of developers required for the project
   • CTo automate security checks so that vulnerabilities are detected early and continuously
   • DTo ensure that all code changes are deployed to production automatically
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is moving a legacy on-premises application to a cloud platform. The application stores sensitive customer data. The security team is concerned about the shared responsibility model and wants to ensure that the company's responsibilities are clearly defined. Which of the following is a company responsibility in the cloud shared responsibility model?

   • AEncrypting data at rest and in transit within the application.
   • BManaging the network infrastructure that connects the cloud data centers.
   • CPatching the underlying hypervisor that hosts the virtual machines.
   • DSecuring the physical data center that houses the cloud servers.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A team is designing a new cloud-native application that will handle user-uploaded files. During the threat modeling phase, they identify a risk that a malicious file could exploit a vulnerability in the file-processing library. Which control should be prioritized during the design phase to mitigate this risk?

   • AAdd a WAF rule to block requests with file extensions that are not in an allowlist.
   • BRun the file-processing service in an isolated sandbox with no network access.
   • CStore all uploaded files in a separate storage account and set a short retention policy.
   • DUse a serverless function to process the files and set a short timeout.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company runs a serverless application on a cloud function platform. The application processes messages from a queue and writes results to a database. A security review reveals that the function's IAM role has broad permissions, including the ability to delete the database. The team wants to apply least privilege without breaking the application. What is the best approach?

   • AKeep the current role but add a condition that denies the delete action when the request comes from the function's service account.
   • BCreate a new IAM role with only the permissions needed to read from the queue and write to the database, then update the function to use it.
   • CMove the function to a separate cloud account and grant it cross-account access to the queue and database.
   • DUse the cloud provider's built-in administrator role for the function and rely on the database's own access controls.
   Reveal Solution Discussion Select an answer first