A company is deploying a new web application on a cloud VM. The default installation includes several sample scripts, a database admin console, and debug endpoints. The security policy requires that only necessary services be exposed. What should the team do before going live?

Remove sample scripts, disable the admin console, and configure the web server to deny access to debug endpoints.

Enable the debug endpoints only during business hours and disable them at night.

Set strong passwords on the admin console and leave the sample scripts as they are.

Keep the sample scripts but restrict access to them via IP allowlisting.

A company is deploying a microservices application on a cloud platform. Each microservice has its own database and API. The security team wants to enforce least privilege across the services while minimizing operational overhead. Which approach is most appropriate?

Use the cloud provider's default service account for all microservices.

Use a single shared service account for all microservices to simplify management.

Grant each microservice broad permissions to the entire cloud environment to avoid future changes.

Create a separate service account for each microservice with permissions limited to its own database and API resources.

A company is deploying a customer portal on a cloud platform. They want to ensure that users cannot access other users' data by manipulating URLs or API requests. Which combination of controls should they implement?

Rely on the cloud provider's identity and access management (IAM) service to authenticate users and enforce access control.

Implement object-level authorization checks on every request and use short-lived, randomly generated session tokens.

Use URL encryption to hide resource IDs from users.

Set session cookies to HttpOnly and Secure attributes only.

What is the primary purpose of using encryption for data in transit?

To allow data to be stored in the cloud without encryption at rest

To protect data from being intercepted and read by unauthorized parties

To ensure data is not altered during transmission

To compress data to reduce bandwidth usage

When should secure code review be performed in the development process?

Only after the application is deployed to production

Throughout the development lifecycle, including before merging code

Only when a security incident occurs

Only during the initial design phase

EC-CouncilCloud Security Essentials

Domain 5Objective 3

Secure Coding Practices CSE Practice Questions (Page 9)

Part of the Application Security in the Cloud domain, which makes up ~16% of our current practice bank.

60questions here

12free pages

12concepts

Questions 41–45

41application · medium
A company is deploying a new web application on a cloud VM. The default installation includes several sample scripts, a database admin console, and debug endpoints. The security policy requires that only necessary services be exposed. What should the team do before going live?
Select an answer first
42expert · hard
A company is deploying a microservices application on a cloud platform. Each microservice has its own database and API. The security team wants to enforce least privilege across the services while minimizing operational overhead. Which approach is most appropriate?
Select an answer first
43application · medium
A company is deploying a customer portal on a cloud platform. They want to ensure that users cannot access other users' data by manipulating URLs or API requests. Which combination of controls should they implement?
Select an answer first
44foundation · easy
What is the primary purpose of using encryption for data in transit?
Select an answer first
45foundation · easy
When should secure code review be performed in the development process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.