Threats and Attacks in Cloud Environments CSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company uses a cloud-based CRM. Several employees have received emails that appear to be from the CRM vendor, asking them to 'verify their account' by clicking a link and entering their password. Two employees have already complied. What is the most likely attack, and what should the security team do first?

   • AInsider threat from a disgruntled employee. Revoke the affected users' access and conduct a forensic investigation.
   • BDenial-of-service attack on the CRM. Increase the instance size to handle the extra traffic.
   • CPhishing attack leading to credential compromise. Force password resets for affected users and enable MFA for all accounts.
   • DAPI key leakage through a public repository. Rotate all API keys and enable logging.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company's cloud application is protected by a Web Application Firewall (WAF) and DDoS protection. The application still becomes unavailable during a large-scale DDoS attack. The security team discovers that the attack is targeting the application's DNS provider, causing DNS resolution to fail. What is the most effective mitigation?

   • AIncrease the TTL of DNS records to reduce query volume.
   • BUse a managed DNS service with DDoS protection and redundant DNS providers.
   • CMove the application to a different cloud region.
   • DUse a static IP address for the application and bypass DNS.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's web application is hosted on a single cloud VM. During a marketing campaign, the application becomes unresponsive. Monitoring shows a massive spike in inbound traffic from thousands of distinct IP addresses, overwhelming the VM's network bandwidth and CPU. What is the most effective immediate mitigation?

   • AEnable cloud provider's DDoS protection service and configure auto-scaling to add more VM instances.
   • BRestrict inbound traffic to only the company's office IP addresses using a network security group.
   • CIncrease the VM's CPU and memory to handle the additional traffic.
   • DReboot the VM to clear the network connections and restore service.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does inadequate change control contribute to cloud security incidents?

   • AIt ensures all changes are automatically rolled back
   • BIt prevents all misconfigurations
   • CIt reduces the need for monitoring
   • DUnauthorized or untested changes can introduce misconfigurations or weaken security controls
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company exposes a REST API for its cloud service. The API uses API keys for authentication, and the keys are stored in the client-side code of a mobile app. An attacker extracts the API key and uses it to access other users' data by manipulating the user ID in API requests. Which of the following is the most effective way to prevent this type of attack?

   • ARequire the API to validate that the authenticated user is authorized to access the requested resource, and do not rely solely on the API key for authentication.
   • BEncrypt the API key in the mobile app and use a certificate pinning technique.
   • CUse a web application firewall (WAF) to block requests that contain a user ID in the URL.
   • DImplement OAuth 2.0 with short-lived access tokens and require the mobile app to use a client-side certificate.
   Reveal Solution Discussion Select an answer first