I85PREP
⌘ K
CCAS study materials
CCAS study resources

CCAS: Cloud Application Security Testing and Vulnerability Management

CCAS · Work through your exam, one topic at a time.

All guide sections

Cloud Application Security Testing and Vulnerability Management

This domain tests prioritization and coverage: scanners produce findings, not risk. Expect items that give you two findings and ask which to fix first, or that probe what a given tool class can and cannot see.

Core rules

  • Know each tool's blind spots. SAST reads source without runtime context. SCA covers dependencies and needs reachability analysis. DAST exercises the running application and needs credentials and good coverage to be meaningful. IaC scanning catches pre-deployment misconfiguration. Image scanning covers OS packages and libraries. CSPM catches configuration drift in cloud accounts. CNAPP aggregates these views.
  • Scan authenticated wherever possible; unauthenticated DAST misses most of an application's functionality.
  • Prioritize on exploitability and exposure, not base score alone: environmental and temporal CVSS metrics, EPSS, known-exploited-vulnerability catalogs, internet reachability, and data sensitivity all reorder the queue.
  • Set tiered remediation SLAs by severity and exposure, track exceptions with an owner and expiry, and retest to verify closure.
  • Penetration tests have scope, rules of engagement, and a formal report; bug bounties complement them but do not replace structured assurance.

Worked example

Two findings land the same day. The first is a CVSS 9.8 in a build-time library that is never shipped to production. The second is a CVSS 6.5 reflected XSS on the public login page. Reasoning: base score ranks the first higher, but that component is not deployed and not reachable by an attacker. The XSS is exploitable by any anonymous visitor and can harvest sessions. Remediate the XSS immediately; schedule the library upgrade. Your severity-mapping document should record why the ranking diverged from raw CVSS.

Traps

Ranking by CVSS alone; reading a clean scan as proof of no vulnerabilities; assuming containers are patched in place when base images must be rebuilt; dismissing misconfigurations because they carry no CVE; and testing only production while defects enter through the pipeline.