5.2 Identify and Describe Application Security Use Cases CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is deploying a web application that uses a third-party payment gateway. The security team wants to ensure that payment data is not stored in the application's database and that the application is compliant with PCI DSS. Which control should they implement?

   • AEncrypt the database with a strong encryption algorithm.
   • BImplement network security groups (NSGs) to restrict access to the database.
   • CUse a web application firewall (WAF) to protect the payment page.
   • DUse tokenization to replace payment data with tokens.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization is migrating a legacy monolithic application to a microservices architecture in the cloud. The security team wants to ensure that only authenticated and authorized services can communicate with each other, and that all inter-service traffic is encrypted. Which approach should they adopt?

   • ADeploy a web application firewall (WAF) in front of the entire microservices cluster.
   • BPlace all microservices in the same subnet and rely on network security groups (NSGs) for isolation.
   • CImplement a service mesh with mutual TLS (mTLS) and fine-grained access policies.
   • DUse a virtual private network (VPN) between each microservice and the cloud provider's API gateway.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is deploying a multi-tier application in the cloud. The security team wants to ensure that the web tier can only communicate with the application tier on a specific port, and that the application tier can only communicate with the database tier on a specific port. Which control should they implement?

   • AConfigure network security groups (NSGs) or security groups to allow only required traffic between tiers.
   • BUse a web application firewall (WAF) between each tier.
   • CImplement a service mesh with mTLS between tiers.
   • DDeploy a virtual private network (VPN) between tiers.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is using a cloud-based API to expose internal data to external partners. The security team wants to ensure that only authorized partners can access the API and that each partner's access is limited to specific data. Which approach should they implement?

   • AEnable network security groups (NSGs) to restrict partner IP addresses.
   • BDeploy a web application firewall (WAF) in front of the API.
   • CUse a single API key for all partners.
   • DUse OAuth 2.0 with scopes to grant partners specific permissions.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is deploying a web application that uses a third-party API to process payments. The security team wants to ensure that payment data is not stored in the application's logs. Which control should they implement?

   • AUse a web application firewall (WAF) to block payment requests.
   • BEnable network security groups (NSGs) on the application subnet.
   • CUse a virtual private network (VPN) for all API traffic.
   • DConfigure logging to redact sensitive fields and use a centralized logging system with access controls.
   Reveal Solution Discussion Select an answer first