Module 4: Application Security: Techniques and Best Practices

Looking for ‘Security Best Practices in Google Cloud Module 4 Answers’?

In this post, I provide complete, accurate, and detailed explanations for the answers to Module 4: Application Security: Techniques and Best Practices of Course 10: Security Best Practices in Google Cloud – Preparing for Google Cloud Certification: Cloud Security Engineer Professional Certificate.

Whether you’re preparing for quizzes or brushing up on your knowledge, these insights will help you master the concepts effectively. Let’s dive into the correct answers and detailed explanations for each question!

Application Security: Techniques and Best Practices

Graded Assignment

1. Which TWO of the following statements about Application Security are TRUE?

  • Developers are commonly given a requirements document that clearly defines security requirements for the application.
  • Applications are the most common target of cyberattack. ✅
  • Applications in general, including many web applications, do not properly protect sensitive user data. ✅
  • “Injection Flaws” are the least frequently found application security issue.

Explanation:

  • Applications, especially web-facing ones, are the top targets for attackers because they often expose vulnerabilities.
  • Many applications fail to adequately secure sensitive data, such as PII, login credentials, etc.

2. Which TWO of the following vulnerabilities are scanned for when you use Web Security Scanner?

  • Mixed content. ✅
  • Personalized data in object names.
  • Insecure logins.
  • Outdated or insecure libraries. ✅
  • User data in images.

Explanation:
Web Security Scanner scans for the following common vulnerabilities:

  • Outdated/insecure libraries – Helps you identify code that may be using vulnerable dependencies.
  • Mixed content – Occurs when a secure page (HTTPS) loads resources (images, scripts) over an insecure connection (HTTP), potentially compromising security.

3. Which TWO of the following statements are TRUE when discussing the threat of OAuth and Identity Phishing?

  • Look-alike phishing sites are generally pretty easy to spot.
  • Credit card data is the only information that is useful to cyber hackers.
  • Even small, unimportant pieces of personal data need to be secured from phishing attacks. ✅
  • Being “hacked” on a social site can lead to being “hacked” on more critical websites, depending on your social site’s account settings. ✅

Explanation:

  • Attackers often build a profile using minor personal data for more damaging phishing or impersonation attacks.
  • Many users reuse passwords or link accounts, so compromising a social account can provide access to more sensitive platforms.

Related contents:

Module 2: Securing Compute Engine: Techniques and Best Practices
Module 3: Securing Cloud Data: Techniques and Best Practices
Module 5: Securing Google Kubernetes Engine: Techniques and Best Practices

You might also like:

Course 1: Preparing for Your Professional Cloud Security Engineer Journey
Course 2: Google Cloud Fundamentals: Core Infrastructure
Course 3: Networking in Google Cloud: Fundamentals
Course 4: Networking in Google Cloud: Routing and Addressing
Course 5: Networking in Google Cloud: Network Architecture
Course 6: Networking in Google Cloud: Network Security
Course 7: Networking in Google Cloud: Load Balancing
Course 8: Networking in Google Cloud: Hybrid and Multicloud
Course 9: Managing Security in Google Cloud
Course 11: Mitigating Security Vulnerabilities on Google Cloud
Course 12: Logging and Monitoring in Google Cloud
Course 13: Observability in Google Cloud
Course 14: Hands-On Labs in Google Cloud for Security Engineers

Leave a Reply