A team is designing a cloud application that will be publicly accessible. They want to implement defense in depth. Which set of controls best represents this principle?

Encryption of data at rest only.

A web application firewall (WAF), network security groups, and application-level authentication.

A network security group that allows all traffic from the internet.

A single strong password policy for all users.

Which security testing approach is most suitable for testing a cloud application's runtime behavior and configuration?

Static Application Security Testing (SAST)

Dynamic Application Security Testing (DAST)

Which threat is specific to cloud architectures and should be considered during threat modeling?

SQL injection in a web application

Misconfigured cloud storage buckets exposing data

Insecure deserialization in a Java application

Cross-site scripting (XSS) in a web form

A company is adopting a cloud SDLC and wants to ensure that security is considered at every stage. Which approach best integrates security into the SDLC?

Conduct a single security assessment before deployment.

Involve security teams in all phases from requirements to operations.

Rely on the cloud provider to handle all security.

Add a security review at the end of each phase.

EC-CouncilCloud Security Essentials

Domain 5Objective 1

Secure Software Development Lifecycle (SDLC) in the Cloud CSE Practice Questions (Page 4)

Part of the Application Security in the Cloud domain, which makes up ~16% of our current practice bank.

48questions here

10free pages

10concepts

Questions 16–20

16application · medium
A team is designing a cloud application that will be publicly accessible. They want to implement defense in depth. Which set of controls best represents this principle?
Select an answer first
17foundation · easy
Which security testing approach is most suitable for testing a cloud application's runtime behavior and configuration?
Select an answer first
18foundation · easy
Which design principle is most directly applied by giving a cloud application's components only the permissions they need to function?
Select an answer first
19foundation · easy
Which threat is specific to cloud architectures and should be considered during threat modeling?
Select an answer first
20application · medium
A company is adopting a cloud SDLC and wants to ensure that security is considered at every stage. Which approach best integrates security into the SDLC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.