5.1 Explain the Features and Functionality of Application Security CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the purpose of scanning Infrastructure as Code (IaC) templates?

   • ATo monitor the runtime performance of deployed resources
   • BTo detect misconfigurations before the infrastructure is deployed
   • CTo compile the IaC code into executable binaries
   • DTo manage user permissions on cloud resources
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization uses Infrastructure as Code (IaC) templates to deploy cloud resources. The security team wants to ensure that misconfigurations, such as overly permissive security group rules, are detected and prevented before the resources are deployed. What should the security team implement?

   • AA manual review process where security engineers inspect each IaC template before deployment.
   • BA policy-as-code scanning tool that runs on the IaC templates during the CI/CD pipeline and fails the build on misconfigurations.
   • CA vulnerability scanner that checks the deployed resources for known CVEs.
   • DA runtime security agent that monitors deployed resources for misconfigurations.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A developer accidentally committed a database password to a public GitHub repository. The security team needs to remediate this issue quickly. Which of the following actions should be taken FIRST?

   • AUse a secrets scanner to detect the password and then ignore the finding since it is already public.
   • BRotate the database password immediately and then remove the secret from the repository history.
   • CDelete the repository and recreate it from scratch.
   • DChange the repository from public to private to hide the password.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team manages multiple scanning tools (SAST, DAST, SCA) across several development teams. They are receiving duplicate and conflicting findings, and developers are complaining about alert fatigue. The team wants to streamline the process and ensure that only actionable, prioritized findings are reported. What should they do?

   • AHave each development team manage their own findings independently without central coordination.
   • BDisable all scanners except SAST to reduce the number of findings.
   • CImplement a centralized scan management platform that deduplicates findings, correlates them, and assigns risk scores based on exploitability and business impact.
   • DIncrease the frequency of all scans to ensure no findings are missed.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which item would a secrets scanner typically flag?

   • AA list of user roles in an application
   • BA database schema definition
   • CAn AWS access key ID and secret access key in a configuration file
   • DA public SSL certificate for a web server
   Reveal Solution Discussion Select an answer first