Secure Software Development Lifecycle (SDLC) in the Cloud CSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary goal of DevSecOps in a cloud environment?

   • ATo perform security testing only after deployment
   • BTo integrate security into every stage of the DevOps pipeline
   • CTo eliminate all security controls to speed up delivery
   • DTo replace the DevOps team with a dedicated security team
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is implementing security testing in a CI/CD pipeline for a cloud application. They have a limited budget and need to choose between SAST, DAST, and IAST. The application is a REST API that is updated frequently. Which approach provides the BEST coverage for the investment?

   • AUse IAST because it combines the benefits of SAST and DAST in a single tool.
   • BUse only SAST because it is the cheapest and can be run early in the pipeline.
   • CUse only DAST because it tests the running application and catches real-world vulnerabilities.
   • DUse SAST in the build phase and DAST in the staging environment.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A multinational company is developing a cloud application that processes personal data of EU citizens. They must comply with GDPR. The application will be deployed in multiple regions. Which compliance consideration is MOST critical during the design phase?

   • AEnsure that all personal data is stored only in the EU region.
   • BEncrypt all personal data with a key stored in the same region as the data.
   • CUse a cloud provider that is GDPR compliant and rely on their certifications.
   • DImplement data residency controls to ensure that personal data is stored in approved regions and that cross-border transfers are documented.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A healthcare startup is moving a patient-portal application to a public cloud. During the requirements phase, the security team is documenting cloud-specific security requirements. Which requirement is MOST directly tied to the cloud deployment model and must be captured now?

   • AThe application must encrypt data at rest and in transit using approved algorithms.
   • BThe application must log all access to patient data and retain logs for at least one year.
   • CThe application must support multi-factor authentication for all users.
   • DThe application must be deployed in a specific cloud region to comply with data-residency regulations.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A team is threat modeling a cloud application that uses serverless functions. They identify that a function has excessive permissions to access other cloud resources. Which threat modeling principle should be applied to mitigate this risk?

   • AIncrease the function's timeout to allow more time for security checks.
   • BApply the principle of least privilege to the function's IAM role.
   • CAdd more logging to the function to detect unauthorized access.
   • DUse a more secure programming language for the function.
   Reveal Solution Discussion Select an answer first