CCSE Cloud Application Security & DevSecOps

Question 1

Which DevSecOps practice involves automatically scanning source code for security vulnerabilities during the CI/CD pipeline without executing the code?

Accepted Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Answer

Runtime Application Self-Protection (RASP)

Question 2

In cloud application security, what is the primary purpose of an API Gateway?

Accepted Answer

To enforce rate limiting, authentication, and routing for API traffic

Answer

To store API credentials securely in a vault

Answer

To automatically generate API documentation from code

Answer

To replicate API endpoints across multiple cloud regions

Question 3

Which OWASP category specifically addresses the risk of using components with publicly known vulnerabilities in cloud applications?

Accepted Answer

Vulnerable and Outdated Components

Answer

Injection

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 4

What is the main security benefit of implementing a Web Application Firewall (WAF) in front of a cloud-hosted application?

Accepted Answer

It filters and monitors HTTP traffic to block common web exploits like SQLi and XSS

Answer

It encrypts all data at rest within the application database

Answer

It performs vulnerability scanning of the application source code

Answer

It manages SSL/TLS certificate rotation automatically

Question 5

In a software supply chain security context, what does a Software Bill of Materials (SBOM) provide?

Accepted Answer

A formal inventory of all components, libraries, and dependencies in a software artifact

Answer

A list of approved cloud service providers for procurement

Answer

A compliance checklist for PCI DSS software requirements

Answer

A log of all code commits and their authors in a repository

Question 6

Which cloud application security principle dictates that each application service should only have the minimum permissions required to perform its function?

Accepted Answer

Principle of Least Privilege

Answer

Defense in Depth

Answer

Separation of Duties

Answer

Zero Trust Networking

Question 7

What is the security risk associated with storing secrets (API keys, passwords) directly in application source code or container images?

Accepted Answer

Secrets can be exposed through repository access, image scanning, or reverse engineering

Answer

It increases application startup latency due to decryption overhead

Answer

It prevents the application from scaling horizontally in the cloud

Answer

It violates cloud provider SLAs and results in account termination