CCSE Cloud Application Security & DevSecOps 3

Question 1

In a DevSecOps pipeline, at which stage is it most cost-effective to identify and remediate security vulnerabilities?

Accepted Answer

During the design and development phase (shift-left security)

Answer

During production incident response after exploitation

Answer

During post-deployment penetration testing

Answer

During the final QA acceptance testing phase

Question 2

What is the purpose of Infrastructure as Code (IaC) security scanning tools like Checkov or tfsec?

Accepted Answer

To detect security misconfigurations in IaC templates before infrastructure is deployed

Answer

To automatically provision and scale cloud infrastructure based on traffic load

Answer

To encrypt Terraform state files stored in cloud backends

Answer

To generate compliance audit reports from deployed cloud resources

Question 3

Which practice ensures that only verified, signed container images are allowed to run in a production Kubernetes cluster?

Accepted Answer

Implementing image admission policies that enforce image signing verification (e.g., Sigstore/Cosign)

Answer

Enabling Kubernetes PodDisruptionBudgets for all deployments

Answer

Configuring Kubernetes HorizontalPodAutoscaler with security thresholds

Answer

Applying Kubernetes ResourceQuotas to restrict container resource usage

Question 4

In secure CI/CD pipeline design, what is the primary security risk of using long-lived static credentials for pipeline authentication to cloud services?

Accepted Answer

Long-lived credentials increase the window of exposure if they are leaked or stolen

Answer

Static credentials cannot be rotated without redeploying the entire pipeline

Answer

Static credentials are incompatible with multi-factor authentication requirements

Answer

Using static credentials violates all major cloud provider SLAs

Question 5

What is the security function of a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault) in a cloud application deployment?

Accepted Answer

To centrally store, rotate, and audit access to sensitive credentials and secrets

Answer

To generate and validate JWT tokens for application authentication

Answer

To encrypt application traffic between microservices using TLS certificates

Answer

To monitor application logs for secret-related error messages

Question 6

Which security testing method involves providing unexpected, random, or malformed input to an application to discover crashes or vulnerabilities?

Accepted Answer

Fuzzing (fuzz testing)

Answer

Regression testing

Answer

Smoke testing

Answer

Boundary value analysis

Question 7

In cloud application security, what does the term 'defense in depth' mean when applied to a web application?

Accepted Answer

Layering multiple independent security controls so that failure of one does not compromise the system

Answer

Deploying the application across multiple availability zones for high availability

Answer

Using deep learning AI to detect and block application-layer attacks in real time

Answer

Implementing database encryption with multiple encryption keys in a hierarchy