Threats and Attacks in Cloud Environments CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company's cloud environment has experienced multiple security incidents due to misconfigured storage buckets. The security team wants to implement a solution that reduces the risk of future misconfigurations without impeding developers' agility. Which approach is most effective?

   • AImplement infrastructure-as-code with policy-as-code checks that automatically deny non-compliant bucket policies.
   • BUse a cloud security posture management tool that only alerts on misconfigurations after they are deployed.
   • CRequire all storage buckets to be private by default and manually review each bucket annually.
   • DDisable the ability for developers to create storage buckets and require all buckets to be created by the security team.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a shared technology vulnerability in cloud computing?

   • AA vulnerability in a customer's application code
   • BA vulnerability in a customer's operating system image
   • CA vulnerability in the hypervisor that could allow one tenant to access another tenant's data
   • DA vulnerability in a customer's network configuration
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A cloud service provider (CSP) employee with administrative access to a hypervisor is suspected of copying customer virtual machine (VM) images to an external storage device. The CSP wants to detect and deter this type of insider threat. Which control would be most effective?

   • AUse a host-based intrusion detection system (HIDS) on the hypervisor to detect unusual file access patterns.
   • BEncrypt all VM images with a key that is stored in a hardware security module (HSM) and require the employee to use a separate key to decrypt them.
   • CRequire two-person integrity for any operation that exports VM images, and log all such operations to an immutable audit trail.
   • DImplement a data loss prevention (DLP) solution that monitors and blocks the transfer of VM images to external devices.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a primary attack vector in cloud environments?

   • ALAN-based packet sniffing
   • BPhysical theft of servers
   • CInsecure application programming interfaces (APIs)
   • DMalicious USB drives
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company stores sensitive data in a cloud database. An employee with read-only access to the database is able to export the data to a personal cloud storage account and then delete the data from the company's database. The employee had legitimate access for their job role. What is the most effective control to prevent this type of data loss?

   • ADisable the database's export functionality for all users.
   • BImplement data loss prevention (DLP) that monitors and blocks unauthorized data exfiltration, and enforce least-privilege access with separation of duties.
   • CRequire multi-factor authentication for all database users.
   • DEncrypt the database and store the keys in a hardware security module (HSM).
   Reveal Solution Discussion Select an answer first