Application Security in Cloud CCSE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is deploying a new application that must comply with GDPR. The application stores personal data of EU citizens. The compliance team requires that the data be protected and that the company can demonstrate compliance. The application team wants to ensure that the application is secure and that access to personal data is controlled. Which combination of controls should be implemented?

   • AUse a single IAM role for all application users and disable audit logging to reduce storage costs.
   • BEncrypt the data at rest and grant all developers access to the database for troubleshooting.
   • CStore all personal data in the EU region and rely on the cloud provider's compliance certifications.
   • DImplement data encryption at rest and in transit, enforce least privilege access controls, and enable detailed audit logging to demonstrate compliance.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is running a serverless application on a cloud platform. The application uses a function that reads from a cloud storage bucket and writes to a database. The security team wants to ensure that the function has only the necessary permissions to perform its tasks. Which approach should be used to configure the function's permissions?

   • ACreate a dedicated IAM role for the function with permissions to read from the specific storage bucket and write to the specific database table.
   • BGrant the function the same IAM role as the application's other functions to simplify management.
   • CEmbed the cloud provider's credentials directly in the function's code for simplicity.
   • DUse the cloud provider's default service account for the function, which has broad permissions.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which API security control is specifically designed to prevent a single client from overwhelming an API with too many requests?

   • AInput validation
   • BAuthentication
   • CEncryption
   • DRate limiting
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which testing approach is most effective for identifying vulnerabilities that only appear when a cloud application is running and processing real user input?

   • ADynamic Application Security Testing (DAST)
   • BStatic Application Security Testing (SAST)
   • CManual code review
   • DDependency scanning
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company exposes a public API that allows partners to query customer account balances. The API uses an API key for authentication. A security assessment finds that the API key is sent in the URL query string, and the API returns full account details when a partner queries with a valid key. Which two changes should be made to improve security?

   • AUse a longer API key and log all requests for auditing.
   • BSwitch to mutual TLS and require partners to use a specific client certificate.
   • CMove the API key to the Authorization header and implement field-level filtering based on the partner's permissions.
   • DAdd rate limiting and a WAF rule to block requests with suspicious query strings.
   Reveal Solution Discussion Select an answer first