CCSK Cloud Application Security

Question 1

Which methodology integrates security practices directly into the DevOps pipeline for cloud applications?

Accepted Answer

DevSecOps

Answer

Agile Security

Answer

Waterfall Assurance

Answer

SecureOps

Question 2

According to the CSA CCSK guidance, which phase of the Secure Software Development Lifecycle (SSDLC) should threat modeling occur?

Accepted Answer

Design

Answer

Testing

Answer

Deployment

Answer

Operations

Question 3

What is the primary purpose of a Web Application Firewall (WAF) deployed in front of a cloud-hosted application?

Accepted Answer

Filter and monitor HTTP/HTTPS traffic to block application-layer attacks

Answer

Encrypt data at rest

Answer

Manage user identities and access tokens

Answer

Provide DDoS protection at the network layer

Question 4

In cloud-native application development, which practice helps ensure that secrets such as API keys and database credentials are NOT hardcoded in source code?

Accepted Answer

Use of a secrets management service or vault

Answer

Code obfuscation

Answer

Role-based access control

Answer

Static application security testing

Question 5

Which OWASP resource specifically addresses the most critical security risks found in web applications and is commonly referenced in CCSK cloud application security?

Accepted Answer

OWASP Top 10

Answer

OWASP SAMM

Answer

OWASP ASVS

Answer

OWASP Testing Guide

Question 6

Static Application Security Testing (SAST) tools analyze an application to find vulnerabilities at which stage?

Accepted Answer

By examining source code or binaries without executing the program

Answer

At runtime during production

Answer

During the design phase before coding begins

Answer

By monitoring live network traffic

Question 7

In the context of cloud application security, what does the term 'shift left' mean?

Accepted Answer

Integrating security activities earlier in the development lifecycle

Answer

Moving workloads to a different cloud region

Answer

Shifting responsibility for security from developers to operations

Answer

Migrating on-premises apps to the cloud