Domain 10 - Application Security

Question 1

What are Cloud Computing Opportunities to Application Security?

Answer 1

• Higher Baseline Security
• Responsiveness
• Isolated Environments
• Independent Virtual Machines
• Elasticity
• DevOps
• Unified Interface

Question 2

True/False: In a cloud environment, major baseline security failures completely undermine the trust
that a public cloud provider needs in order to maintain relationships with its customer base.

Answer 2

True

Question 3

_______ is a new application development methodology and philosophy focused
on automation of application development and deployment.

Answer 3

DevOps

Question 4

What are the cloud computing challenges to Application Security?

Answer 4

• Limited Detailed Visibility
• Increased Application Scope
• Changing Threat Models
• Reduced Transparency

Question 5

What are some of SDLC Frameworks?

Answer 5

• Microsoft Developent Lifecycle
• NIST 800-64
• ISO/IEC 27034
• OWASP

Question 6

What are the CSA Meta phases of SDLC?

Answer 6

• Secure Design and Development
• Secure Deployment
• Secure Operations

Question 7

5 Main Phases in Secure Design and Development

Answer 7

• Training
• Define
• Design
• Develop
• Test

Question 8

Multiple Kind of Application Security Test

Answer 8

• Code Review
• Unit, regression and functional test
• SAST
• DAST

Question 9

CSA Cloud Penetration Testing Recommendations

Answer 9

• Use experienced cloud provider testing firm
• Include developer and adminitrator in scoping
• In multi-tenant app, all testers to act as tenant

Question 10

Impact of Cloud in Application Design and Architectures

Answer 10

• Segregation by Default
• Immutable Infrastructure
• Increased use of micro-services
• PaaS and Serverless architectures
• Software Defined Security
• Event Driven Security

Question 11

________refers to the deeper integration of development and operations teams through better
collaboration and communications, with a heavy focus on automating application deployment and
infrastructure operations.

Answer 11

DevOps

Question 12

Security Implications and Advantages of DevOps

Answer 12

• Standardisation
• Automated Testing
• Immutable
• Improved Auditing and Change Management
• SecDevOps/DevSecOps and Rugged DevOps

Question 13

__________ sometimes refers to the
use of DevOps automation techniques to improve security operations. These two terms are emerging to describe the integration of security activities into DevOps

Answer 13

SecDevOps/DevSecOps

Question 14

In DevOps, _________ refers
to integration of security testing into the application development process to produce harder,
more secure, and more resilient applications

Answer 14

Rugged DevOps