5.1 Explain the Features and Functionality of Application Security CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company wants to implement a comprehensive application security program that covers code, infrastructure, and CI/CD pipelines. They have limited budget and need to choose between investing in an ASPM platform or purchasing separate tools for SAST, SCA, and IaC scanning. What is the most important consideration when making this decision?

   • ASeparate tools are easier to integrate with existing CI/CD pipelines than an ASPM platform.
   • BSeparate tools are always cheaper and provide more specialized functionality.
   • CThe ASPM platform provides a unified view and prioritization, which can reduce the effort required to manage multiple tools and improve remediation efficiency.
   • DThe ASPM platform is not necessary if the company has a small number of applications.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary focus of Software Composition Analysis (SCA)?

   • AScanning running applications for runtime vulnerabilities
   • BIdentifying vulnerabilities and license risks in open-source and third-party components
   • CAnalyzing the business logic of custom application code
   • DTesting the performance of application APIs
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team discovers that an API key for a production service was committed to a private repository. The key has been in the repository for several months and may have been exposed to other developers. What is the most important action to take?

   • ARemove the key from the repository history but do not rotate it, to avoid disruption.
   • BRotate the API key immediately and then remove it from the repository history.
   • CIgnore the finding because the repository is private and the key is unlikely to be compromised.
   • DChange the repository from private to public to make the key visible to the security team.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team wants to implement a process to detect hardcoded secrets in source code and configuration files before they are committed to the repository. Which approach should they take?

   • AUse a DAST scanner to test the running application for exposed secrets.
   • BConduct periodic manual reviews of the codebase for hardcoded secrets.
   • CImplement a pre-commit hook that runs a secrets scanner and blocks the commit if a secret is found.
   • DRun a secrets scanner only in the CI/CD pipeline after the code is committed.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which capability is a key feature of an ASPM solution?

   • APerforming only static analysis on source code
   • BStoring application logs for compliance auditing
   • CBlocking network traffic to and from applications
   • DCorrelating findings from multiple security tools to provide a unified risk view
   Reveal Solution Discussion Select an answer first