Domain 4: Cloud Application Security Flashcards

Question

Ian wants to use a cloud-specific list of application issues. Which of the following options should he choose? A. The OWASP Top 10 B. The NIST Dirty Dozen C. The SANS Top 25 D. The MITRE ATT&CK-RS

Answer 1

**Answer: A. The OWASP Top 10** **The OWASP Top 10 is a cloud-specific list, whereas the SANS Top 25 describes the software errors in general.** The NIST Dirty Dozen and the MITRE ATT&CK- RS were made up for this question.

Answer 2

**Answer: D. Major.minor.patch** Major.minor.patch is a common format for versioning. While there’s no industry standard, having the versioning numbers in an order of scale is a common practice.

Answer 3

**Answer: B. SBOM** A software bill of materials (SBOM) is a listing of all of the components of a software package or program, and it is considered increasingly important as part of a software security program.

Answer 4

**Answer: B. A WAF** Web application firewalls (WAFs) typically have built-in protection against common attacks like SQL injection. Valerie should choose a WAF to protect against both the SQL injection she’s aware of and other common attacks against web applications.

Answer 5

**Answer: B. Containers** Containers allow applications to be moved easily because they contain the dependencies and components the application needs without requiring a complete operating system to be packaged with them. Packages are software components, and virtual machines run on hypervisors.

Answer 6

**Answer: B. SSO** **Charles is using a single-sign-on (SSO) technology to allow him to log in once and use many services and systems.** SAML and OpenID Connect are used for federation, while OTP is a one-time password.

Answer 7

**Answer: A. API keys** **Henry’s organization should use API keys to ensure that only authorized users are able to use the APIs that they expose for customer use.**

Answer 8

**Answer: A. The license term** **Nancy knows that she should keep track of the license term, or how long the license is valid for, so that the software does not disable itself when the license or contract expires.** The cost, whether the terms can be disclosed, and if there is third-party software involved, are less likely to be the cause of service interruptions.

Answer 9

**Answer: B. FIPS 140-2** **FIPS 140- 2, a Federal Information Processing Standard, defines the requirements for cryptographic modules and is a commonly used standard to assess cryptographic systems, and it’s the only currently valid cryptographic standard listed here.** SSL is outdated and has been replaced by TLS, SHA-2 is a hashing algorithm, and GDPR is a European Union data protection regulation.

Answer 10

**Answer: C. Use dynamic secrets.** **Using dynamic secrets— secrets that are generated and used as they are needed— allows for granular auditing of uses because each secret is created as needed and thus their specific usage can be reviewed as needed.** Shared accounts don’t allow auditing because actions cannot be provably linked to individual users. Multifactor authentication helps prevent stolen credentials and brute-force attacks, but won’t increase the auditability of usage, and API keys allow API authentication, but like multifactor authentication, don’t increase the individual auditability of usage as much as dynamic secrets do.

Answer 11

**Answer: D. Security** Testing the performance and security of software is expected in the Testing phase of the SDLC. **The version, complexity, and size of the code are not commonly tested elements.**

Answer 12

**Answer: A. KMS** Chris should look for a key management service (KMS). KMSs allow creation, storage, management, and auditing of keys. A PKI is a public key infrastructure, a CA is a certificate authority, and a KCS was made up for this question— none of them will provide the services that Chris is looking for.

Answer 13

**Answer: A. IdP** **Identity providers (IdPs) provide authentication as well as create, manage, and maintain identities and identity information.** Relying parties and service providers both trust IdPs to handle authentication, and SSO is Single-Sign-On.

Answer 14

**Answer: C. A containerization platform** Docker is a containerization tool.

Answer 15

**Answer: D. The vendor is responsible for the environment.** **Yasmine knows that in an SaaS environment, the vendor is responsible for the applications, data storage, runtime and middleware, operating systems and servers, storage, and networking.** Yasmine’s company will be responsible for how they operate the software, who they provide access to, and what rights they provide to their users, as well as ensuring that her data is safe and secure.

Answer 16

**Answer: B. A username, password, and app-generated code on a phone** Multifactor authentication relies on using two different types of factors: something you know, like a password or PIN; something you have, like a hardware token or application-generated PIN; or something you are, such as a biometric identifier. Jason knows that a password and an app-generated PIN count as using multiple factors.

Answer 17

**Answer: C. Git** Git provides version management as part of its capabilities. Jenkins is a CI/CD tool used for continuous integration tooling. Puppet and Chef are both infrastructure automation tools.

Answer 18

**Answer: A. Federated identity** **Ramon’s organization is using Azure’s federation capability to leverage its existing on-site credentials in the cloud.** Structured, shared, and constrained identity was made up for this question.

Answer 19

**Answer: D. Software inventory** **Having a complete software inventory allows organizations like Gretchen’s to ensure that they are aware of their software license compliances, terms, and conditions as well as their license expiration dates.** While only using open-source software might seem like an easy solution, there are multiple open-source software licenses that have different requirements, making a software inventory necessary. Using only commercial software doesn’t simplify the requirement, and software versioning is important but would be part of a complete inventory.

Answer 20

**Answer: A. DREAD** DREAD has been replaced with STRIDE by Microsoft. PASTA and ATASM are in active use. DREAD (Damage, Reproducibility, Exploitability, Affected Users, Discoverability) is the risk assessment model.

Answer 21

**Answer: A. To control usage-based costs** **CASBs are often used to control usage based on roles and rights, but they aren’t used to monitor based on costs in the cloud service itself— instead, cost limiting rules are often used in the cloud services themselves.** They are also used to limit the potential for sensitive data loss and to detect anomalous usage patterns.

Answer 22

**Answer: C. Sandboxing** **Kathleen knows that sandboxing, or creating a secure and isolated environment, is commonly used for malicious software testing.** An IPS or antivirus can be used to detect malicious activities and might be deployed in the sandbox as part of the instrumentation. A SIEM solution is used to centralize and correlate security events and information.

Answer 23

**Answer: A. Encryption** **Using the CASB to enforce encryption between an on-premises location and cloud providers will provide the most effective protection against third parties seeing the data in transit.** Tokenization and masking help protect data while it is being accessed, but don’t prevent it from being exposed in transit. Upload prevention doesn’t prevent downloads from being accessed.

Answer 24

**Answer: A. The host kernel for the operating system** Containers contain elements of the operating system but share the host’s kernel. They also contain libraries, configuration files, and the application files or binaries themselves.

Answer 25

**Answer: A. Unique, random, and non-guessable** API keys should be unique, random, and non-guessable to ensure that attackers cannot guess or otherwise identify them.

Answer 26

**Answer: C. Identity and service** Ian can filter based on user identity and the service the users are attempting to use to most effectively filter service usage by role. Activity and data don’t identify the user, and activities don’t necessarily uniquely identify a service.

Answer 27

**Answer: A. Attacks** ATASM considers architecture, threats, attack surfaces (not attacks) and mitigations. ATASM (Architecture, Threats, Attack Surfaces, and Mitigations).

Answer 28

**Answer: A. Dynamic** Testing done against running code is called dynamic testing. Static testing reviews source code. Automatic and structured testing are not commonly used testing terms.

Answer 29

**Answer: D. Hypertext Transfer Protocol (HTTP)** WAFs focus on web traffic and thus typically scan HTTP traffic rather than BGP, ICMP, or SMTP traffic.

Answer 30

**Answer: B. Design** **The Design phase allows Henry to include security design elements that will help ensure that his application is secure.** The Requirements phase should include the need for security, but won’t specify how it will be accomplished, and deployment and maintenance are too late as the architecture has already been designed and implemented.

Answer 31

**Answer: C. Running malware for analysis purposes** **A sandbox can be used to run malware for analysis purposes as it won’t affect (or infect) the production environment; it’s worth noting, though, that some malware is sandbox-aware, so additional antimalware measures are advisable.** Optimizing production by moving tasks isn’t a typical use for a sandbox, remote secure access systems are called jumpboxes, and subnets are created using network configurations.

Answer 32

**Answer: B. Use containers configured for the application to host the application. ** **Containerization best meets the platform-agnostic approach that matches Valerie’s requirements.** While serverless is powerful, moving between native serverless platforms typically requires building to each provider’s requirements. Virtual machines have more overhead than Valerie needs, and not configuring them for the application only makes them less suited to the task.

Answer 33

**Answer: D. A DAM** **A Database Activity Monitor (DAM) solution provides database activity monitoring that includes privileged account usage logging and monitoring in addition to other security and monitoring features.** A WAF would help with web application security issues but doesn’t meet the need described here. DB- IPS and database SIEMs were made up for this question.

Answer 34

**Answer: D. Require authentication and set throttling limits and quotas.** **Requiring authentication and setting throttling limits and quotas help to prevent Denial-Of-Service (DOS) attacks on APIs.** Scalable architecture can help handle the load, but won’t stop the attacks from occurring, and using an IPS might help stop attacks, but an API gateway would be more likely to understand API traffic.

Answer 35

**Answer: C. Testing software before putting it into production.** **Software that has either been purchased from a vendor or developed internally can be tested in a sandboxed environment that mimics the production environment in order to determine whether there will be any interoperability problems when it is installed into actual production.** It isn’t used for user awareness, regulatory requirement evaluation, or API security testing in most cases.

Answer 36

**Answer: C. FIPS 140-2** **FIPS 140- 2 is a U.S. government standard that specifies the security requirements for cryptographic modules.** If the module Jen is using is FIPS 140- 2-certified, she will have met her goal. PCI compliance is used for credit cards, AES is not a certification, and GLBA is a U.S. act that requires financial institutions to secure their customers' private information.

Answer 37

**Answer: B. Rotate secrets.** Rotating secrets limits the blast radius of exposed or compromised secrets. Extending their lifecycle does the opposite and means they can have a longer lifecycle in the hands of attackers. Replacing secrets with tokens won’t meet the needs of most service environments. While certificate revocation lists (CRLs) exist, secret expiration lists do not.

Answer 38

**Answer: B. Functional testing** **Olivia is conducting functional testing that seeks to test whether the software meets business requirements.** This does not specify a load or stress test scenario.

Answer 39

**Answer: C. SMS factors** **SMS factors are considered the least secure of these options because of SIM swapping and VoIP-based attacks on SMS messages.**

Answer 40

**Answer: C. Use manual security testing of the source code.** **Review of the source code is static testing and does not meet Ben’s needs. The other answers all include dynamic testing options.**

Answer 41

**Answer: B. Use a CAPTCHA before allowing user actions.** **CAPTCHA-based security systems help to reduce the impact of bots by requiring human interaction.** While there are ways to work around CAPTCHAs, Yariv knows that they require additional work from attackers and will help reduce the overall load from bots. SQL injection and XSS are not mentioned in the question, and requiring logins without additional protections will not help.

Answer 42

**Answer: D. Google is the identity provider.** **When Emily logs in using her Google credentials, Google acts as the identity provider and tells the third-party service provider that she has logged in using her user ID and passwords successfully.** The service provider must then authorize her to use the services. Nothing in the question indicates whether the service provider may be a storage provider.

Answer 43

**Answer: D. Randomizing customer data** Not all programs (or organizations) will require database access, or even use databases, and hashing is not a common requirement since the data will not be readable. Encryption at rest and in transit, as well as data masking, are all commonly employed to protect sensitive information.

Answer 44

**Answer: C. An XML firewall** **SAML is an XML-based protocol, and Kristen knows that an XML firewall that is SAML-aware with appropriate rules for identity-based protection would be her best option.** IDS systems cannot rate-limit even if they are SAML-aware. WAFs are designed for web applications rather than specifically for XML and SAML-based filtering, and a DAM is a database- specific tool.

Answer 45

**Answer: C. Prevents the use of multifactor authentication** **Using SSO does not prevent the use of multifactor authentication.** In fact, it often makes it easier since organizations can centralize their use of MFA.

Answer 46

**Answer: D. Source code** **Static testing reviews source code. Dynamic testing would test outcomes and performance.**

Answer 47

**Answer: B. Biometric readers** **Biometric readers are the least likely secondary factor to be supported by cloud vendors.** Hardware and software tokens as well as SMS factors are commonly supported by cloud providers.

Answer 48

**Answer: D. Requirements Gathering** **Once planning is done, organizations typically move into the Requirements Gathering phase to ensure they know what the software they will build will do.** Design, Build, Test, Deploy, and Maintain are common follow-up phases.

Answer 49

**Answer: B. The outcome of each phase serves as the input to the next phase.** Waterfall phases each serve as the input for the next phase and move only in one direction.

Answer 50

**Answer: B. Design** Requirements are typically mapped to the software in the Design phase. Requirements will be created in the Define phase, validated in the Test phase, and, of course, the software will be run in production in the Operations phase.

Answer 51

**Answer: D. Nonfunctional testing** **Nonfunctional testing seeks to test whether it meets customer expectations and performance requirements, including how software behaves under abnormal conditions.** Black box, or zero knowledge, testing attempts to replicate an attacker’s experience; white box, or full knowledge, testing provides complete insight into an environment or tool, including access to source code and documentation, and functional testing is conducted based on business requirements.

Answer 52

**Answer: D. Review the licenses for each component to ensure they are in compliance.** **Since there are some different open source licenses, Gabriel’s best bet is to ensure that his organization reviews the licenses that apply to each software package or component they use.** This can be complex and time-consuming, and organizations often limit the licenses they are willing to accept to reduce of this burden.

Answer 53

**Answer: B. Malware** **Injection, distributed denial-of-service, cross-site scripting, on-path, and credential stuffing attacks are all commonly aimed at APIs. Malware attacks, however, are not a common API threat.**

Answer 54

**Answer: B. Handling errors in a secure and graceful way.** **The SAFECode fundamental practices note that errors should be handled in a secure and graceful way.** It recommends against providing too much information in errors and that unanticipated errors should be flagged to both users and administrators, but with different levels of information appropriate to each group.

Answer 55

**Answer: C. Jason should use a commercial certificate authority.** **Jason should use a commercial certificate authority for any certificate used in production.** This allows users to validate the certificate and the certificate chain to ensure trust.

Answer 56

**Answer: B. The cryptographic signature** **A signature ensures that the file is both the correct file and that it has not been changed, and validates that it was provided by the signer.** An SHA2 hash is the second-best option, although attackers might modify the hash on the site or modify the file before it is hashed. File size and version number are the least useful options.

Answer 57

**Answer: A. IAST** **Interactive application security testing (IAST) uses software instrumentation to validate performance and function, and is typically conducted during the QA/Test phase of the SDLC.** SCA, or software composition analysis, reviews the components that make up an application. Interactive and structured DST were made up for this question.

Answer 58

**Answer: A. Ensuring encryption algorithms cannot be changed easily.** **Changing encryption algorithms if a problem is found with one that is currently in use is, actually, a best practice that SAFECode recommends.** They call it “cryptographic agility”, and note that you need to be able to transition to new mechanisms, libraries, and keys when needed. Defining what to protect, what mechanisms will be used, and how keys and certificates will be managed are all common best practices and are also recommended by SAFECode.

Answer 59

**Answer: A. Cloud customer** **In a PaaS environment, the customer is responsible for the security of applications in the production environment.** The service provider will be responsible for the underlying hardware and platform itself.

Answer 60

**Answer: A. Abuse case testing** **Abuse case testing will test how users could abuse the software, including the type of issues James is concerned about.** White box, or full knowledge, testing, and black box, or zero knowledge, testing both describe the amount of information that testers have about the environment, and use case testing validates how software is supposed to be used, not how it could be abused.

Answer 61

**Answer: D. LDAP** **Active Directory, SAML, and vendor-native SSO options are all commonly supported, but LDAP is not a commonly supported SSO option for most cloud vendors.**

Answer 62

**Answer: A. Define** **In the Define phase, organizations work to determine the purpose of the software and what it needs to do to meet the needs of users.** Design and Development stages, then work to architect and build software that meets those requirements. Detect is not an SDLC phase.

Answer 63

**Answer: C. Set a non-privileged user as the process owner.** **Setting a nonprivileged user as the process owner will work in many cases. Setting the container owner as a nonprivileged user won’t stop root from running it in a poor configuration.** Limiting root login or requiring multifactor won’t stop a process from running as root either.

Answer 64

**Answer: A. Static testing** **Jessica should perform static testing to help her organization identify code quality issues by reviewing the source code for the application.** Dynamic testing can identify functional issues, but may not identify code quality or business logic flaws. Black box testing won’t allow the access to the code she needs, and software composition analysis seeks to understand what components make up an application.

Answer 65

**Answer: B. The ability of internal personnel to trigger business continuity/disaster recovery activities. (BC/DR) ** **The STRIDE threat model does not deal with business continuity and disaster recovery (BC/DR) actions. All the other options are elements of STRIDE: escalation of privilege, repudiation, and spoofing.**

Answer 66

**Answer: D. API gateway** **API gateways are well suited to this type of architecture because they focus on service discovery and API security as well as rate-limiting and other security controls like authentication.** XML firewalls and cloud application security brokers (CASBs) are both used for other purposes, and RPC gateways allow remote procedure calls to other networks and services.

Answer 67

**Answer: A. Define** **The earlier security inputs are included in the project, the more efficient and less costly security controls are overall. The Define phase is the earliest part of the SDLC, and thus is when security staff should be included.**

Answer 68

**Answer: A. Dynamic, nonfunctional testing** **Tahir is conducting a non-functional test that checks for behavior under load, and since the program is actually running, it is dynamic testing rather than static testing of source code.**

Answer 69

**Answer: B. SSO** **Joanna is using a Single-Sign-On (SSO) infrastructure to allow her to sign on in one location and to use those credentials in multiple locations with various service providers.** RDP (Remote Desktop Protocol) is used for graphical access to Windows systems, OTP is a one-time password, and MFA is multifactor authentication.

Answer 70

**Answer: A. Integrity** Tampering impacts the integrity of data by modifying it.

Answer 71

**Answer: C. OWASP** OWASP, the Open Web Application Security Project, provides both cloud and web application security Top 10 lists that are community-sourced and which are well suited to awareness training. ASVS sets standards for application validation and security testing. CVE and NIST are not community-based web application security guides.

Answer 72

**Answer: D. Testing** Interactive application security testing (IAST) would be most likely to occur during the Testing phase of the SDLC.

Answer 73

**Answer: C. Generate passphrases randomly.** **Using automated creation tools for passphrases will prevent staff members from reusing passwords or falling into habits that result in easily guessed passphrases and passwords.** Using a word list, shared passphrases, or simply adding complexity will not meet Malika’s needs.

Answer 74

**Answer: A. SAML** **SAML (Security Assertion Markup Language) is commonly used to enable identity federation.** FIPS 140- 2 is a U.S. government encryption mechanism standard, XML may be needed, but is a very broad standard for extensible markup languages, and FIM is federated identity management, a generic term describing the overall concept, not a technology or technological capability.

Answer 75

**Answer: C. Replicate the production environment for QA testing, then promote to production after testing.** Replicating production for QA testing, then promoting from QA to production once testing is complete, is a common design practice in application development environments. Adding software going through QA to production environments or allowing users to use QA systems instead of production can lead to a negative user experience, and creating a QA environment that doesn’t match production may invalidate testing.

Answer 76

**Answer: A. ASVS** ASVS uses a three-level code validation assurance level model, with level 3 requiring critical applications to meet in-depth validation and testing requirements. The OWASP Application Security Verification Standard (ASVS) is a security standard that helps organizations develop, maintain, and test secure applications, and it is relevant to the CCSP (Certified Cloud Security Professional) certification. ASVS is particularly useful for understanding and applying cloud application security principles. Level 3. Level 3 of the ASVS is the most rigorous level of security requirements. It includes all the requirements from Levels 1 and 2, adding additional requirements considered best practices for securing web applications.