Securing Serverless Functions GPCS Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A serverless function receives user-generated HTML content and stores it in a database. The content is later rendered in a web application. The function currently does no validation or encoding. A security review found that the function is vulnerable to stored XSS. The team wants to fix the issue without breaking the application's ability to display formatted content. What should they do?

   • ARemove all HTML tags from the input and store only plain text.
   • BBase64-encode the HTML before storing it and decode it when rendering.
   • CStore the HTML as-is and rely on the web application's client-side framework to escape it.
   • DSanitize the HTML input on the server side using an allowlist of safe tags and attributes, and encode the output when rendering.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which statement best describes the execution model of a serverless function?

   • AThe function maintains a persistent state between invocations by default.
   • BThe function runs only when a developer manually starts it from the cloud console.
   • CThe function is invoked by an event trigger, runs in a stateless container, and the platform manages the underlying infrastructure.
   • DThe function runs on a dedicated, always-on virtual machine that the developer manages.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A healthcare organization uses an AWS Lambda function to process patient records. The function receives data via an S3 trigger, transforms it, and stores the output in another S3 bucket. Compliance requires encryption of data at rest and in transit, and minimization of sensitive data in logs. What should the team implement?

   • AEncrypt only the destination bucket and leave the source bucket unencrypted because the data is temporary.
   • BRely on the Lambda service's built-in encryption for data in transit and store logs with full patient data for auditing.
   • CUse a customer-provided encryption key stored in the function's environment variables.
   • DEnable S3 default encryption on both buckets, use S3-managed keys (SSE-S3) or AWS KMS, ensure the function uses HTTPS endpoints, and redact patient identifiers from any log output.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization exposes an Azure Function App as a public HTTP API. Recently, a spike in traffic caused the function to consume excessive resources and incur high costs. The team wants to limit the impact of a single client while still allowing legitimate bursts of traffic. What should they implement?

   • ADisable the function app's authentication so that anonymous clients are not charged for authentication overhead.
   • BIncrease the function app's memory allocation and timeout to handle larger bursts of traffic.
   • CSet the function app's concurrency limit to 1 so that only one request is processed at a time.
   • DConfigure per-client rate limiting in the API Management layer and set a concurrency limit on the function app.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst needs to detect and respond to a potential compromise of an Azure Function app. The function processes sensitive data and is triggered by an HTTP endpoint. Which combination of settings should the analyst enable to support incident response?

   • AEnable logging only for successful invocations and ignore failed ones to reduce noise.
   • BStore logs only in the function's local file system to avoid external data transfer.
   • CDisable all logging to reduce the attack surface and prevent log tampering.
   • DEnable application logging to Application Insights, configure diagnostic settings to send function execution logs to a Log Analytics workspace, and enable Azure Monitor alerts on anomalous invocation patterns.
   Reveal Solution Discussion Select an answer first