CCSE Cloud Application Security & DevSecOps 1 — Questions and Answers
Question 1: Which DevSecOps practice involves automatically scanning source code for security vulnerabilities during the CI/CD pipeline without executing the code?
- Dynamic Application Security Testing (DAST)
- Static Application Security Testing (SAST) (Correct answer)
- Interactive Application Security Testing (IAST)
- Runtime Application Self-Protection (RASP)
Correct answer: Static Application Security Testing (SAST)
SAST analyzes source code, bytecode, or binaries for vulnerabilities without executing the application, making it ideal for early-stage CI/CD integration.
Question 2: In cloud application security, what is the primary purpose of an API Gateway?
- To store API credentials securely in a vault
- To enforce rate limiting, authentication, and routing for API traffic (Correct answer)
- To automatically generate API documentation from code
- To replicate API endpoints across multiple cloud regions
Correct answer: To enforce rate limiting, authentication, and routing for API traffic
An API Gateway centralizes traffic management, enforcing authentication, authorization, rate limiting, and routing, acting as a security control point for all API calls.
Question 3: Which OWASP category specifically addresses the risk of using components with publicly known vulnerabilities in cloud applications?
- Injection
- Security Misconfiguration
- Vulnerable and Outdated Components (Correct answer)
- Broken Access Control
Correct answer: Vulnerable and Outdated Components
OWASP's 'Vulnerable and Outdated Components' category addresses the risk of using libraries, frameworks, or other software with known security vulnerabilities.
Question 4: What is the main security benefit of implementing a Web Application Firewall (WAF) in front of a cloud-hosted application?
- It encrypts all data at rest within the application database
- It filters and monitors HTTP traffic to block common web exploits like SQLi and XSS (Correct answer)
- It performs vulnerability scanning of the application source code
- It manages SSL/TLS certificate rotation automatically
Correct answer: It filters and monitors HTTP traffic to block common web exploits like SQLi and XSS
A WAF inspects HTTP/HTTPS traffic in real time and blocks common web-layer attacks such as SQL injection, cross-site scripting, and OWASP Top 10 threats.
Question 5: In a software supply chain security context, what does a Software Bill of Materials (SBOM) provide?
- A list of approved cloud service providers for procurement
- A formal inventory of all components, libraries, and dependencies in a software artifact (Correct answer)
- A compliance checklist for PCI DSS software requirements
- A log of all code commits and their authors in a repository
Correct answer: A formal inventory of all components, libraries, and dependencies in a software artifact
An SBOM provides a complete, structured inventory of software components and dependencies, enabling organizations to identify and respond to vulnerabilities in their supply chain.
Question 6: Which cloud application security principle dictates that each application service should only have the minimum permissions required to perform its function?
- Defense in Depth
- Principle of Least Privilege (Correct answer)
- Separation of Duties
- Zero Trust Networking
Correct answer: Principle of Least Privilege
The Principle of Least Privilege limits each service or user to only the permissions strictly necessary, reducing the blast radius if a service is compromised.
Question 7: What is the security risk associated with storing secrets (API keys, passwords) directly in application source code or container images?
- It increases application startup latency due to decryption overhead
- Secrets can be exposed through repository access, image scanning, or reverse engineering (Correct answer)
- It prevents the application from scaling horizontally in the cloud
- It violates cloud provider SLAs and results in account termination
Correct answer: Secrets can be exposed through repository access, image scanning, or reverse engineering
Hardcoded secrets in code or images can be extracted by anyone with repository access, via image layer inspection, or through decompilation, leading to credential exposure.
CCSE Cloud Application Security & DevSecOps 1
Which DevSecOps practice involves automatically scanning source code for security vulnerabilities during the CI/CD pipeline without executing the code?