Cloud Application Security Flashcards
6 cards from real CCSP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Cloud Application Security flashcards as text
What is Cross-Site Request Forgery (CSRF) and how is it typically mitigated?
Answer: An attack that tricks users into submitting unauthorized requests, mitigated by anti-CSRF tokens
CSRF tricks authenticated users into unknowingly submitting requests to a web application; anti-CSRF tokens verify that requests originate from legitimate user sessions.
Which security practice involves deliberately testing an application by providing random, unexpected, or malformed input?
Answer: Fuzz testing (fuzzing)
Fuzz testing (fuzzing) bombards an application with random or malformed inputs to discover crashes, exceptions, and security vulnerabilities the developer didn't anticipate.
What is the OWASP Secure Coding Practices guideline's primary recommendation for handling user input?
Answer: Validate and sanitize all input from untrusted sources
OWASP recommends treating all input from external sources as untrusted and applying validation, sanitization, and encoding to prevent injection and other attacks.
What does a runtime application self-protection (RASP) solution do?
Answer: Instruments the application to detect and block attacks in real time from within the running process
RASP integrates into the application runtime to monitor execution, detect attack patterns, and block malicious actions from within the application itself.
Why is input validation considered insufficient as the sole defense against SQL injection?
Answer: Validation can be bypassed through encoding tricks; parameterized queries provide a stronger architectural defense
Input validation alone can be circumvented by encoding or obfuscation; parameterized queries (prepared statements) prevent injection at the architectural level by separating code from data.
Which cloud application security component validates the identity of API consumers using client credentials before granting access?
Answer: API Key / OAuth 2.0 Client Credentials flow
API keys or the OAuth 2.0 client credentials grant are used to authenticate machine-to-machine API consumers, ensuring only authorized clients can call the API.