CCSP Cloud Application Security 2 — Questions and Answers
Question 1: What is the primary risk of storing sensitive data in JWT (JSON Web Token) payloads?
- JWTs cannot be transmitted over HTTPS
- JWT payloads are base64-encoded but not encrypted by default, making the data readable if intercepted (Correct answer)
- JWTs expire too quickly for production use
- JWTs are limited to 256 bytes
Correct answer: JWT payloads are base64-encoded but not encrypted by default, making the data readable if intercepted
JWT payloads are only base64url-encoded, not encrypted, so anyone who intercepts or decodes the token can read the claims within it.
Question 2: In a microservices architecture, what is mutual TLS (mTLS) used for?
- Encrypting data stored in databases
- Authenticating both the client and server to each other in service-to-service communication (Correct answer)
- Managing API rate limits
- Load balancing traffic between services
Correct answer: Authenticating both the client and server to each other in service-to-service communication
mTLS requires both communicating parties to present certificates, ensuring that each microservice can verify the identity of the other before exchanging data.
Question 3: Which threat modeling framework uses the mnemonic STRIDE to categorize threats?
- OWASP Threat Dragon
- Microsoft STRIDE model (Correct answer)
- NIST RMF
- PASTA framework
Correct answer: Microsoft STRIDE model
Microsoft's STRIDE model categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
Question 4: What is a major security concern with serverless (FaaS) applications in the cloud?
- Serverless functions cannot use HTTPS
- Insecure function triggers and over-permissive IAM roles granting excessive access (Correct answer)
- Functions are too slow for security-sensitive workloads
- Serverless platforms do not support logging
Correct answer: Insecure function triggers and over-permissive IAM roles granting excessive access
Serverless functions are often granted overly broad IAM permissions and may be triggered by insecure event sources, creating privilege escalation and injection risks.
Question 5: What is the purpose of an API gateway in cloud application security?
- To store API credentials securely
- To enforce authentication, rate limiting, and traffic management for API calls (Correct answer)
- To compile API source code
- To back up API response data
Correct answer: To enforce authentication, rate limiting, and traffic management for API calls
An API gateway centralizes authentication, authorization, rate limiting, and logging for all API traffic, acting as a single controlled entry point.
Question 6: In the context of DevSecOps, what does 'shift left' security mean?
- Moving security testing to the left side of the screen in dashboards
- Integrating security practices early in the development lifecycle rather than only at the end (Correct answer)
- Shifting security team responsibilities to developers entirely
- Using left-handed encryption algorithms
Correct answer: Integrating security practices early in the development lifecycle rather than only at the end
Shifting left means introducing security testing, code analysis, and threat modeling early in development rather than waiting until the deployment or production phase.
CCSP Cloud Application Security 2
What is the primary risk of storing sensitive data in JWT (JSON Web Token) payloads?