Apply Cloud Software Assurance and Validation CCSP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   A cloud security engineer is reviewing a Python web application that will be deployed on a managed platform. The application uses several open-source libraries, and the team wants to ensure they do not introduce known vulnerabilities or incompatible licenses into production. Which practice is most appropriate for this requirement?

   • AInteractive Application Security Testing (IAST)
   • BDynamic Application Security Testing (DAST)
   • CSoftware Composition Analysis (SCA)
   • DFunctional testing with abuse cases
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   A security team wants to identify vulnerabilities in a cloud application's source code before it is deployed. They plan to scan the codebase for insecure functions and coding patterns without executing the application. Which testing technique should they use?

   • AStatic Application Security Testing (SAST), which analyzes source code for vulnerabilities without running the application
   • BDynamic Application Security Testing (DAST), which tests the running application
   • CSoftware Composition Analysis (SCA), which scans open-source components for known vulnerabilities
   • DInteractive Application Security Testing (IAST), which instruments the application during runtime
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which activity is a typical example of quality assurance (QA) in the context of cloud application development?

   • AConfiguring a web application firewall to protect the production environment
   • BWriting the initial project plan and defining the scope of the application
   • CEncrypting data at rest in the cloud storage service
   • DPerforming a static code analysis to identify potential security flaws
   Reveal Solution Discussion Select an answer first
5. 4foundation · medium

   A cloud application team is validating the system before release. They want to confirm that the application can handle the expected peak load without degrading response time and that it can scale out when demand increases. Which type of testing directly addresses these quality attributes?

   • AFunctional testing of the user login and checkout workflows
   • BWhitebox testing of the internal sorting algorithms
   • CBlackbox testing of the public API endpoints
   • DNon-functional testing, including load and scalability testing
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   A cloud security team is designing a CI/CD pipeline for a web application. The team wants automated validation at every stage so that security and quality gates are enforced before a build reaches production. Which statement correctly describes how functional and non-functional testing are incorporated into CI/CD processes to achieve this goal?

   • AFunctional tests are executed automatically in the test stage, and non-functional tests (e.g., performance, security) are also automated in dedicated stages or as part of the pipeline, with failures blocking promotion to the next environment.
   • BNon-functional tests are embedded in the commit stage, while functional tests are only triggered manually by a release manager before each production deployment.
   • CBoth functional and non-functional tests are run only in a nightly batch job, and the pipeline always promotes code to production regardless of test results to maintain delivery speed.
   • DFunctional tests run only in the deployment stage, while non-functional tests are executed manually by QA after release to avoid slowing down the pipeline.
   Reveal Solution Discussion Select an answer first