CCSK Cloud Application Security

Question 1

Which methodology integrates security practices directly into the DevOps pipeline for cloud applications?

Accepted Answer

DevSecOps

Answer

DevSecOps embeds security checks and automation throughout the DevOps pipeline so vulnerabilities are caught early in the development lifecycle.

Question 2

According to the CSA CCSK guidance, which phase of the Secure Software Development Lifecycle (SSDLC) should threat modeling occur?

Accepted Answer

Design

Answer

Threat modeling should be performed during the Design phase so that security requirements and mitigations are built into the architecture before code is written.

Question 3

What is the primary purpose of a Web Application Firewall (WAF) deployed in front of a cloud-hosted application?

Accepted Answer

Filter and monitor HTTP/HTTPS traffic to block application-layer attacks

Answer

A WAF inspects HTTP/HTTPS traffic and blocks application-layer attacks such as SQL injection and cross-site scripting before they reach the application.

Question 4

In cloud-native application development, which practice helps ensure that secrets such as API keys and database credentials are NOT hardcoded in source code?

Accepted Answer

Use of a secrets management service or vault

Answer

Secrets management services (e.g., HashiCorp Vault or cloud-native equivalents) store and inject credentials at runtime, preventing them from being embedded in source code.

Question 5

Which OWASP resource specifically addresses the most critical security risks found in web applications and is commonly referenced in CCSK cloud application security?

Accepted Answer

OWASP Top 10

Answer

The OWASP Top 10 is the widely recognized list of the most critical web application security risks and is a key reference for cloud application security.

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK Cloud Application Security