A developer is writing a function that queries a cloud database. The function constructs a query by concatenating user input directly into the SQL string. Which secure coding practice should the developer apply to prevent SQL injection?

Validate user input with a blacklist of SQL keywords

Escape single quotes in user input

Use parameterized queries or prepared statements

Use a stored procedure for all database access

A developer is implementing a file upload feature for a cloud application. The application will accept PDF files from users. Which secure coding practice is most important to prevent a malicious PDF from exploiting a vulnerability in the PDF parser?

Store the PDF in a separate storage service

Validate the file extension and MIME type

Use a sandboxed environment to parse the PDF

A company is adopting a DevOps model and moving to a cloud environment. The security team is concerned about the lack of visibility and control over the development pipeline. They want to implement a control that provides the most comprehensive visibility into code changes and deployments while maintaining the agility of the DevOps process. Which control best balances these needs?

Use a configuration management database (CMDB) to track all infrastructure changes

Restrict access to the CI/CD pipeline to a small group of administrators

Require manual approval for every deployment to production

Implement a centralized logging and monitoring solution that captures all CI/CD pipeline events and code changes

A development team is writing a new REST API for a cloud application. The security lead instructs the team to follow OWASP ASVS to ensure the API is secure. Which ASVS requirement is most directly relevant to preventing injection attacks?

Verify that all input is validated using a positive (allowlist) approach

Verify that the application logs all security-relevant events

Verify that the application uses a web application firewall (WAF)

Verify that all communications are encrypted using TLS

A development team is using a version control system to manage code for a cloud application. They want to ensure that the code that is deployed to production is exactly the code that was reviewed and approved. Which configuration management practice should they implement?

Use immutable build artifacts and store them in a secure artifact repository

Use a branching strategy where developers work on feature branches and merge to main

Enable two-factor authentication for the version control system

Use a continuous integration server to build the code

Certified Cloud Security Professional

Domain 4Objective 3

Apply the Secure Software Development Life Cycle (SDLC) CCSP Practice Questions (Page 2)

Part of the Cloud Application Security domain, which accounts for 16% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

16%of the exam

Questions 6–10

6application · medium
A developer is writing a function that queries a cloud database. The function constructs a query by concatenating user input directly into the SQL string. Which secure coding practice should the developer apply to prevent SQL injection?
Select an answer first
7application · medium
A developer is implementing a file upload feature for a cloud application. The application will accept PDF files from users. Which secure coding practice is most important to prevent a malicious PDF from exploiting a vulnerability in the PDF parser?
Select an answer first
8expert · hard
A company is adopting a DevOps model and moving to a cloud environment. The security team is concerned about the lack of visibility and control over the development pipeline. They want to implement a control that provides the most comprehensive visibility into code changes and deployments while maintaining the agility of the DevOps process. Which control best balances these needs?
Select an answer first
9application · medium
A development team is writing a new REST API for a cloud application. The security lead instructs the team to follow OWASP ASVS to ensure the API is secure. Which ASVS requirement is most directly relevant to preventing injection attacks?
Select an answer first
10application · medium
A development team is using a version control system to manage code for a cloud application. They want to ensure that the code that is deployed to production is exactly the code that was reviewed and approved. Which configuration management practice should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.