Application Security in Cloud CCSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A financial services company must provide evidence to auditors that its cloud application enforces segregation of duties. Specifically, the team that develops code must not be able to deploy it to production. What is the most effective control to implement?

   • AUse the same service account for development and production deployments to simplify management.
   • BImplement a policy that requires all code changes to be reviewed by a senior developer before merge.
   • CGrant the development team read-only access to the production environment and rely on the cloud provider's audit logs.
   • DConfigure the CI/CD pipeline so that the production deployment stage requires approval from a separate team.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company's cloud application stores personally identifiable information (PII) in a database. The compliance team requires that the data be encrypted at rest and that access to the data be logged. The application team wants to minimize the impact of a data breach by ensuring that even if the database is compromised, the PII is unreadable. Which approach should be implemented?

   • AUse envelope encryption with a customer-managed key stored in a cloud KMS, and enable audit logging on the database.
   • BEncrypt the PII fields using application-level encryption and store the encryption keys in the application's configuration file.
   • CUse a cloud provider's default encryption at rest and rely on the provider's audit logging.
   • DUse tokenization to replace PII with tokens and store the mapping in the same database.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which statement best describes a core security challenge specific to cloud-hosted applications compared to traditional on-premises applications?

   • AThe customer loses all visibility into application logs and monitoring data
   • BThe application's attack surface is reduced because the provider manages all network security
   • CThe application may be exposed to a broader set of network-based threats due to its public accessibility and shared infrastructure
   • DThe application is no longer subject to regulatory compliance requirements
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which action best exemplifies a DevSecOps practice in a CI/CD pipeline?

   • ADisabling security checks to speed up deployment
   • BRunning a SAST scan automatically on every code commit
   • CReviewing security logs after a breach occurs
   • DPerforming a penetration test manually once a year
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare application stores patient records in a cloud database. Compliance requires that any export of data to a reporting team must not contain real patient names or national identification numbers. The reporting team needs to join records across tables using a consistent identifier. What is the most appropriate data protection technique?

   • AApply deterministic tokenization to the identifier fields and masking to name and ID columns in the export.
   • BCreate a database view that selects only non-sensitive columns and grant the reporting team access to that view.
   • CUse format-preserving encryption on the name fields and store the national IDs in a separate vault.
   • DEncrypt the entire database with a customer-managed key and grant the reporting team read-only access.
   Reveal Solution Discussion Select an answer first