Secure Software Development Lifecycle (SDLC) in the Cloud CSE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A team is designing a cloud application that will be accessed by external partners. The security team mandates that the application should be secure by default, meaning that any new feature must be disabled unless explicitly enabled by an administrator. Which design principle is being applied?

   • ADefense in depth
   • BSecure defaults
   • CFail secure
   • DLeast privilege
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A developer is writing code for a cloud application that accepts JSON input from external clients. The code parses the JSON and uses the values in database queries. Which secure coding practice is most important to prevent injection attacks?

   • AUse parameterized queries or prepared statements for database access.
   • BLog all JSON input for auditing purposes.
   • CValidate that the JSON input is well-formed.
   • DUse a JSON parser that is known to be fast.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A DevOps team is implementing DevSecOps in a regulated industry. They need to ensure that every code change is automatically tested for security vulnerabilities and that compliance evidence is collected. However, they also need to maintain a fast release cadence. Which approach BEST balances security and speed?

   • ARun security tests only in production to avoid slowing down the pipeline.
   • BUse a separate security team to test after each release and manually compile compliance reports.
   • CRun SAST and dependency scanning in the pipeline, and automatically generate compliance reports from the pipeline results.
   • DPerform a full manual security review before every release.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which practice supports governance in a cloud SDLC by ensuring that security policies are enforced across development teams?

   • ADocumenting policies but not enforcing them
   • BUsing policy as code to automate compliance checks
   • CConducting security reviews only after an incident
   • DAllowing each team to define its own security standards
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A team is threat modeling a new cloud-native application that uses serverless functions, a managed database, and an object storage bucket. Which threat is MOST specific to the serverless component and should be prioritized?

   • ASQL injection in the managed database queries.
   • BInjection attacks through unsanitized user input in the function code.
   • COver-privileged IAM roles assigned to the function at runtime.
   • DDistributed denial-of-service (DDoS) attacks against the application's public endpoint.
   Reveal Solution Discussion Select an answer first