Application Security in Cloud CCSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which monitoring activity is most effective for detecting a potential security incident in a cloud application?

   • ABacking up logs to a separate storage bucket
   • BSetting up alerts for anomalous behavior, such as unusual login patterns or API call spikes
   • CMonitoring CPU usage to ensure the application is fast
   • DReviewing code changes for syntax errors
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security operations team is monitoring a cloud-hosted API for suspicious activity. The team has set up logging and alerting, but is receiving too many false positives, which is causing alert fatigue. The team wants to reduce false positives while still detecting real threats. Which approach should be taken?

   • AIncrease the alert threshold for all metrics to reduce the number of alerts.
   • BUse a single log source and rely on manual review of the logs to identify threats.
   • CDisable alerts for low-severity events and only alert on critical events.
   • DImplement a correlation engine that combines multiple log sources and uses anomaly detection to identify unusual patterns, and tune alert thresholds based on historical baseline data.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A healthcare application stores patient records in a cloud database. The compliance team requires that all data be encrypted at rest and that access to the data be logged for audit purposes. The application team also wants to protect sensitive fields, such as social security numbers, from being displayed to support staff who only need the last four digits. Which combination of controls should be implemented?

   • AEnable database-level encryption at rest, implement column-level encryption for the SSN field, and configure audit logging for all database access.
   • BEnable TLS for all database connections and use data masking to show only the last four digits of the SSN to support staff.
   • CEncrypt the entire database with a customer-managed key and grant support staff direct database access to query the SSN field.
   • DUse tokenization to replace SSNs with tokens and rely on the cloud provider's default audit logging.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A financial services company is deploying a new application that processes customer transactions. The compliance team requires that all access to the application be logged and that logs be retained for at least seven years. The application team wants to ensure that only authorized personnel can access the logs. Which configuration should be implemented?

   • AEnable audit logging and store logs in a database with a seven-year retention period, granting all developers access to the logs.
   • BEnable audit logging and store logs in a log management service with a seven-year retention policy, but do not restrict access to the logs.
   • CEnable basic logging on the application and store logs in a standard storage bucket with a lifecycle policy to delete logs after seven years.
   • DEnable detailed audit logging on the application, store logs in an immutable storage bucket with a retention policy of seven years, and restrict access to the bucket using IAM roles.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which practice helps ensure that a cloud application meets regulatory compliance requirements?

   • AGranting all users administrative access to simplify management
   • BUsing the same security group for all application components
   • CDisabling logging to reduce the attack surface
   • DEnforcing policies that restrict data storage to approved geographic regions
   Reveal Solution Discussion Select an answer first