App Security Engineer Secure Deployment Flashcards

Which practice best hardens a Docker container image for deploying a web application?

Answer: Use a minimal base image and run as a non-root user

Minimal images and non-root users reduce both the attack surface and the privileges available after a compromise.

A Content-Security-Policy header with "script-src 'self'" mainly helps mitigate which attack?

Answer: Cross-site scripting

CSP restricts where scripts can load from, which blocks most injected and inline script attacks.

An application is deployed with debug mode enabled in its framework configuration. What is the primary risk?

Answer: Exposure of internal details and possibly code execution through debug consoles

Debug modes can reveal configuration and stack details, and some interactive debuggers allow remote code execution.

Which header setting prevents an application's pages from being framed by other sites to stop clickjacking?

Answer: X-Frame-Options: DENY

X-Frame-Options DENY (or CSP frame-ancestors 'none') blocks other origins from embedding the page in frames.

Infrastructure-as-Code templates are scanned before deployment. What does this mainly detect?

Answer: Misconfigurations such as open security groups or unencrypted storage

IaC scanning catches insecure cloud and infrastructure settings before they are provisioned.

For security monitoring after deployment, which events should an application reliably log?

Answer: Authentication failures, access-control failures, and input-validation failures

Logging security-relevant failures (without sensitive data) supports detection and incident response.

What is the main purpose of keeping separate development, test, and production environments with different credentials?

Answer: To prevent a compromise or mistake in a lower environment from affecting production

Environment separation with unique credentials isolates production from less-protected development and test systems.