Application Security in Cloud CCSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   During which phase of the Secure Software Development Life Cycle (SDLC) is threat modeling most commonly performed?

   • AMaintenance
   • BDesign
   • CImplementation
   • DRequirements gathering
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company exposes a public API that allows third-party developers to access customer data. The API uses OAuth 2.0 for authorization. The security team discovers that the API is vulnerable to a token replay attack, where a stolen access token can be used from a different IP address. The team also wants to ensure that the API can handle a sudden spike in traffic without being overwhelmed. Which combination of controls should be implemented?

   • AShorten the access token expiration time and increase the API gateway's maximum request size.
   • BRequire clients to send the token in the request body instead of the Authorization header, and disable rate limiting to avoid blocking legitimate users.
   • CUse a shared secret for all API clients and implement IP-based rate limiting.
   • DImplement token binding to tie the access token to the client's TLS session, and enable rate limiting with a burst allowance at the API gateway.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company uses a cloud object storage service to host static assets for a public website. The security team wants to ensure that only the website's backend service can write to the storage bucket, while anyone on the internet can read the assets. What is the most secure way to configure access?

   • ACreate a shared access key for the bucket and embed it in the website's JavaScript code.
   • BMake the bucket private and use a pre-signed URL for every asset request.
   • CGrant all users in the cloud account write access and use a bucket policy to allow public read.
   • DGrant the backend service's identity write access to the bucket and make the bucket publicly readable.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the primary purpose of an audit trail in a cloud application?

   • ATo automatically block malicious users
   • BTo reduce the amount of data stored in the database
   • CTo provide a chronological record of actions and events for compliance and investigation
   • DTo improve application performance by caching data
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company's CI/CD pipeline builds and deploys a web application to a cloud platform. The security team wants to ensure that no secrets are accidentally committed to the source repository and that any code containing hardcoded credentials fails the build automatically. What is the most effective way to implement this control?

   • AAdd a secret-scanning tool as a pre-commit hook and as a CI pipeline stage that fails the build on detection.
   • BUse a code review process where a senior developer manually checks every commit for secrets.
   • CEnable branch protection rules that require two approvals for all pull requests.
   • DRotate all secrets every 90 days and store them in a central vault.
   Reveal Solution Discussion Select an answer first