4.4 Identify and Describe the Functions of a Cloud Native Application Protection Platform (CNAPP) CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement best describes how a CNAPP integrates with cloud environments?

   • AIt requires installing agents on every cloud server to function.
   • BIt only works with a single cloud provider.
   • CIt uses cloud provider APIs to continuously monitor configurations and workloads.
   • DIt replaces the cloud provider's native security tools.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security architect is explaining the value of a CNAPP to the CISO. The CISO asks, 'How is this different from the vulnerability scanner we already have?' The architect needs to articulate the key difference. Which statement best describes the fundamental difference?

   • AA CNAPP is a hardware appliance, while a vulnerability scanner is a software tool
   • BA CNAPP provides a broader, integrated view of security across the entire cloud-native application lifecycle, not just vulnerability scanning
   • CA CNAPP is only for containerized workloads, while a vulnerability scanner works on all workloads
   • DA CNAPP is faster at scanning for vulnerabilities than a traditional scanner
   Reveal Solution Discussion Select an answer first
4. 18application · medium · select all that apply

   A company is deploying a CNAPP to secure its cloud environment. The security team wants to ensure that the CNAPP provides comprehensive protection. Which of the following are core functions of a CNAPP? (Select all that apply.)

   • ACloud workload protection platform (CWPP)
   • BCloud infrastructure entitlement management (CIEM)
   • CNetwork firewall management
   • DCloud security posture management (CSPM)
   • EData loss prevention (DLP)
   Check answers Discussion Select an answer first
5. 19application · medium

   A company runs a microservices-based application on Amazon EKS with containers rebuilt and deployed multiple times per day. The security team currently uses a network firewall to inspect east-west traffic between pods and a separate vulnerability scanner that runs weekly against running container images. After a recent compromise, the team realizes the attacker exploited a misconfigured IAM role attached to a pod. Which capability of a CNAPP would most directly have prevented or detected this specific issue?

   • AAutomatically patching the underlying host operating system of the Kubernetes nodes
   • BScanning container images for known vulnerabilities before they are deployed
   • CContinuously assessing cloud infrastructure configurations against security benchmarks to detect risky IAM role assignments
   • DInspecting network traffic between pods to identify malicious lateral movement patterns
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A DevOps team wants to implement a 'shift-left' security strategy using a CNAPP. They currently have a CI/CD pipeline that builds and deploys a microservices application. The team wants to catch security issues as early as possible in the development lifecycle. Which sequence of CNAPP integrations would best achieve this goal?

   • AScan IaC templates, then scan container images, then monitor runtime behavior
   • BScan container images, then scan IaC templates, then monitor runtime behavior
   • CMonitor runtime behavior, then scan container images, then scan IaC templates
   • DOnly scan IaC templates and container images, and skip runtime monitoring
   Reveal Solution Discussion Select an answer first