5.2 Identify and Describe Application Security Use Cases CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is using a cloud-based CI/CD pipeline to deploy applications. The security team wants to ensure that code is not tampered with during the build process and that secrets used in the pipeline are protected. Which practices should they adopt?

   • AUse environment variables to store secrets in the pipeline configuration.
   • BEnable network security groups (NSGs) on the build agents.
   • CUse a web application firewall (WAF) in front of the CI/CD server.
   • DUse code signing and store secrets in a dedicated secrets manager.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services company is developing a mobile banking app. The app sends sensitive transaction data from the user's device to a cloud-hosted API. The security team wants to protect the data in transit and ensure that the API only accepts requests from the legitimate mobile app. Which combination of controls should they implement?

   • AUse TLS for all API traffic and implement certificate pinning in the mobile app.
   • BUse API keys embedded in the mobile app.
   • CUse a VPN on the mobile device to connect to the API.
   • DImplement a web application firewall (WAF) in front of the API.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company runs a containerized application on a Kubernetes cluster. The security team wants to ensure that container images are scanned for vulnerabilities before deployment and that only signed images are allowed to run. Which set of controls should they implement?

   • AIntegrate a container image scanner into the CI/CD pipeline and enforce image signature verification in the cluster.
   • BConfigure role-based access control (RBAC) to limit who can deploy containers.
   • CEnable Kubernetes network policies to restrict pod-to-pod communication.
   • DUse a web application firewall (WAF) to protect the Kubernetes API server.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is deploying a serverless application using cloud functions. The security team wants to ensure that the functions are not vulnerable to injection attacks and that secrets are not exposed in the code. Which practices should they adopt?

   • AUse parameterized queries in the function code and store secrets in a managed secrets manager.
   • BUse environment variables to store secrets directly in the function configuration.
   • CDeploy a web application firewall (WAF) in front of the function.
   • DEnable network security groups (NSGs) on the function's virtual network.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is deploying a customer-facing web application in the cloud. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, while also ensuring that the application can scale automatically during peak traffic. Which solution should they implement?

   • AEnable network security groups (NSGs) on the application subnet and rely on the cloud provider's built-in DDoS protection.
   • BUse a content delivery network (CDN) to cache static content and reduce origin server load.
   • CDeploy a web application firewall (WAF) in front of the application and configure auto-scaling for the application tier.
   • DImplement a virtual private network (VPN) for remote access to the application's management interface.
   Reveal Solution Discussion Select an answer first