5.1 Identify and Evaluate Application Security Posture Management (ASPM) Features and Functionality CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is configuring ASPM for a company that has a custom-built internal tool for managing employee timesheets. The tool is updated manually by a small development team whenever a new feature is requested. How should the analyst configure ASPM to evaluate this application's security posture?

   • AManually define the application and its components in ASPM, and schedule periodic scans.
   • BClassify the application as dynamic so that ASPM can use its automated discovery features.
   • CSkip ASPM monitoring for this application because it is internal and low-risk.
   • DConfigure ASPM to automatically discover the application's components from the CI/CD pipeline.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A software company's flagship product is a SaaS application that is updated daily via automated deployments. The security team is using ASPM to monitor this application. Which characteristic is most indicative that this is a 'dynamic' business application in ASPM?

   • AThe application's codebase is automatically updated and deployed through a CI/CD pipeline.
   • BThe application has a large number of end users.
   • CThe application is hosted in a public cloud environment.
   • DThe application is composed of multiple microservices.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team is evaluating ASPM for their organization. They want a solution that can provide a unified view of security risks across their application portfolio, including both legacy and cloud-native applications. Which core capability of ASPM directly addresses this need?

   • AThe ability to identify and inventory business applications and their associated risks.
   • BThe ability to define and enforce SLAs for issue remediation.
   • CThe ability to replace the existing CI/CD pipeline.
   • DThe ability to automatically remediate vulnerabilities without human intervention.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a key aspect of managing SLAs in ASPM?

   • AThe ability to ignore SLAs for issues that are not critical
   • BThe ability to automatically remediate all issues before the SLA expires
   • CThe ability to update SLA policies as business requirements change
   • DThe ability to assign SLAs only to manual applications
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of Application Security Posture Management (ASPM) in an organization?

   • ATo replace the need for a Web Application Firewall (WAF) by blocking malicious traffic in real time
   • BTo continuously identify, evaluate, and prioritize security risks across applications and their development pipelines
   • CTo automate the deployment of application code to production environments without manual review
   • DTo provide a single repository for storing application source code and managing version control
   Reveal Solution Discussion Select an answer first