Threats and Attacks in Cloud Environments CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company uses a cloud-based infrastructure-as-code tool to deploy resources. A developer accidentally commits a cloud access key to a public GitHub repository. The key is for an IAM role with broad permissions. What is the most immediate action to limit the damage?

   • AEnable multi-factor authentication on the IAM role.
   • BDelete the GitHub repository to remove the key from public view.
   • CRotate the access key immediately and review cloud logs for any unauthorized usage.
   • DChange the IAM role's permissions to read-only.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company's cloud environment was compromised. The investigation reveals that an attacker used a valid API key from a third-party integration to access the company's cloud resources. The API key was stored in a plaintext configuration file on a shared network drive. The company wants to prevent this from happening again. Which combination of controls is most effective?

   • AEncrypt the configuration file and restrict access to the network drive.
   • BMove API keys to a secrets manager, rotate keys automatically, and restrict the permissions of the integration account.
   • CUse a Web Application Firewall to block the attacker's IP address.
   • DChange the API key every six months.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is concerned about the risk of an insider threat from a cloud provider's administrator. The company uses a public cloud provider and stores sensitive data in a database. Which of the following is the most effective control to protect the data from a malicious cloud provider administrator?

   • AEncrypt the data with a customer-managed key (CMK) and use a hardware security module (HSM) to store the key.
   • BRequire the cloud provider to sign a business associate agreement (BAA) that includes security clauses.
   • CUse a virtual private cloud (VPC) to isolate the database from other tenants.
   • DUse a cloud access security broker (CASB) to monitor for unusual database access.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which group of threat actors is most commonly associated with financially motivated attacks targeting cloud environments, such as deploying ransomware or cryptomining?

   • AInsiders
   • BOrganized cybercriminal groups
   • CNation-state actors
   • DHacktivists
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is investigating a potential vulnerability in a cloud provider's hypervisor. The analyst is concerned that a malicious tenant could exploit a hypervisor bug to access memory of other tenants running on the same physical host. Which type of attack is the analyst most concerned about?

   • ACredential stuffing attack on the management console.
   • BSide-channel attack that leaks data across the virtualization boundary.
   • CDistributed denial-of-service attack that overwhelms the host.
   • DPhishing attack targeting cloud provider employees.
   Reveal Solution Discussion Select an answer first