Cloud Application Security & DevSecOps Flashcards

Which DevSecOps practice involves automatically scanning source code for security vulnerabilities during the CI/CD pipeline without executing the code?

Answer: Static Application Security Testing (SAST)

SAST analyzes source code, bytecode, or binaries for vulnerabilities without executing the application, making it ideal for early-stage CI/CD integration.

In cloud application security, what is the primary purpose of an API Gateway?

Answer: To enforce rate limiting, authentication, and routing for API traffic

An API Gateway centralizes traffic management, enforcing authentication, authorization, rate limiting, and routing, acting as a security control point for all API calls.

Which OWASP category specifically addresses the risk of using components with publicly known vulnerabilities in cloud applications?

Answer: Vulnerable and Outdated Components

OWASP's 'Vulnerable and Outdated Components' category addresses the risk of using libraries, frameworks, or other software with known security vulnerabilities.

What is the main security benefit of implementing a Web Application Firewall (WAF) in front of a cloud-hosted application?

Answer: It filters and monitors HTTP traffic to block common web exploits like SQLi and XSS

A WAF inspects HTTP/HTTPS traffic in real time and blocks common web-layer attacks such as SQL injection, cross-site scripting, and OWASP Top 10 threats.

In a software supply chain security context, what does a Software Bill of Materials (SBOM) provide?

Answer: A formal inventory of all components, libraries, and dependencies in a software artifact

An SBOM provides a complete, structured inventory of software components and dependencies, enabling organizations to identify and respond to vulnerabilities in their supply chain.

Which cloud application security principle dictates that each application service should only have the minimum permissions required to perform its function?

Answer: Principle of Least Privilege

The Principle of Least Privilege limits each service or user to only the permissions strictly necessary, reducing the blast radius if a service is compromised.

What is the security risk associated with storing secrets (API keys, passwords) directly in application source code or container images?

Answer: Secrets can be exposed through repository access, image scanning, or reverse engineering

Hardcoded secrets in code or images can be extracted by anyone with repository access, via image layer inspection, or through decompilation, leading to credential exposure.