What is the primary purpose of the OWASP Application Security Verification Standard (ASVS)?

To provide a list of the most common web vulnerabilities

To establish a standard for testing web application security controls

To define a secure coding standard for developers

To specify requirements for cloud infrastructure security

A company is developing a cloud application using a PaaS model. The security team is creating training materials to explain the shared responsibility model. Which responsibility belongs to the cloud provider in a PaaS model?

Configuring network security groups

Managing user access and identities

Managing the runtime environment and middleware

Securing the application code and data

Which OWASP API Security Risk is most directly related to an attacker being able to access another user's data by changing an object identifier in an API request?

Broken Object Level Authorization (BOLA)

A security analyst is reviewing a cloud application and finds that it uses a broken authentication mechanism, allowing attackers to compromise passwords and session tokens. Which OWASP Top 10 risk does this represent?

Identification and Authentication Failures

Certified Cloud Security Professional

Domain 4Objective 1

Advocate Training and Awareness for Application Security CCSP Practice Questions (Page 1)

Part of the Cloud Application Security domain, which accounts for 16% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

16%of the exam

Questions 1–5

1foundation · easy
What is the primary purpose of the OWASP Application Security Verification Standard (ASVS)?
Select an answer first
2foundation · easy
Which OWASP Top 10 risk occurs when an application fails to properly validate user-supplied input and allows an attacker to execute arbitrary commands on the underlying system?
Select an answer first
3application · medium
A company is developing a cloud application using a PaaS model. The security team is creating training materials to explain the shared responsibility model. Which responsibility belongs to the cloud provider in a PaaS model?
Select an answer first
4foundation · easy
Which OWASP API Security Risk is most directly related to an attacker being able to access another user's data by changing an object identifier in an API request?
Select an answer first
5application · medium
A security analyst is reviewing a cloud application and finds that it uses a broken authentication mechanism, allowing attackers to compromise passwords and session tokens. Which OWASP Top 10 risk does this represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.