CCSK Cloud Application Security 3

Question 1

In the CSA Cloud Controls Matrix (CCM), which domain specifically addresses application and interface security for cloud services?

Accepted Answer

Application & Interface Security (AIS)

Answer

Threat and Vulnerability Management

Answer

Data Security & Information Lifecycle Management

Answer

Identity & Access Management

Question 2

What is the purpose of a Content Security Policy (CSP) HTTP response header in web application security?

Accepted Answer

It restricts the sources from which a browser can load resources, mitigating XSS attacks

Answer

It encrypts the HTTP response body

Answer

It enforces HTTPS-only connections to the server

Answer

It manages session cookie attributes such as HttpOnly and Secure

Question 3

When performing penetration testing on a cloud application, which action MUST be taken before starting to avoid violating the cloud provider's terms of service?

Accepted Answer

Obtain prior written authorization from the cloud provider and the application owner

Answer

Enable multi-factor authentication on all accounts

Answer

Disable all WAF rules temporarily to get accurate results

Answer

Scan only during business hours to minimize impact

Question 4

Which secure coding practice specifically prevents SQL Injection attacks in cloud-hosted database-backed applications?

Accepted Answer

Parameterized queries (prepared statements)

Answer

Input length validation only

Answer

Output encoding of HTML entities

Answer

Using stored procedures without parameterization

Question 5

In a serverless cloud application, which security consideration is unique compared to traditional application hosting?

Accepted Answer

Overly permissive function-level IAM roles and event injection via triggers

Answer

The need to patch operating systems and runtimes

Answer

Managing physical server hardware

Answer

Configuring hypervisor-level isolation

Question 6

What does the principle of 'least privilege' mean when applied to cloud application service accounts?

Accepted Answer

Service accounts should be granted only the minimum permissions necessary to perform their function

Answer

Service accounts should have administrator access to simplify operations

Answer

All service accounts should share the same credentials for easier management

Answer

Service accounts do not need to follow access control policies

Question 7

Which approach best supports continuous security validation of cloud application deployments in a CI/CD pipeline?

Accepted Answer

Integrating automated SAST, DAST, and dependency scanning into every pipeline build and blocking on critical findings

Answer

Running security scans manually once per quarter

Answer

Conducting a penetration test only at the initial deployment

Answer

Relying exclusively on the cloud provider's built-in security scanning