CCSE Cloud Application Security & DevSecOps 3

Question 1

In a DevSecOps pipeline, at which stage is it most cost-effective to identify and remediate security vulnerabilities?

Accepted Answer

During the design and development phase (shift-left security)

Answer

Shift-left security embeds security checks early in the development lifecycle, where fixing defects is exponentially cheaper than remediating issues discovered in production.

Question 2

What is the purpose of Infrastructure as Code (IaC) security scanning tools like Checkov or tfsec?

Accepted Answer

To detect security misconfigurations in IaC templates before infrastructure is deployed

Answer

IaC scanning tools analyze Terraform, CloudFormation, and other IaC templates for security misconfigurations (e.g., open S3 buckets, permissive security groups) before resources are provisioned.

Question 3

Which practice ensures that only verified, signed container images are allowed to run in a production Kubernetes cluster?

Accepted Answer

Implementing image admission policies that enforce image signing verification (e.g., Sigstore/Cosign)

Answer

Image signing and admission policy enforcement (using tools like Cosign and OPA/Gatekeeper) ensures only cryptographically verified images from trusted registries run in the cluster.

Question 4

In secure CI/CD pipeline design, what is the primary security risk of using long-lived static credentials for pipeline authentication to cloud services?

Accepted Answer

Long-lived credentials increase the window of exposure if they are leaked or stolen

Answer

Long-lived static credentials provide an extended opportunity for misuse if compromised; short-lived, dynamically generated credentials (e.g., OIDC tokens) minimize this exposure window.

Question 5

What is the security function of a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault) in a cloud application deployment?

Accepted Answer

To centrally store, rotate, and audit access to sensitive credentials and secrets

Answer

Secrets managers provide secure, centralized storage for credentials with automatic rotation, fine-grained access controls, and audit logging to prevent hardcoded or improperly stored secrets.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE Cloud Application Security & DevSecOps 3