5.1 Explain the Features and Functionality of Application Security CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which type of risk is specifically addressed by SCA?

   • ASQL injection flaws in custom code
   • BMisconfigurations in cloud infrastructure templates
   • CWeak passwords used by application users
   • DLicense compliance issues in third-party libraries
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has a CI/CD pipeline that builds and deploys a containerized application. The security team wants to ensure that secrets are not embedded in the container image. Which control should be implemented in the pipeline?

   • AA runtime security agent that scans the container after it is deployed.
   • BA secrets scanner that runs as a stage in the pipeline and fails the build if any secrets are found in the image.
   • CA network firewall that blocks access to the container if a secret is detected.
   • DA manual review of the Dockerfile by the security team before each build.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A development team wants to integrate security scanning into their CI/CD pipeline. They are concerned about the impact on build times and want to ensure that scans do not slow down the pipeline unnecessarily. Which approach is most effective?

   • ARun security scans only when a developer manually triggers them.
   • BRun security scans only on a nightly basis outside of the pipeline to avoid impacting build times.
   • CRun all security scans in parallel as separate stages in the pipeline to minimize the impact on build time.
   • DRun only SAST scans in the pipeline and perform other scans manually.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the main goal of scan management?

   • ATo store scan results in a single database for compliance only
   • BTo eliminate the need for manual security testing
   • CTo run all scans at the same time to save time
   • DTo coordinate and prioritize various security scans to efficiently manage findings and track remediation
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which activity is part of scan management?

   • APrioritizing findings based on risk and impact
   • BDesigning the user interface
   • CWriting the application code
   • DConfiguring the network firewall
   Reveal Solution Discussion Select an answer first