Cloud Application Security

CCSP · 48 questions

• During a design review for a new PaaS-hosted application, several developers argue that input validation and authorization checks are unnecessary because the cloud service provider secures the platform. What should the cloud security professional advocate?
• Developers migrating an application to the cloud leave calls between internal services unauthenticated, reasoning that only components inside the virtual network can reach them, as was true in the corporate data center. What awareness point should the cloud security professional emphasize?
• A tester for a cloud-hosted billing portal signs in as one customer, changes the numeric invoice identifier in the browser's URL, and is shown another customer's invoice. Under the OWASP Top 10, which risk category does this flaw belong to?
• A mobile app's back-end REST API returns any customer record when the caller supplies its object identifier, checking only that the caller presents a valid session token. Which risk from the OWASP API Security Top 10 does this describe?
• A cloud-hosted support chatbot built on a large language model summarizes documents that customers upload. A tester uploads a file containing hidden text that tells the model to ignore its rules and include a phishing link in its reply, and the chatbot complies. Which OWASP Top 10 for LLM Applications risk does this demonstrate?
• A team building a high-value cloud banking application needs a structured, testable set of security requirements, graded by the application's risk level, that testers can verify control by control. Which resource best fits this need?
• A product team building a cloud-native customer portal has defined its features and plans to 'add security' after launch, once it sees how customers use the service. According to secure SDLC practice, when should security requirements first be defined?
• A development team adopting a secure SDLC for a cloud application asks where threat modeling belongs in its sequence of requirements, design, development, testing, deployment and maintenance. In which phase should threat modeling first be performed?
• An agile team ships a cloud application every two weeks and has no security stage in its process. Leadership asks how to integrate security without returning to a waterfall-style security gate at the end of each release. Which approach best fits?
• A cloud-hosted internal application was released three years ago and is no longer actively developed, though it remains in production and processes employee data. Which secure SDLC activity is most important for it now?
• A healthcare provider is specifying a new cloud application. Its regulatory obligations require that every access to patient records be logged, recording who accessed which record and when. How should this obligation be handled in the SDLC?
• A risk assessment for a multi-tenant SaaS application notes that a vulnerability in the hypervisor or in a shared database engine could expose data belonging to every tenant at once. Which cloud-specific risk category does this describe?
• The threat model for a cloud application that handles trade secrets includes a malicious administrator employed by the cloud service provider. Which mitigation most directly reduces this risk?
• A team running an application on a PaaS offering discovers during an incident investigation that it cannot obtain operating system or platform-level logs, because the provider manages those layers and does not expose them to customers. Which cloud-specific risk has the team encountered?
• An architect designing a cloud application learns that the default storage region for its customer data is in a country whose laws allow broad government access to data held there, while many of the customers are subject to stricter privacy laws. Which SDLC response is most appropriate?
• While threat modeling a cloud trading application with STRIDE, the team finds that a user could submit an order and later credibly deny having done so, because the system keeps no reliable record that ties the action to the user. Which STRIDE category is this?
• After identifying the threats to a cloud API, a team needs to prioritize them by scoring each one on how much harm it could cause, how easily it can be reproduced and exploited, how many users it would affect, and how easily it could be found. Which model is designed for this rating step?
• A business wants a threat modeling methodology for its cloud platform that starts from business objectives and impact and proceeds through staged analysis, including attack simulation, to risk-based countermeasures. Which methodology fits best?
• A code review of a cloud-hosted order service finds SQL statements built by concatenating user-supplied search terms directly into query strings. Which remediation best addresses the root cause, consistent with OWASP ASVS and SAFECode secure coding guidance?
• Engineers at a SaaS company edit infrastructure templates and application configuration directly in production, leaving no record of who changed what, and they cannot roll back reliably when a change fails. Which practice should be introduced?
• A CI/CD pipeline for a cloud application runs unit and integration tests confirming that each feature behaves as specified, but nothing measures response time under load, behavior during failover, or security properties. What is missing from the test strategy?
• A security team wants every commit to a cloud application's repository analyzed for vulnerabilities such as injection flaws and hard-coded secrets before the code is ever compiled or run. Which testing approach fits this requirement?
• Testers are asked to assess a cloud web application from the outside, sending crafted requests to the running application, with no access to its source code or internal design. Which testing approach does this describe?
• A development team installs an agent inside its cloud application's runtime. While the QA team runs normal functional tests, the agent observes code execution and data flows and reports where untrusted input reaches a dangerous function. Which testing approach is this?
• A widely used open-source logging library bundled into a cloud application's build is disclosed to have a critical CVE. The team needs a tool that inventories every third-party dependency, including transitive ones, and flags known vulnerabilities on each build. Which tool category fits?
• Before a penetration test of a cloud application begins, the tester is given the full source code, the architecture diagrams and administrator credentials for the test environment. What kind of test is this?
• To speed up releases of a cloud application, the developers propose to perform and approve their own security testing and to remove the separate quality assurance function from the process. What is the main reason a cloud security professional should object?
• A cloud e-commerce application passed all of its functional tests, yet after launch users discovered they could apply the same single-use discount code thousands of times by replaying the request. Which testing practice would most likely have found this before release?
• A company exposes a public REST API from its cloud platform. A review finds that the API applies no request throttling and passes caller-supplied parameters directly to back-end services without any checks. Which set of controls best addresses these findings?
• A SaaS provider's public API authorizes every request with a single static API key embedded in a partner's application. The partner now needs each of its end users to see only their own data through that API. What should the API's authorization design change to?
• A CI pipeline for a cloud service pulls third-party packages from a public repository, and the security team is concerned that a package could be tampered with between its publication and the download. Which control most directly verifies integrity and authenticity before a package is used?
• A software vendor will supply a component that runs inside a company's cloud application and processes customer personal data. Before the component is approved, which activity is most appropriate as part of software supply-chain management?
• A company plans to distribute a proprietary application that embeds an open-source library released under a strong copyleft license. Which supply-chain risk should be raised before the product is released?
• An audit finds that several commercial off-the-shelf components deployed in a company's cloud workloads appear in no inventory, and no one tracks vendor security advisories for them. What should be established first?
• Developers want to add an obscure open-source package, maintained by a single anonymous contributor and last updated four years ago, to a cloud application that handles payments. What should the cloud security professional require before approval?
• A cloud application must block SQL injection attempts in HTTP traffic, validate the structure of incoming SOAP messages against their schemas, and enforce per-client request quotas on its REST APIs. Which assignment of controls fits these three needs?
• A database administrator at a company using a cloud-hosted relational database has begun running unusual bulk SELECT queries against customer tables late at night. Which control is designed to detect and alert on this activity independently of the administrator's own privileges?
• A cloud load balancer terminates TLS from clients and forwards requests to back-end application instances over unencrypted HTTP within the virtual network. A compliance requirement states that cardholder data must be encrypted throughout transmission. What should be done?
• A multi-tenant SaaS analytics platform lets customers upload their own transformation scripts, which run on the provider's shared worker fleet. Security is concerned that a malicious script could read other tenants' data or tamper with the underlying host. Which architectural control best addresses this risk?
• A review of a cloud container platform finds three issues: application containers run in privileged mode, images are built from public base images that are never scanned, and orchestrator secrets are readable from every namespace. Which remediation plan best addresses all three findings?
• A cloud-native application consists of dozens of microservices. Any workload on the internal cluster network can call any service's API, and services trust requests based only on the caller's source IP range. The architect wants every service-to-service call authenticated and encrypted without rewriting each service. What is the best approach?
• A company's employees need access to a business partner's SaaS application. The partner does not want to manage passwords for the company's staff, and the company wants its own MFA requirements and leaver process to govern that access. Which design best meets both needs?
• An audit finds that terminated employees keep active accounts in several SaaS applications for weeks after leaving, because each application owner removes users manually whenever a ticket eventually arrives. Which control best fixes the root cause?
• After rolling out single sign-on to forty cloud applications, the CISO points out that one phished password would now give an attacker access to all of them. What is the most effective way to reduce this risk while keeping SSO in place?
• A cloud application's sign-in page asks for a password and then for the answer to a personal security question. The vendor markets this as multifactor authentication. How should the security architect assess the claim?
• A security team must scan files already stored in the company's sanctioned SaaS collaboration suite for sensitive data, and also block uploads in real time when users browse to unsanctioned file-sharing sites. Which CASB deployment meets both requirements?
• The CISO suspects that departments are using many cloud applications IT never approved, but there is no inventory of them. What is the best first step to identify which cloud services are actually in use across the organization?
• Developers have embedded a database password in an application's configuration file, which is committed to the source code repository. The application runs on cloud compute instances. What is the best way to supply this credential to the application?