CCSK Cloud Application Security 1 — Questions and Answers
Question 1: Which methodology integrates security practices directly into the DevOps pipeline for cloud applications?
- DevSecOps (Correct answer)
- Agile Security
- Waterfall Assurance
- SecureOps
Correct answer: DevSecOps
DevSecOps embeds security checks and automation throughout the DevOps pipeline so vulnerabilities are caught early in the development lifecycle.
Question 2: According to the CSA CCSK guidance, which phase of the Secure Software Development Lifecycle (SSDLC) should threat modeling occur?
- Testing
- Design (Correct answer)
- Deployment
- Operations
Correct answer: Design
Threat modeling should be performed during the Design phase so that security requirements and mitigations are built into the architecture before code is written.
Question 3: What is the primary purpose of a Web Application Firewall (WAF) deployed in front of a cloud-hosted application?
- Encrypt data at rest
- Filter and monitor HTTP/HTTPS traffic to block application-layer attacks (Correct answer)
- Manage user identities and access tokens
- Provide DDoS protection at the network layer
Correct answer: Filter and monitor HTTP/HTTPS traffic to block application-layer attacks
A WAF inspects HTTP/HTTPS traffic and blocks application-layer attacks such as SQL injection and cross-site scripting before they reach the application.
Question 4: In cloud-native application development, which practice helps ensure that secrets such as API keys and database credentials are NOT hardcoded in source code?
- Code obfuscation
- Use of a secrets management service or vault (Correct answer)
- Role-based access control
- Static application security testing
Correct answer: Use of a secrets management service or vault
Secrets management services (e.g., HashiCorp Vault or cloud-native equivalents) store and inject credentials at runtime, preventing them from being embedded in source code.
Question 5: Which OWASP resource specifically addresses the most critical security risks found in web applications and is commonly referenced in CCSK cloud application security?
- OWASP SAMM
- OWASP ASVS
- OWASP Top 10 (Correct answer)
- OWASP Testing Guide
Correct answer: OWASP Top 10
The OWASP Top 10 is the widely recognized list of the most critical web application security risks and is a key reference for cloud application security.
Question 6: Static Application Security Testing (SAST) tools analyze an application to find vulnerabilities at which stage?
- At runtime during production
- During the design phase before coding begins
- By examining source code or binaries without executing the program (Correct answer)
- By monitoring live network traffic
Correct answer: By examining source code or binaries without executing the program
SAST analyzes source code, bytecode, or binaries in a non-running state, enabling early detection of vulnerabilities before deployment.
Question 7: In the context of cloud application security, what does the term 'shift left' mean?
- Moving workloads to a different cloud region
- Integrating security activities earlier in the development lifecycle (Correct answer)
- Shifting responsibility for security from developers to operations
- Migrating on-premises apps to the cloud
Correct answer: Integrating security activities earlier in the development lifecycle
Shifting left means incorporating security testing and reviews earlier in the SDLC — during design and development — rather than waiting until testing or deployment.
CCSK Cloud Application Security 1
Which methodology integrates security practices directly into the DevOps pipeline for cloud applications?