Cloud-Based Attacks PT0-003 Practice Questions (Page 4)

Questions 16–19

1. 16application · medium

   A security engineer is hardening an AWS environment after an SSRF vulnerability was used to access the instance metadata service. Which measure would be most effective in preventing this type of attack?

   • ARestrict access to the metadata service using security group rules.
   • BUse IMDSv2, which requires a session token for metadata requests.
   • CMove all applications to a private subnet.
   • DDisable the metadata service entirely on all EC2 instances.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A penetration tester is assessing a Kubernetes cluster. The tester finds a pod that has the hostPID: true setting. Which attack is most directly enabled by this configuration?

   • AThe pod can access the host's network interfaces.
   • BThe pod can mount the host's filesystem.
   • CThe pod can read the host's Docker socket.
   • DThe pod can see all processes running on the host node.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which container security best practice is most effective in preventing a container escape via a kernel vulnerability?

   • AKeeping the host kernel patched
   • BRunning the container as a non-root user
   • CLimiting container network access
   • DUsing a minimal base image
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a common IAM misconfiguration that allows a user to assume a role they should not have access to?

   • AA security group that allows inbound SSH from anywhere
   • BA password policy that requires a minimum length of 8 characters
   • CAn S3 bucket policy that grants public read access
   • DA trust policy that allows `sts:AssumeRole` from any principal
   Reveal Solution Discussion Select an answer first