A financial services company is developing a cloud-based application that will handle highly sensitive customer data. They want to adopt a security framework that provides a structured set of verification requirements at different levels of rigor, allowing them to progressively increase security assurance. Which framework should they adopt?

OWASP Top 10 for LLM Applications

A development team is writing a cloud-native application in C++. They want to focus their secure coding training on the most common and dangerous software errors that lead to vulnerabilities. Which framework should they use to identify these errors?

OWASP Top 10 API Security Risks

A company's cloud API allows users to upload files. A security review finds that the API does not validate the file type, allowing users to upload executable files that could be run on the server. Which OWASP API Security Risk is this?

Broken Object Level Authorization

Unrestricted Resource Consumption

Which SANS Top 25 software error is most directly related to a cloud application failing to properly validate input before using it in a database query?

Cross-Site Request Forgery (CSRF)

Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)

Certified Cloud Security Professional

Domain 4Objective 1

Advocate Training and Awareness for Application Security CCSP Practice Questions (Page 4)

Part of the Cloud Application Security domain, which accounts for 16% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

16%of the exam

Questions 16–20

16application · medium
A financial services company is developing a cloud-based application that will handle highly sensitive customer data. They want to adopt a security framework that provides a structured set of verification requirements at different levels of rigor, allowing them to progressively increase security assurance. Which framework should they adopt?
Select an answer first
17application · medium
A development team is writing a cloud-native application in C++. They want to focus their secure coding training on the most common and dangerous software errors that lead to vulnerabilities. Which framework should they use to identify these errors?
Select an answer first
18application · medium
A company's cloud API allows users to upload files. A security review finds that the API does not validate the file type, allowing users to upload executable files that could be run on the server. Which OWASP API Security Risk is this?
Select an answer first
19foundation · easy
Which OWASP Top 10 risk is specifically characterized by an attacker being able to view or modify data they are not authorized to access, such as by manipulating URL parameters or cookies?
Select an answer first
20foundation · easy
Which SANS Top 25 software error is most directly related to a cloud application failing to properly validate input before using it in a database query?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.

Advocate Training and Awareness for Application Security CCSP Practice Questions (Page 4)

Questions 16–20

A development team is writing a cloud-native application in C++. They want to focus their secure coding training on the most common and dangerous software errors that lead to vulnerabilities. Which framework should they use to identify these errors?

A company's cloud API allows users to upload files. A security review finds that the API does not validate the file type, allowing users to upload executable files that could be run on the server. Which OWASP API Security Risk is this?

Which OWASP Top 10 risk is specifically characterized by an attacker being able to view or modify data they are not authorized to access, such as by manipulating URL parameters or cookies?

Which SANS Top 25 software error is most directly related to a cloud application failing to properly validate input before using it in a database query?

Keep studying — Cloud Application Security