CCSK Cloud Application Security 2

Question 1

Which security concern is most critical when exposing microservices through a public API in a cloud environment?

Accepted Answer

Lack of proper authentication and authorization controls on API endpoints

Answer

Excessive logging of non-sensitive events

Answer

Using HTTP instead of HTTPS for internal service communication

Answer

Deploying microservices in a single availability zone

Question 2

What is the role of an API Gateway in a cloud-native application architecture from a security perspective?

Accepted Answer

It provides a centralized enforcement point for authentication, rate limiting, and traffic inspection

Answer

It replaces the need for encryption between services

Answer

It eliminates the need for WAF by providing full application-layer protection

Answer

It manages container orchestration and scaling

Question 3

Which vulnerability occurs when a cloud application includes functionality that allows attackers to enumerate and access other users' object references (e.g., user IDs, file names) in API requests?

Accepted Answer

Insecure Direct Object Reference (IDOR) / BOLA

Answer

Server-Side Request Forgery (SSRF)

Answer

Broken Object Level Authorization (BOLA)

Answer

XML External Entity (XXE) Injection

Question 4

In container security for cloud applications, which practice reduces the attack surface of a running container?

Accepted Answer

Using minimal base images and removing unnecessary packages

Answer

Running containers as the root user to allow all operations

Answer

Storing secrets inside the container image layers

Answer

Disabling read-only file system restrictions

Question 5

What is the primary security risk of using third-party or open-source libraries in cloud-deployed applications?

Accepted Answer

They may contain known vulnerabilities that are inherited by the application (supply chain risk)

Answer

They always require additional licensing fees

Answer

They are incompatible with cloud IAM systems

Answer

They prevent the use of container technologies

Question 6

Dynamic Application Security Testing (DAST) differs from SAST in that DAST:

Accepted Answer

Tests the application while it is running by sending crafted inputs and observing responses

Answer

Analyzes source code without running the application

Answer

Focuses exclusively on infrastructure misconfigurations

Answer

Generates security policies automatically from code comments

Question 7

Which cloud application security control helps prevent Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Anti-CSRF tokens in state-changing requests

Answer

Content Security Policy (CSP) headers

Answer

SQL parameterized queries

Answer

TLS certificate pinning