A company is designing a multi-tier web application in the cloud. The threat model identifies a risk of an attacker compromising the web tier and using that access to reach the database tier. The security team wants to minimize this risk without adding significant latency. Which control is the MOST effective and practical?

Implement a web application firewall (WAF) in front of the web tier.

Use network security groups to restrict database access to only the web tier's IP addresses.

Encrypt all traffic between the web and database tiers using TLS.

Place the web and database tiers in the same subnet to reduce network complexity.

A developer is writing a cloud function that accepts JSON input from an API gateway and stores it in a database. Which secure coding practice is MOST important to prevent injection attacks?

Encode the JSON payload with base64 before storing it.

Validate and sanitize all input fields against an allowlist of expected types and lengths.

Use a NoSQL database to avoid SQL injection entirely.

Log the raw input to a separate log file for later analysis.

When threat modeling a cloud application, which element is unique to the cloud and must be included in the data flow diagram?

The company's internal firewall

The application's database schema

The cloud provider's shared infrastructure

Which practice is important for securing APIs used by a cloud application?

Embedding API keys in client-side code

Allowing all cross-origin requests

Using unencrypted HTTP for simplicity

Implementing rate limiting and authentication

EC-CouncilCloud Security Essentials

Domain 5Objective 1

Secure Software Development Lifecycle (SDLC) in the Cloud CSE Practice Questions (Page 7)

Part of the Application Security in the Cloud domain, which makes up ~16% of our current practice bank.

48questions here

10free pages

10concepts

Questions 31–35

31application · medium
A financial services company is developing a cloud application that handles customer data. They must comply with a regulation that requires data to be stored in a specific geographic region. During which SDLC phase should this requirement be formally captured?
Select an answer first
32expert · hard
A company is designing a multi-tier web application in the cloud. The threat model identifies a risk of an attacker compromising the web tier and using that access to reach the database tier. The security team wants to minimize this risk without adding significant latency. Which control is the MOST effective and practical?
Select an answer first
33application · medium
A developer is writing a cloud function that accepts JSON input from an API gateway and stores it in a database. Which secure coding practice is MOST important to prevent injection attacks?
Select an answer first
34foundation · easy
When threat modeling a cloud application, which element is unique to the cloud and must be included in the data flow diagram?
Select an answer first
35foundation · easy
Which practice is important for securing APIs used by a cloud application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.

Secure Software Development Lifecycle (SDLC) in the Cloud CSE Practice Questions (Page 7)

Questions 31–35

A financial services company is developing a cloud application that handles customer data. They must comply with a regulation that requires data to be stored in a specific geographic region. During which SDLC phase should this requirement be formally captured?

A developer is writing a cloud function that accepts JSON input from an API gateway and stores it in a database. Which secure coding practice is MOST important to prevent injection attacks?

When threat modeling a cloud application, which element is unique to the cloud and must be included in the data flow diagram?

Which practice is important for securing APIs used by a cloud application?

Keep studying — Application Security in the Cloud