Application Security in Cloud CCSE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company runs a containerized application on a managed Kubernetes service. The security team wants to detect and respond to a compromised container that is attempting to make outbound network connections to a known command-and-control (C2) server. Which control is most effective for detecting this behavior?

   • ADeploy a runtime security agent on each node that monitors container network activity and alerts on connections to known malicious IPs.
   • BUse a network policy that denies all outbound traffic except to specific allowed destinations.
   • CEnable container image scanning to check for known vulnerabilities in the container image.
   • DEnable Kubernetes audit logging and use a monitoring tool that alerts on outbound connections to known malicious IP addresses.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is migrating a legacy on-premises application to a cloud platform. The application stores customer data and is subject to data residency requirements. The security team is reviewing the shared responsibility model. Which responsibility remains with the customer regardless of the cloud service model?

   • APatching the underlying hypervisor that hosts the virtual machines.
   • BEnsuring that the application's data handling complies with the residency requirement by selecting the appropriate region.
   • CManaging the physical security of the data center where the application runs.
   • DConfiguring the network firewall rules for the cloud provider's backbone network.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A development team is deploying a containerized application to a cloud platform using a CI/CD pipeline. The security team requires that all container images be scanned for vulnerabilities before deployment, and that the pipeline automatically fails if any critical vulnerability is found. The team also wants to ensure that the source code is checked for common security flaws before the build stage. Which two steps should be added to the pipeline?

   • ARun a DAST tool on the container image in the build stage, and run a SAST tool on the source code in the post-build stage.
   • BRun a container image scanner in the build stage, and run a SAST tool in the post-build stage on the running container.
   • CRun a SAST tool on the source code in the build stage, and run a container image scanner in the post-build stage with a fail-on-critical policy.
   • DRun a DAST tool against the source code in the build stage, and run a SAST tool against the container image in the post-build stage.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company stores customer data in a cloud database. The security team wants to protect the data at rest and in transit, and also ensure that only specific applications can decrypt the data. They are considering using envelope encryption. What is the primary security benefit of envelope encryption over directly encrypting data with a single key?

   • AIt eliminates the need to manage encryption keys because the cloud provider handles all key operations.
   • BIt makes the encryption algorithm stronger by using two different encryption algorithms in sequence.
   • CIt allows the data encryption key to be rotated independently of the key that protects it, and it enables fine-grained access control over which applications can decrypt.
   • DIt ensures that data is encrypted in transit as well as at rest without additional configuration.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which IAM practice helps enforce the principle of least privilege for a cloud application?

   • AGranting each application component only the permissions it needs to function
   • BUsing the same IAM role for all application components to simplify management
   • CAssigning administrator access to all developers to reduce support tickets
   • DCreating a new IAM user for every API call
   Reveal Solution Discussion Select an answer first