CCSK Cloud Application Security 2 — Questions and Answers
Question 1: Which security concern is most critical when exposing microservices through a public API in a cloud environment?
- Excessive logging of non-sensitive events
- Lack of proper authentication and authorization controls on API endpoints (Correct answer)
- Using HTTP instead of HTTPS for internal service communication
- Deploying microservices in a single availability zone
Correct answer: Lack of proper authentication and authorization controls on API endpoints
Without strong authentication and authorization controls, unauthorized actors can access or abuse API endpoints, making this the most critical security concern for public APIs.
Question 2: What is the role of an API Gateway in a cloud-native application architecture from a security perspective?
- It replaces the need for encryption between services
- It provides a centralized enforcement point for authentication, rate limiting, and traffic inspection (Correct answer)
- It eliminates the need for WAF by providing full application-layer protection
- It manages container orchestration and scaling
Correct answer: It provides a centralized enforcement point for authentication, rate limiting, and traffic inspection
An API Gateway acts as a centralized control point that enforces authentication, rate limiting, logging, and policy-based access across all API calls.
Question 3: Which vulnerability occurs when a cloud application includes functionality that allows attackers to enumerate and access other users' object references (e.g., user IDs, file names) in API requests?
- Server-Side Request Forgery (SSRF)
- Broken Object Level Authorization (BOLA)
- Insecure Direct Object Reference (IDOR) / BOLA (Correct answer)
- XML External Entity (XXE) Injection
Correct answer: Insecure Direct Object Reference (IDOR) / BOLA
Broken Object Level Authorization (BOLA), also known as IDOR, occurs when an API exposes object identifiers that attackers can manipulate to access other users' data.
Question 4: In container security for cloud applications, which practice reduces the attack surface of a running container?
- Running containers as the root user to allow all operations
- Using minimal base images and removing unnecessary packages (Correct answer)
- Storing secrets inside the container image layers
- Disabling read-only file system restrictions
Correct answer: Using minimal base images and removing unnecessary packages
Minimal base images reduce the number of installed packages and therefore the attack surface, limiting the tools available to an attacker who compromises the container.
Question 5: What is the primary security risk of using third-party or open-source libraries in cloud-deployed applications?
- They always require additional licensing fees
- They may contain known vulnerabilities that are inherited by the application (supply chain risk) (Correct answer)
- They are incompatible with cloud IAM systems
- They prevent the use of container technologies
Correct answer: They may contain known vulnerabilities that are inherited by the application (supply chain risk)
Open-source and third-party dependencies can introduce known vulnerabilities into an application's supply chain, which attackers can exploit if libraries are not kept patched.
Question 6: Dynamic Application Security Testing (DAST) differs from SAST in that DAST:
- Analyzes source code without running the application
- Tests the application while it is running by sending crafted inputs and observing responses (Correct answer)
- Focuses exclusively on infrastructure misconfigurations
- Generates security policies automatically from code comments
Correct answer: Tests the application while it is running by sending crafted inputs and observing responses
DAST tools interact with a running application — simulating external attacks — making it effective at discovering runtime vulnerabilities that static analysis may miss.
Question 7: Which cloud application security control helps prevent Cross-Site Request Forgery (CSRF) attacks?
- Content Security Policy (CSP) headers
- Anti-CSRF tokens in state-changing requests (Correct answer)
- SQL parameterized queries
- TLS certificate pinning
Correct answer: Anti-CSRF tokens in state-changing requests
Anti-CSRF tokens are unique, unpredictable values embedded in forms and verified server-side, preventing attackers from tricking users into submitting unauthorized requests.
CCSK Cloud Application Security 2
Which security concern is most critical when exposing microservices through a public API in a cloud environment?