Threats and Attacks in Cloud Environments CSE Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A company exposes a public REST API for its cloud application. The API uses API keys passed in the query string for authentication. An attacker intercepts network traffic and captures a valid API key, then uses it to access sensitive data. What is the most effective mitigation?

   • ARotate API keys monthly.
   • BRequire API keys to be sent in the Authorization header over HTTPS, and implement short-lived tokens.
   • CUse a Web Application Firewall (WAF) to block malicious requests.
   • DAdd rate limiting to the API to slow down attackers.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A startup uses a single AWS account for all environments. A developer accidentally creates an S3 bucket with 'Everyone' read access, and the bucket name is publicly discoverable. The security team wants to prevent this class of incident from recurring without blocking the developers' ability to create buckets. Which combination of controls should the security team implement?

   • ARequire all developers to use a pre-approved CloudFormation template that includes a bucket policy, and disable the ability to create buckets through the console.
   • BCreate a custom AWS Config rule that marks any bucket with a public ACL as non-compliant and automatically deletes the bucket after 24 hours.
   • CUse AWS Organizations with a service control policy (SCP) that denies the s3:PutBucketPolicy action unless the bucket is tagged with a specific 'public-allowed' tag, and enable CloudTrail to monitor bucket policy changes.
   • DEnable S3 Block Public Access at the account level and require a multi-factor authentication (MFA) delete on all buckets.
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   What is the primary impact of a distributed denial-of-service (DDoS) attack on a cloud service?

   • ASensitive data is encrypted and held for ransom
   • BData is silently copied to an external server
   • CThe attacker gains administrative access to the cloud account
   • DThe service becomes unavailable to legitimate users due to overwhelming traffic
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A company is evaluating a public cloud provider for a new application that will process sensitive financial data. The company is concerned about the risk of multi-tenant data exposure due to shared infrastructure. Which of the following controls would best address this concern?

   • AEnable encryption for all data at rest and in transit, and use a hardware security module (HSM) to manage keys.
   • BChoose a cloud provider that offers strong isolation guarantees, such as dedicated hosts or confidential computing, and ensure that the provider's security certifications are up to date.
   • CUse a private cloud deployment model to ensure exclusive use of the infrastructure.
   • DImplement a cloud access security broker (CASB) to monitor for data exfiltration.
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A security researcher is testing a cloud provider's container service. The researcher suspects that a container can access the host kernel and potentially read data from other containers on the same node. Which type of vulnerability is the researcher investigating, and what is the most effective mitigation?

   • AInsecure API in the container service. Use API authentication and authorization.
   • BSide-channel attack on the CPU cache. Use dedicated CPU cores for each container.
   • CContainer escape vulnerability. Use a hardened container runtime and run containers with the least privileges necessary.
   • DDenial-of-service attack on the host. Implement resource limits for containers.
   Reveal Solution Discussion Select an answer first