Secure Software Development Lifecycle (SDLC) in the Cloud CSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which secure coding practice is essential for preventing injection attacks in a cloud application?

   • AUsing parameterized queries for database access
   • BUsing client-side validation only
   • CStoring passwords in plain text for simplicity
   • DDisabling error messages entirely
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is deploying a critical application to the cloud. They want to ensure that the deployment is secure and that any change to the infrastructure is reviewed and approved. They also want to maintain the ability to roll back quickly if a deployment fails. Which deployment strategy BEST meets these requirements?

   • AUse a single production environment and update it in place with a configuration management tool.
   • BUse a canary deployment with no approval gates to speed up releases.
   • CUse a rolling deployment with manual configuration changes.
   • DUse a blue/green deployment with infrastructure as code (IaC) and automated approval gates.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is developing a cloud application that will process personal data of EU citizens. They need to ensure compliance with GDPR. Which practice should be implemented during the SDLC?

   • AConduct a one-time security review before launch.
   • BStore all data in a single region to simplify management.
   • CEnsure that data processing is documented and that data subjects can exercise their rights.
   • DEncrypt all data at rest and in transit.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which design approach exemplifies the principle of defense in depth for a cloud application?

   • AUsing a single strong password for all services
   • BRelying solely on the cloud provider's physical security
   • CDisabling all logging to reduce attack surface
   • DImplementing network security groups, application-level authentication, and data encryption
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which type of security testing analyzes source code for vulnerabilities without executing the application?

   • ADynamic Application Security Testing (DAST)
   • BStatic Application Security Testing (SAST)
   • CPenetration testing
   • DInteractive Application Security Testing (IAST)
   Reveal Solution Discussion Select an answer first