5.1 Identify and Evaluate Application Security Posture Management (ASPM) Features and Functionality CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key characteristic of a dynamic business application in ASPM?

   • AIt is automatically discovered and updated by ASPM based on changes in the environment
   • BIt is an application that changes its code frequently through agile development
   • CIt is an application that is only used for a short period of time and then decommissioned
   • DIt requires manual registration and periodic updates by a security team
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is configuring SLAs in ASPM. They have a critical application where a 'high' severity issue must be remediated in 48 hours. However, the development team has a policy that no code changes are pushed to production on weekends. An issue is discovered on a Friday afternoon. The security team wants the SLA to reflect the actual working time available. What is the most appropriate way to handle this in ASPM?

   • AConfigure the SLA with a remediation time that accounts for the weekend, such as 96 hours, to ensure the 48 working hours are available.
   • BConfigure the SLA with a 48-hour remediation time and accept that the weekend will count against it.
   • CConfigure the SLA with a 48-hour remediation time and manually pause the SLA clock for the weekend.
   • DConfigure the SLA to use a business calendar or working-hours schedule that excludes weekends.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security manager wants to generate a report showing the percentage of high-severity issues that were remediated within the 72-hour SLA target over the last quarter. Which ASPM feature should they use to obtain this information?

   • AThe real-time alert feed for SLA breaches.
   • BThe SLA configuration page to review the defined targets.
   • CThe application inventory page to see which apps have SLAs assigned.
   • DThe reporting and analytics dashboard that tracks SLA compliance metrics.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A retail company's e-commerce checkout service is composed of microservices that are automatically scaled and redeployed by a CI/CD pipeline multiple times per day. The security team is configuring ASPM to monitor this service. What is the most important consideration for ASPM to accurately evaluate this application's security posture?

   • AASPM must be configured to require manual approval for every code change before it is deployed.
   • BASPM must be able to continuously discover and track the frequently changing components and dependencies.
   • CASPM should classify the application as a manual business application to simplify monitoring.
   • DASPM must be pointed to a single static repository to get a complete view of the application.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In ASPM, what parameters are typically used to define a service-level agreement (SLA) for a security issue?

   • AThe number of issues found and the total number of applications in the environment
   • BThe cost of remediation and the budget allocated for security
   • CSeverity of the issue and the maximum time allowed for response or remediation
   • DThe name of the application and the owner of the security team
   Reveal Solution Discussion Select an answer first