CCSK Cloud Application Security 3

Question 1

In the CSA Cloud Controls Matrix (CCM), which domain specifically addresses application and interface security for cloud services?

Accepted Answer

Application & Interface Security (AIS)

Answer

The CCM's Application & Interface Security (AIS) domain covers controls for secure application development, testing, and integrity of customer-facing interfaces.

Question 2

What is the purpose of a Content Security Policy (CSP) HTTP response header in web application security?

Accepted Answer

It restricts the sources from which a browser can load resources, mitigating XSS attacks

Answer

CSP instructs the browser to only load resources (scripts, styles, images) from trusted origins, significantly reducing the risk of Cross-Site Scripting (XSS) attacks.

Question 3

When performing penetration testing on a cloud application, which action MUST be taken before starting to avoid violating the cloud provider's terms of service?

Accepted Answer

Obtain prior written authorization from the cloud provider and the application owner

Answer

Cloud providers require customers to request explicit authorization before conducting penetration tests; failure to do so may violate terms of service and result in account suspension.

Question 4

Which secure coding practice specifically prevents SQL Injection attacks in cloud-hosted database-backed applications?

Accepted Answer

Parameterized queries (prepared statements)

Answer

Parameterized queries separate SQL code from user-supplied data, ensuring that user input is always treated as a data value and never interpreted as executable SQL.

Question 5

In a serverless cloud application, which security consideration is unique compared to traditional application hosting?

Accepted Answer

Overly permissive function-level IAM roles and event injection via triggers

Answer

Serverless functions often inherit overly permissive IAM roles, and their many event-based triggers (S3, SQS, API Gateway) can be exploited for injection attacks if inputs are not validated.

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK Cloud Application Security 3