Cloud Application Security
Where application security lives
Cloud applications are built, not just deployed, so the exam tests the SDLC: requirements, threat modeling, secure design, coding, testing, deployment, operations. Threat modeling with STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) enumerates risks early; rate them with a scheme such as DREAD or a risk matrix.
Identity is the new perimeter
Know protocols by job: SAML for browser SSO federation, OAuth 2.0 for delegated authorization (tokens and scopes, not authentication), OIDC as the authentication layer on top of OAuth 2.0, and SCIM for provisioning. Traps: calling OAuth an authentication protocol; confusing authorization-code with implicit flow; forgetting that tokens must be validated (signature, audience, expiry) and that microservices must propagate identity rather than trusting internal calls.
Pipeline and testing
SAST inspects source without running it; DAST attacks a running app from outside; SCA checks third-party dependencies; IAST instruments runtime. Secrets must never live in code or images - use a secrets manager and rotate. Immutable infrastructure and IaC scanning catch drift before deployment. Add WAF/RASP for runtime defense and API gateways for rate limiting and schema validation.
Worked example
A serverless function accepts an event payload and passes fields straight into a query and an outbound call. Two problems: injection via unvalidated event data (event injection) and an over-privileged execution role. The fix is input validation plus a least-privilege role per function.
Trap: assuming the provider secures the application because it is 'cloud native'. Providers secure the platform; your code, dependencies, and configurations are yours.