CCSP - Cloud Application Security (16% of the exam) - Section 4.1
Advocate training and awareness for application security.
Cloud development basics, common implementation pitfalls, and the common cloud vulnerabilities that developer security training and awareness is meant to prevent.
secure development trainingOWASP Top 10common cloud vulnerabilitiescloud development pitfalls
A team lead wants developer training to focus on the most common categories of web application security risk. Which resource is specifically designed to catalogue those widespread risks for awareness and training?
AThe OWASP Top 10, a consensus list of the most critical web application security risks.check_circle Correct
BThe shared responsibility model, which allocates security duties between the cloud provider and the customer.
CA service level agreement, which defines the availability and performance commitments of a cloud service.
DA recovery time objective, which sets the maximum tolerable duration to restore a service after disruption.
The OWASP Top 10 is the standard awareness reference for the most common web application security risks used in developer training. The OWASP Top 10 exists precisely to raise awareness of the categories of web application weakness that appear most often and cause the most harm, such as injection and broken access control. It gives training programmes a shared, prioritised vocabulary, which is why it is the resource pointed to for application security awareness rather than contractual or continuity artefacts.
Why A is correct: Correct. The OWASP Top 10 is a widely used awareness document that ranks the most common and impactful web application security risks.
Why B is wrong: Tempting because it is central to cloud security, but it divides operational responsibility rather than cataloguing common application vulnerabilities.
Why C is wrong: Tempting because it governs the provider relationship, but an SLA sets service commitments and does not list web application risks.
Why D is wrong: Tempting because it is a familiar security metric, but an RTO is a continuity target and has nothing to do with cataloguing application risks.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
It transfers legal liability for any breach from the provider to the individual developers who wrote the vulnerable code.
errorWhy it is wrong: Tempting because training assigns responsibility, but awareness programmes do not reassign legal liability to individuals; accountability stays organisational.
Configuring platform-level web application firewall rules to block malicious request patterns
errorWhy it is wrong: A WAF can mitigate some injection attempts and is tempting because it addresses the same threat, but it is an operational control rather than a developer awareness topic and does not stop developers writing unsafe query code.
The cloud infrastructure provider, because it owns the physical and virtualisation layers
errorWhy it is wrong: The infrastructure provider does secure its own layers, which makes this tempting, but application security awareness for the SaaS code base is not something the underlying IaaS or platform vendor delivers.