CCSP Cloud Application Security 1 — Questions and Answers
Question 1: Which OWASP Top 10 vulnerability involves attackers manipulating SQL queries by injecting malicious input?
- Broken Access Control
- SQL Injection (Correct answer)
- Security Misconfiguration
- Insecure Deserialization
Correct answer: SQL Injection
SQL injection occurs when user-supplied input is incorporated into a SQL query without proper sanitization, allowing attackers to manipulate the database.
Question 2: What is the primary purpose of a Web Application Firewall (WAF) in cloud application security?
- To encrypt traffic between the browser and server
- To filter and monitor HTTP traffic to protect web applications from common exploits (Correct answer)
- To manage API authentication tokens
- To cache web content for faster delivery
Correct answer: To filter and monitor HTTP traffic to protect web applications from common exploits
A WAF inspects HTTP/HTTPS requests and responses, blocking attacks such as SQL injection, XSS, and CSRF before they reach the application.
Question 3: In secure software development for cloud applications, what does SAST (Static Application Security Testing) analyze?
- Running application behavior in production
- Source code or compiled binaries without executing the program (Correct answer)
- Network traffic between microservices
- Container image vulnerabilities
Correct answer: Source code or compiled binaries without executing the program
SAST tools analyze source code, bytecode, or binaries statically to identify security vulnerabilities early in the development lifecycle before the code runs.
Question 4: What is OAuth 2.0 primarily used for in cloud applications?
- Encrypting data in transit
- Delegated authorization, allowing applications to access resources on behalf of users without sharing credentials (Correct answer)
- Multi-factor authentication
- Digital certificate management
Correct answer: Delegated authorization, allowing applications to access resources on behalf of users without sharing credentials
OAuth 2.0 is an authorization framework that enables a third-party application to obtain limited access to a service on behalf of a user without exposing their password.
Question 5: Which secure development practice involves reviewing code written by another developer to identify security flaws before deployment?
- Threat modeling
- Peer code review / security code review (Correct answer)
- Fuzz testing
- Regression testing
Correct answer: Peer code review / security code review
Security-focused code review uses a second developer (or automated tool) to scrutinize code for vulnerabilities before it is merged or deployed.
Question 6: What does the term 'defense in depth' mean when applied to cloud application security?
- Using the deepest available encryption algorithm
- Applying multiple overlapping layers of security controls so that no single failure compromises the whole system (Correct answer)
- Deeply scanning network packets
- Running security tests after every code commit
Correct answer: Applying multiple overlapping layers of security controls so that no single failure compromises the whole system
Defense in depth stacks multiple independent security controls (WAF, authentication, encryption, monitoring) so that an attacker must bypass every layer to succeed.
CCSP Cloud Application Security 1
Which OWASP Top 10 vulnerability involves attackers manipulating SQL queries by injecting malicious input?