CCSK Cloud Application Security 2

Question 1

Which security concern is most critical when exposing microservices through a public API in a cloud environment?

Accepted Answer

Lack of proper authentication and authorization controls on API endpoints

Answer

Without strong authentication and authorization controls, unauthorized actors can access or abuse API endpoints, making this the most critical security concern for public APIs.

Question 2

What is the role of an API Gateway in a cloud-native application architecture from a security perspective?

Accepted Answer

It provides a centralized enforcement point for authentication, rate limiting, and traffic inspection

Answer

An API Gateway acts as a centralized control point that enforces authentication, rate limiting, logging, and policy-based access across all API calls.

Question 3

Which vulnerability occurs when a cloud application includes functionality that allows attackers to enumerate and access other users' object references (e.g., user IDs, file names) in API requests?

Accepted Answer

Insecure Direct Object Reference (IDOR) / BOLA

Answer

Broken Object Level Authorization (BOLA), also known as IDOR, occurs when an API exposes object identifiers that attackers can manipulate to access other users' data.

Question 4

In container security for cloud applications, which practice reduces the attack surface of a running container?

Accepted Answer

Using minimal base images and removing unnecessary packages

Answer

Minimal base images reduce the number of installed packages and therefore the attack surface, limiting the tools available to an attacker who compromises the container.

Question 5

What is the primary security risk of using third-party or open-source libraries in cloud-deployed applications?

Accepted Answer

They may contain known vulnerabilities that are inherited by the application (supply chain risk)

Answer

Open-source and third-party dependencies can introduce known vulnerabilities into an application's supply chain, which attackers can exploit if libraries are not kept patched.

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK Cloud Application Security 2