Application Security in Cloud CCSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is migrating a monolithic application to a microservices architecture on a cloud platform. Each microservice needs to access a shared database, but the security team wants to enforce least privilege so that each service can only access its own tables. The team also wants to ensure that service-to-service communication is authenticated. Which approach should be implemented?

   • AUse a single shared database user for all microservices and rely on network segmentation to isolate traffic between services.
   • BGrant each microservice admin rights on the database and use a VPN for all inter-service communication.
   • CCreate a dedicated database user for each microservice with permissions limited to its specific tables, and use a service mesh with mutual TLS for service-to-service authentication.
   • DEncrypt the database connection using TLS and use API keys for service-to-service authentication.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which encryption method is most appropriate for protecting data in transit between a cloud application and its users?

   • ATokenization
   • BTLS/SSL
   • CHashing
   • DAES-256 at rest
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company exposes a public REST API for its partner integrations. The security team discovers that a partner application is sending requests with a forged 'X-User-Role: admin' header, and the API gateway is trusting this header to enforce authorization. The API also lacks any request throttling, allowing a single partner to flood the endpoint. Which combination of controls should the security architect implement to address both issues?

   • ARequire all partners to use a shared API key and implement IP-based rate limiting at the network layer.
   • BConfigure the API gateway to strip or ignore client-supplied authorization headers, enforce authorization based on the authenticated OAuth token claims, and enable rate limiting per client ID.
   • CSwitch the API to use mutual TLS (mTLS) and disable all HTTP methods except GET and POST.
   • DAdd a Web Application Firewall (WAF) rule to block requests containing 'X-User-Role' and increase the API gateway's overall request quota.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which technique is used to protect sensitive data in a cloud application by replacing it with a non-sensitive placeholder that has no reversible relationship to the original value?

   • ATokenization
   • BHashing
   • CMasking
   • DEncryption
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   For a serverless function, which security practice is essential to prevent unauthorized invocation?

   • AImplementing fine-grained permissions on the function's trigger or API
   • BDeploying a network intrusion detection system (NIDS) inside the function
   • CPatching the underlying operating system regularly
   • DUsing a virtual private network (VPN) for all function invocations
   Reveal Solution Discussion Select an answer first